S.M.A.R.T repair [Solved]

Ok, here is the log: Scan result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 20-05-2012 Ran by [removed] at 22-05-2012 20:23:35 Running from E:\ Service Pack 1 (X86) OS Language: English(US) Attention: Could not load system hive.ERROR: The process cannot access the file because it is being used by another process. ATTENTION: THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNTION PROPERLY. ========================== Registry (Whitelisted) ============= HKLM\…\Winlogon: [Userinit] [x] HKLM\…\Winlogon: [Shell] ================================ Services (Whitelisted) ================== ========================== Drivers (Whitelisted) ============= ========================== NetSvcs (Whitelisted) =========== ============ One Month Created Files and Folders ============== 2012-05-22 20:23 - 2012-05-22 20:23 - 0000000 ____D C:\FRST 2012-05-22 18:27 - 2012-05-22 18:28 - 0000000 ___SD C:\ComboFix 2012-05-22 17:09 - 2012-05-22 17:09 - 0002319 ____A C:\Users\Liam\Desktop\RKreport[3].txt 2012-05-22 17:08 - 2012-05-22 17:08 - 0131072 ____A C:\Windows\Minidump\052212-68749-01.dmp 2012-05-22 13:22 - 2012-05-22 13:22 - 0002301 ____A C:\Users\Liam\Desktop\RKreport[2].txt 2012-05-22 13:17 - 2012-05-22 13:17 - 0131072 ____A C:\Windows\Minidump\052212-30560-01.dmp 2012-05-22 13:13 - 2012-05-22 19:55 - 0001432 ____A C:\Windows\System32\debug.log 2012-05-22 13:06 - 2012-05-07 18:59 - 0002141 ____A C:\Users\Public\Desktop\Google Earth.lnk 2012-05-22 12:55 - 2011-06-26 16:45 - 0256000 ____A C:\Windows\PEV.exe 2012-05-22 12:55 - 2010-11-08 03:20 - 0208896 ____A C:\Windows\MBR.exe 2012-05-22 12:55 - 2009-04-20 14:56 - 0060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2012-05-22 12:55 - 2000-08-31 10:00 - 0518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2012-05-22 12:55 - 2000-08-31 10:00 - 0406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2012-05-22 12:55 - 2000-08-31 10:00 - 0098816 ____A C:\Windows\sed.exe 2012-05-22 12:55 - 2000-08-31 10:00 - 0080412 ____A C:\Windows\grep.exe 2012-05-22 12:55 - 2000-08-31 10:00 - 0068096 ____A C:\Windows\zip.exe 2012-05-22 12:48 - 2012-05-22 12:48 - 0000000 ____D C:\Windows\ERDNT 2012-05-22 12:48 - 2012-05-22 12:48 - 0000000 ____D C:\Qoobox 2012-05-22 12:38 - 2012-05-22 12:38 - 0002283 ____A C:\Users\Liam\Desktop\RKreport[1].txt 2012-05-22 12:36 - 2012-05-22 12:36 - 0131072 ____A C:\Windows\Minidump\052212-28969-01.dmp 2012-05-22 12:32 - 2012-05-22 17:08 - 0000000 ____D C:\Windows\Minidump 2012-05-22 12:32 - 2012-05-22 17:07 - 253332927 ____A C:\Windows\MEMORY.DMP 2012-05-22 12:32 - 2012-05-22 12:32 - 0131072 ____A C:\Windows\Minidump\052212-28938-01.dmp 2012-05-22 12:31 - 2012-05-22 17:08 - 0000000 ____D C:\Users\Liam\Desktop\RK_Quarantine 2012-05-22 12:29 - 2012-05-22 12:30 - 1454080 ____A C:\Users\Liam\Desktop\RogueKiller.exe 2012-05-21 23:32 - 2012-05-21 23:32 - 0127312 ____A C:\Users\Liam\Desktop\OTL.Txt 2012-05-21 23:10 - 2012-05-21 23:27 - 0000794 ____A C:\Users\Liam\Desktop\unhide.txt 2012-05-21 22:31 - 2012-05-21 22:31 - 0000619 ____A C:\rkill.log 2012-05-21 22:29 - 2012-05-21 22:29 - 1012656 ____A C:\Users\Liam\Desktop\rkill.exe 2012-05-21 22:21 - 2012-05-21 22:21 - 0000000 ____D C:\_OTL 2012-05-21 19:48 - 2012-05-21 19:51 - 0133470 ____A C:\TDSSKiller.2.7.35.0_21.05.2012_19.48.11_log.txt 2012-05-21 19:47 - 2012-05-21 19:47 - 0000000 ____D C:\Users\Liam\Desktop\tdsskiller 2012-05-21 19:47 - 2012-05-16 17:40 - 2126424 ____A (Kaspersky Lab ZAO) C:\Users\Liam\Desktop\TDSSKiller.exe 2012-05-21 14:09 - 2012-05-21 14:09 - 0103000 ____A C:\Users\Liam\AppData\Local\GDIPFONTCACHEV1.DAT 2012-05-21 12:22 - 2012-05-21 12:22 - 0595968 ____A (OldTimer Tools) C:\Users\Liam\Desktop\OTL.exe 2012-05-21 12:20 - 2012-05-18 21:52 - 0002261 ____A C:\Users\Public\Desktop\Google Chrome.lnk 2012-05-21 12:20 - 2012-05-11 22:17 - 0002037 ____A C:\Users\Public\Desktop\DivX Plus Converter.lnk 2012-05-21 12:20 - 2012-05-11 22:16 - 0001057 ____A C:\Users\Public\Desktop\DivX Plus Player.lnk 2012-05-21 12:20 - 2012-04-21 20:53 - 0001810 ____A C:\Users\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk 2012-05-21 12:20 - 2011-10-21 14:35 - 0000914 ____A C:\Users\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk 2012-05-21 12:20 - 2009-07-14 14:41 - 0000174 __ASH C:\Users\All Users\Start Menu\Programs\Startup\desktop.ini 2012-05-21 11:33 - 2012-05-21 11:33 - 0399264 ____A (Bleeping Computer, LLC) C:\Users\Liam\Desktop\unhide.exe 2012-05-21 01:27 - 2012-05-21 01:27 - 0288771 ____A C:\Users\Liam\AppData\Local\census.cache 2012-05-21 01:27 - 2012-05-21 01:27 - 0129958 ____A C:\Users\Liam\AppData\Local\ars.cache 2012-05-21 01:17 - 2012-05-21 01:18 - 0000036 ____A C:\Users\Liam\AppData\Local\housecall.guid.cache 2012-05-20 23:22 - 2012-05-21 00:31 - 0000000 ____D C:\Users\Liam\Desktop\FakeAVRemover 2012-05-20 22:58 - 2012-05-20 22:58 - 0000000 ____D C:\Users\Liam\AppData\Local\ElevatedDiagnostics 2012-05-20 22:52 - 2012-05-22 20:23 - 1930040 ____A C:\Windows\ntbtlog.txt 2012-05-20 22:39 - 2012-05-20 23:28 - 0000152 ____A C:\Users\All Users\-GO9APCOFkP3bgmr 2012-05-20 22:39 - 2012-05-20 23:28 - 0000152 ____A C:\ProgramData\-GO9APCOFkP3bgmr 2012-05-20 22:39 - 2012-05-20 23:28 - 0000000 ____A C:\Users\All Users\-GO9APCOFkP3bgm 2012-05-20 22:39 - 2012-05-20 23:28 - 0000000 ____A C:\ProgramData\-GO9APCOFkP3bgm 2012-05-20 22:13 - 2012-05-20 22:22 - 0108048 ____A C:\Windows\RegBootClean.exe 2012-05-14 21:00 - 2012-05-14 21:00 - 0000000 ____D C:\Program Files\BOINC 2012-05-12 18:41 - 2012-03-17 17:27 - 0056176 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys 2012-05-12 18:41 - 2012-03-03 15:31 - 1077248 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2012-05-12 18:31 - 2012-03-31 14:39 - 3968368 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe 2012-05-12 18:31 - 2012-03-31 14:39 - 3913072 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-05-12 18:31 - 2012-03-31 12:36 - 2343424 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-05-12 18:31 - 2012-03-30 20:23 - 1291632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-05-11 22:17 - 2012-05-22 19:43 - 0000000 ____D C:\Users\Liam\AppData\Roaming\DivX 2012-05-11 22:16 - 2012-05-11 22:16 - 0000000 ____D C:\Program Files\Common Files\PX Storage Engine 2012-05-11 22:14 - 2012-05-11 22:16 - 0000000 ____D C:\Program Files\Common Files\DivX Shared 2012-05-11 21:59 - 2012-05-11 22:17 - 0000000 ____D C:\Program Files\DivX 2012-05-11 21:56 - 2012-05-11 22:17 - 0000000 ____D C:\Users\All Users\DivX 2012-05-11 21:56 - 2012-05-11 22:17 - 0000000 ____D C:\ProgramData\DivX 2012-05-07 18:55 - 2012-05-07 18:55 - 0740000 ____A (Google Inc.) C:\Users\Liam\Downloads\googleupdatesetup.exe 2012-04-30 22:15 - 2012-04-30 22:15 - 0036200 ____A C:\Users\Liam\Downloads\AreaGuard.jar 2012-04-29 20:28 - 2012-04-29 20:28 - 0000442 ___SH C:\Windows\System32\signed_DOCLERW.lic 2012-04-29 20:28 - 2012-04-29 20:28 - 0000272 ___SH C:\Windows\System32\DOCLERW_license_public_key.pem 2012-04-29 20:28 - 2012-04-29 20:28 - 0000021 ____A C:\Windows\System32\dllresult 2012-04-25 21:44 - 2012-04-30 22:27 - 0000000 ____D C:\Users\Liam\Desktop\Bukkit 2012-04-24 17:14 - 2012-04-24 17:09 - 0126428 ____A C:\Users\Liam\Desktop\g3kmc.jpg 2012-04-23 15:43 - 2012-04-28 19:13 - 0000000 ____D C:\Users\Liam\Desktop\Desktop1 ============ 3 Months Modified Files and Folders =============== 2012-05-22 20:23 - 2012-05-22 20:23 - 0000000 ____D C:\FRST 2012-05-22 20:23 - 2012-05-20 22:52 - 1930040 ____A C:\Windows\ntbtlog.txt 2012-05-22 20:22 - 2011-07-22 23:44 - 2175160320 __ASH C:\hiberfil.sys 2012-05-22 20:21 - 2011-11-09 21:39 - 0000000 ____D C:\Users\All Users\BOINC 2012-05-22 20:21 - 2011-11-09 21:39 - 0000000 ____D C:\ProgramData\BOINC 2012-05-22 20:21 - 2011-07-22 23:49 - 1980395 ____A C:\Windows\WindowsUpdate.log 2012-05-22 20:03 - 2009-07-14 14:34 - 0025120 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-05-22 20:03 - 2009-07-14 14:34 - 0025120 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-05-22 20:02 - 2010-11-21 07:01 - 0861432 ____A C:\Windows\System32\PerfStringBackup.INI 2012-05-22 19:55 - 2012-05-22 13:13 - 0001432 ____A C:\Windows\System32\debug.log 2012-05-22 19:55 - 2011-11-01 19:46 - 0000000 ___RD C:\Users\Liam\Dropbox 2012-05-22 19:55 - 2011-11-01 19:45 - 0000000 ____D C:\Users\Liam\AppData\Roaming\Dropbox 2012-05-22 19:55 - 2011-10-21 23:54 - 0000000 ____D C:\Program Files\Steam 2012-05-22 19:54 - 2011-11-22 20:20 - 0000878 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2012-05-22 19:54 - 2009-07-14 14:53 - 0000006 ___AH C:\Windows\Tasks\SA.DAT 2012-05-22 19:54 - 2009-07-14 14:39 - 0063785 ____A C:\Windows\setupact.log 2012-05-22 19:43 - 2012-05-11 22:17 - 0000000 ____D C:\Users\Liam\AppData\Roaming\DivX 2012-05-22 19:22 - 2011-12-21 08:05 - 0000904 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000UA.job 2012-05-22 19:19 - 2011-10-26 22:12 - 0000924 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000UA.job 2012-05-22 19:19 - 2011-10-26 22:12 - 0000902 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000Core.job 2012-05-22 18:51 - 2011-11-22 20:20 - 0000882 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2012-05-22 18:28 - 2012-05-22 18:27 - 0000000 ___SD C:\ComboFix 2012-05-22 17:09 - 2012-05-22 17:09 - 0002319 ____A C:\Users\Liam\Desktop\RKreport[3].txt 2012-05-22 17:08 - 2012-05-22 17:08 - 0131072 ____A C:\Windows\Minidump\052212-68749-01.dmp 2012-05-22 17:08 - 2012-05-22 12:32 - 0000000 ____D C:\Windows\Minidump 2012-05-22 17:08 - 2012-05-22 12:31 - 0000000 ____D C:\Users\Liam\Desktop\RK_Quarantine 2012-05-22 17:07 - 2012-05-22 12:32 - 253332927 ____A C:\Windows\MEMORY.DMP 2012-05-22 13:22 - 2012-05-22 13:22 - 0002301 ____A C:\Users\Liam\Desktop\RKreport[2].txt 2012-05-22 13:17 - 2012-05-22 13:17 - 0131072 ____A C:\Windows\Minidump\052212-30560-01.dmp 2012-05-22 13:11 - 2010-11-21 07:48 - 0319392 ____A C:\Windows\PFRO.log 2012-05-22 12:48 - 2012-05-22 12:48 - 0000000 ____D C:\Windows\ERDNT 2012-05-22 12:48 - 2012-05-22 12:48 - 0000000 ____D C:\Qoobox 2012-05-22 12:38 - 2012-05-22 12:38 - 0002283 ____A C:\Users\Liam\Desktop\RKreport[1].txt 2012-05-22 12:36 - 2012-05-22 12:36 - 0131072 ____A C:\Windows\Minidump\052212-28969-01.dmp 2012-05-22 12:32 - 2012-05-22 12:32 - 0131072 ____A C:\Windows\Minidump\052212-28938-01.dmp 2012-05-22 12:30 - 2012-05-22 12:29 - 1454080 ____A C:\Users\Liam\Desktop\RogueKiller.exe 2012-05-22 00:10 - 2009-07-14 14:53 - 0032604 ____A C:\Windows\Tasks\SCHEDLGU.TXT 2012-05-21 23:32 - 2012-05-21 23:32 - 0127312 ____A C:\Users\Liam\Desktop\OTL.Txt 2012-05-21 23:27 - 2012-05-21 23:10 - 0000794 ____A C:\Users\Liam\Desktop\unhide.txt 2012-05-21 22:31 - 2012-05-21 22:31 - 0000619 ____A C:\rkill.log 2012-05-21 22:29 - 2012-05-21 22:29 - 1012656 ____A C:\Users\Liam\Desktop\rkill.exe 2012-05-21 22:21 - 2012-05-21 22:21 - 0000000 ____D C:\_OTL 2012-05-21 21:22 - 2011-12-21 08:05 - 0000852 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3529970971-4163437698-1443127188-1000Core.job 2012-05-21 20:28 - 2011-10-08 18:26 - 0000258 _RASH C:\Users\All Users\ntuser.pol 2012-05-21 20:28 - 2011-10-08 18:26 - 0000258 _RASH C:\ProgramData\ntuser.pol 2012-05-21 19:51 - 2012-05-21 19:48 - 0133470 ____A C:\TDSSKiller.2.7.35.0_21.05.2012_19.48.11_log.txt 2012-05-21 19:47 - 2012-05-21 19:47 - 0000000 ____D C:\Users\Liam\Desktop\tdsskiller 2012-05-21 19:45 - 2011-10-08 16:16 - 0000000 ____D C:\Users\Liam\AppData\LocalLow 2012-05-21 16:31 - 2009-07-14 12:37 - 0000000 ____D C:\Windows\System32\LogFiles 2012-05-21 14:09 - 2012-05-21 14:09 - 0103000 ____A C:\Users\Liam\AppData\Local\GDIPFONTCACHEV1.DAT 2012-05-21 12:22 - 2012-05-21 12:22 - 0595968 ____A (OldTimer Tools) C:\Users\Liam\Desktop\OTL.exe 2012-05-21 11:33 - 2012-05-21 11:33 - 0399264 ____A (Bleeping Computer, LLC) C:\Users\Liam\Desktop\unhide.exe 2012-05-21 01:27 - 2012-05-21 01:27 - 0288771 ____A C:\Users\Liam\AppData\Local\census.cache 2012-05-21 01:27 - 2012-05-21 01:27 - 0129958 ____A C:\Users\Liam\AppData\Local\ars.cache 2012-05-21 01:18 - 2012-05-21 01:17 - 0000036 ____A C:\Users\Liam\AppData\Local\housecall.guid.cache 2012-05-21 00:33 - 2012-04-04 13:05 - 0000000 ____D C:\Program Files\Optimizer Pro 2012-05-21 00:31 - 2012-05-20 23:22 - 0000000 ____D C:\Users\Liam\Desktop\FakeAVRemover 2012-05-20 23:28 - 2012-05-20 22:39 - 0000152 ____A C:\Users\All Users\-GO9APCOFkP3bgmr 2012-05-20 23:28 - 2012-05-20 22:39 - 0000152 ____A C:\ProgramData\-GO9APCOFkP3bgmr 2012-05-20 23:28 - 2012-05-20 22:39 - 0000000 ____A C:\Users\All Users\-GO9APCOFkP3bgm 2012-05-20 23:28 - 2012-05-20 22:39 - 0000000 ____A C:\ProgramData\-GO9APCOFkP3bgm 2012-05-20 23:15 - 2011-10-08 18:24 - 0000000 ____D C:\Users\All Users\Trend Micro 2012-05-20 23:15 - 2011-10-08 18:24 - 0000000 ____D C:\ProgramData\Trend Micro 2012-05-20 22:58 - 2012-05-20 22:58 - 0000000 ____D C:\Users\Liam\AppData\Local\ElevatedDiagnostics 2012-05-20 22:45 - 2011-10-08 22:49 - 0000000 ____D C:\Program Files\Mozilla Firefox 2012-05-20 22:22 - 2012-05-20 22:13 - 0108048 ____A C:\Windows\RegBootClean.exe 2012-05-20 16:19 - 2011-10-21 23:54 - 0000000 ____D C:\Program Files\Common Files\Steam 2012-05-18 22:20 - 2012-04-11 19:14 - 0001292 ____A C:\Users\Liam\Start Menu\Programs\Startup\Facebook Messenger.lnk 2012-05-18 22:20 - 2012-04-11 19:14 - 0001292 ____A C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk 2012-05-18 21:52 - 2012-05-21 12:20 - 0002261 ____A C:\Users\Public\Desktop\Google Chrome.lnk 2012-05-16 17:40 - 2012-05-21 19:47 - 2126424 ____A (Kaspersky Lab ZAO) C:\Users\Liam\Desktop\TDSSKiller.exe 2012-05-14 21:00 - 2012-05-14 21:00 - 0000000 ____D C:\Program Files\BOINC 2012-05-14 20:59 - 2011-07-23 00:08 - 0000000 ____D C:\Windows\Downloaded Installations 2012-05-13 22:59 - 2009-07-14 12:37 - 0000000 ____D C:\Windows\Microsoft.NET 2012-05-12 20:12 - 2009-07-14 14:33 - 0378840 ____A C:\Windows\System32\FNTCACHE.DAT 2012-05-12 20:10 - 2010-11-21 10:47 - 0000000 ____D C:\Program Files\Windows Journal 2012-05-12 19:40 - 2011-10-08 18:37 - 0000000 ____D C:\Users\All Users\Microsoft Help 2012-05-12 19:40 - 2011-10-08 18:37 - 0000000 ____D C:\ProgramData\Microsoft Help 2012-05-12 19:26 - 2011-07-23 00:14 - 0000000 ____D C:\Program Files\Microsoft Silverlight 2012-05-12 18:57 - 2012-03-31 18:22 - 0419488 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe 2012-05-12 18:57 - 2011-10-08 22:24 - 0070304 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl 2012-05-11 22:17 - 2012-05-21 12:20 - 0002037 ____A C:\Users\Public\Desktop\DivX Plus Converter.lnk 2012-05-11 22:17 - 2012-05-11 21:59 - 0000000 ____D C:\Program Files\DivX 2012-05-11 22:17 - 2012-05-11 21:56 - 0000000 ____D C:\Users\All Users\DivX 2012-05-11 22:17 - 2012-05-11 21:56 - 0000000 ____D C:\ProgramData\DivX 2012-05-11 22:16 - 2012-05-21 12:20 - 0001057 ____A C:\Users\Public\Desktop\DivX Plus Player.lnk 2012-05-11 22:16 - 2012-05-11 22:16 - 0000000 ____D C:\Program Files\Common Files\PX Storage Engine 2012-05-11 22:16 - 2012-05-11 22:14 - 0000000 ____D C:\Program Files\Common Files\DivX Shared 2012-05-11 21:43 - 2011-11-22 14:27 - 0000000 ____D C:\Users\All Users\Vso 2012-05-11 21:43 - 2011-11-22 14:27 - 0000000 ____D C:\ProgramData\Vso 2012-05-11 21:43 - 2011-11-19 14:29 - 0000000 ____D C:\Users\Liam\AppData\Roaming\Vso 2012-05-07 19:56 - 2012-01-28 05:36 - 0000000 ___RD C:\Users\Liam\Documents\Scanned Documents 2012-05-07 18:59 - 2012-05-22 13:06 - 0002141 ____A C:\Users\Public\Desktop\Google Earth.lnk 2012-05-07 18:59 - 2011-11-22 20:20 - 0000000 ____D C:\Users\Liam\AppData\Local\Google 2012-05-07 18:59 - 2011-11-22 20:20 - 0000000 ____D C:\Program Files\Google 2012-05-07 18:55 - 2012-05-07 18:55 - 0740000 ____A (Google Inc.) C:\Users\Liam\Downloads\googleupdatesetup.exe 2012-05-04 02:02 - 2011-10-08 18:57 - 0000000 ____D C:\Users\Liam\AppData\Roaming\Skype 2012-04-30 22:27 - 2012-04-25 21:44 - 0000000 ____D C:\Users\Liam\Desktop\Bukkit 2012-04-30 22:15 - 2012-04-30 22:15 - 0036200 ____A C:\Users\Liam\Downloads\AreaGuard.jar 2012-04-29 20:28 - 2012-04-29 20:28 - 0000442 ___SH C:\Windows\System32\signed_DOCLERW.lic 2012-04-29 20:28 - 2012-04-29 20:28 - 0000272 ___SH C:\Windows\System32\DOCLERW_license_public_key.pem 2012-04-29 20:28 - 2012-04-29 20:28 - 0000021 ____A C:\Windows\System32\dllresult 2012-04-28 20:51 - 2011-10-22 18:30 - 0000000 ____D C:\Users\All Users\DVD Shrink 2012-04-28 20:51 - 2011-10-22 18:30 - 0000000 ____D C:\ProgramData\DVD Shrink 2012-04-28 19:13 - 2012-04-23 15:43 - 0000000 ____D C:\Users\Liam\Desktop\Desktop1 2012-04-26 16:00 - 2011-10-18 00:27 - 0000000 ____D C:\Users\Liam\AppData\Roaming\.minecraft 2012-04-24 17:09 - 2012-04-24 17:14 - 0126428 ____A C:\Users\Liam\Desktop\g3kmc.jpg 2012-04-21 20:53 - 2012-05-21 12:20 - 0001810 ____A C:\Users\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk 2012-04-21 20:53 - 2012-04-18 14:09 - 0000000 ____D C:\Program Files\McAfee Security Scan 2012-04-20 18:28 - 2009-07-14 12:37 - 0000000 ___RD C:\users\Public 2012-04-18 14:16 - 2012-04-18 14:16 - 0000000 ____D C:\Users\Guest\AppData\Roaming\Mozilla 2012-04-18 14:16 - 2012-04-18 14:16 - 0000000 ____D C:\Users\Guest\AppData\Local\Mozilla 2012-04-18 14:09 - 2012-04-18 14:09 - 0000000 ____D C:\Users\All Users\McAfee Security Scan 2012-04-18 14:09 - 2012-04-18 14:09 - 0000000 ____D C:\ProgramData\McAfee Security Scan 2012-04-18 12:45 - 2012-04-18 00:24 - 0103031 ____A C:\Users\Liam\AppData\Roaming\Talk.dmp 2012-04-18 02:01 - 2009-07-14 12:37 - 0000000 ____D C:\Windows\rescache 2012-04-11 19:14 - 2011-10-26 22:12 - 0000000 ____D C:\Users\Liam\AppData\Local\Facebook 2012-04-11 01:12 - 2012-04-11 01:12 - 0065452 ____A C:\Users\Liam\Desktop\DEC_AKLZ001221_1-NZRVFM_1334053191799.pdf 2012-04-06 18:25 - 2009-07-14 14:52 - 0000000 ____D C:\Windows\Downloaded Program Files 2012-04-06 18:03 - 2011-10-27 22:08 - 0000000 ____D C:\Users\Liam\AppData\Local\Windows Live 2012-04-06 17:51 - 2012-04-06 17:38 - 71229297 ____A C:\Users\Liam\Downloads\Ugly.Americans.S02E14.480p._.x264-mSD.mkv 2012-04-04 13:12 - 2012-04-04 13:12 - 0000000 ____D C:\Users\Liam\AppData\Roaming\Optimizer Pro 2012-04-04 13:07 - 2012-04-04 13:07 - 0799664 ____A (Solid State Networks) C:\Users\Liam\Downloads\install_flashplayer11x32ax_gtbd_aih.exe 2012-04-04 13:05 - 2012-04-04 13:05 - 0000000 ____D C:\Users\All Users\Premium 2012-04-04 13:05 - 2012-04-04 13:05 - 0000000 ____D C:\ProgramData\Premium 2012-04-04 13:05 - 2012-04-04 13:04 - 0000000 ____D C:\Users\All Users\Codecv 2012-04-04 13:05 - 2012-04-04 13:04 - 0000000 ____D C:\ProgramData\Codecv 2012-04-04 13:05 - 2012-04-04 13:03 - 0000000 ____D C:\Users\All Users\InstallMate 2012-04-04 13:05 - 2012-04-04 13:03 - 0000000 ____D C:\ProgramData\InstallMate 2012-04-04 13:03 - 2012-04-04 13:03 - 0000000 ____D C:\codec-info 2012-04-04 12:05 - 2012-04-04 12:05 - 0869552 ____A (Space Sciences Laboratory) C:\Windows\boinc.scr 2012-03-31 14:39 - 2012-05-12 18:31 - 3968368 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe 2012-03-31 14:39 - 2012-05-12 18:31 - 3913072 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-03-31 12:36 - 2012-05-12 18:31 - 2343424 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-03-30 20:23 - 2012-05-12 18:31 - 1291632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-03-29 01:39 - 2009-07-14 12:37 - 0000000 ____D C:\Program Files\Common Files\microsoft shared 2012-03-25 23:53 - 2012-02-04 22:02 - 0000000 ____D C:\Users\Liam\AppData\Roaming\NCH Software 2012-03-25 23:53 - 2012-02-04 15:17 - 0000000 ____D C:\Program Files\NCH Software 2012-03-25 23:53 - 2012-02-04 15:16 - 0000000 ____D C:\Users\All Users\NCH Software 2012-03-25 23:53 - 2012-02-04 15:16 - 0000000 ____D C:\ProgramData\NCH Software 2012-03-23 22:54 - 2011-10-09 20:08 - 0000000 ____D C:\Users\Liam\AppData\Roaming\ManyCam 2012-03-21 22:55 - 2011-10-18 23:59 - 0001237 ____A C:\Users\Liam\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk 2012-03-21 22:55 - 2011-10-18 23:59 - 0001237 ____A C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk 2012-03-21 12:31 - 2012-03-21 12:31 - 0001100 ____A C:\Users\Liam\Start Menu\Programs\Startup\DesktopVideoPlayer.lnk 2012-03-21 12:31 - 2012-03-21 12:31 - 0001100 ____A C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DesktopVideoPlayer.lnk 2012-03-21 12:31 - 2012-03-21 12:31 - 0000000 ____D C:\Users\Liam\AppData\Local\vghd 2012-03-17 17:49 - 2012-03-17 13:40 - 159153467 ____A C:\Users\Liam\Downloads\bears_3.wmv 2012-03-17 17:27 - 2012-05-12 18:41 - 0056176 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys 2012-03-16 19:57 - 2012-03-16 19:57 - 0000000 ____D C:\Program Files\Webcam Video Capture 7.0 2012-03-16 19:57 - 2012-03-16 19:57 - 0000000 ____D C:\Program Files\Common Files\Webcam Simulator 2012-03-16 19:41 - 2012-03-16 19:40 - 0000000 ____D C:\Program Files\Webcam Video Capture 2012-03-16 19:39 - 2012-03-16 19:40 - 6901804 ____A (Webcam Simulator ) C:\Users\Liam\Downloads\wvcsetup.exe 2012-03-16 01:12 - 2012-03-16 01:12 - 0000510 ____A C:\settings.ini 2012-03-14 11:56 - 2012-03-14 11:56 - 0000000 ____D C:\Users\Space Colony account\AppData\Roaming\Toshiba 2012-03-14 11:56 - 2012-03-14 11:52 - 0000000 ____D C:\Users\Space Colony account\AppData\Local\VirtualStore 2012-03-14 11:54 - 2012-03-14 11:54 - 0001340 ____A C:\Users\Space Colony account\Desktop\Trend Micro Titanium Maximum Security 2012.lnk 2012-03-14 11:54 - 2012-03-14 11:54 - 0000000 ____D C:\Users\Space Colony account\Documents\DYMO Label 2012-03-14 11:54 - 2012-03-14 11:54 - 0000000 ____D C:\Users\Space Colony account\AppData\Roaming\NCH Software 2012-03-14 11:54 - 2012-03-14 11:54 - 0000000 ____D C:\Users\Space Colony account\AppData\Roaming\BSD 2012-03-14 11:54 - 2012-03-14 11:54 - 0000000 ____D C:\Users\Space Colony account\AppData\Roaming\Apple Computer 2012-03-14 11:54 - 2012-03-14 11:54 - 0000000 ____D C:\Users\Space Colony account\AppData\Local\TOSHIBA 2012-03-14 11:54 - 2012-03-14 11:54 - 0000000 ____D C:\Users\Space Colony account\AppData\Local\DYMO 2012-03-14 11:54 - 2012-03-14 11:51 - 0000000 ____D C:\Users\Space Colony account\AppData\LocalLow 2012-03-14 11:53 - 2012-03-14 11:53 - 0000174 ___SH C:\Users\Space Colony account\Start Menu\Programs\Startup\desktop.ini 2012-03-14 11:53 - 2012-03-14 11:53 - 0000174 ___SH C:\Users\Space Colony account\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2012-03-14 11:53 - 2012-03-14 11:51 - 0000000 ____D C:\users\Space Colony account 2012-03-14 11:52 - 2009-07-14 12:36 - 0000000 __SHD C:\$Recycle.Bin 2012-03-14 11:51 - 2012-03-14 11:51 - 0000020 __ASH C:\Users\Space Colony account\ntuser.ini 2012-03-14 11:51 - 2012-03-14 11:51 - 0000000 __SHD C:\Users\Space Colony account\Templates 2012-03-14 11:51 - 2012-03-14 11:51 - 0000000 __SHD C:\Users\Space Colony account\Start Menu 2012-03-14 11:51 - 2012-03-14 11:51 - 0000000 __SHD C:\Users\Space Colony account\PrintHood 2012-03-14 11:51 - 2012-03-14 11:51 - 0000000 __SHD C:\Users\Space Colony account\NetHood 2012-03-14 11:51 - 2012-03-14 11:51 - 0000000 __SHD C:\Users\Space Colony account\My Documents 2012-03-14 11:51 - 2012-03-14 11:51 - 0000000 __SHD C:\Users\Space Colony account\Documents\My Videos 2012-03-14 11:51 - 2012-03-14 11:51 - 0000000 __SHD C:\Users\Space Colony account\Documents\My Pictures 2012-03-14 11:51 - 2012-03-14 11:51 - 0000000 __SHD C:\Users\Space Colony account\Documents\My Music 2012-03-14 11:51 - 2012-03-14 11:51 - 0000000 __SHD C:\Users\Space Colony account\AppData\Local\Temporary Internet Files 2012-03-14 11:51 - 2012-03-14 11:51 - 0000000 __SHD C:\Users\Space Colony account\AppData\Local\History 2012-03-14 11:36 - 2011-11-15 22:18 - 0000000 ____D C:\Program Files\Firefly Studios 2012-03-14 11:17 - 2011-03-11 14:00 - 0000000 ____D C:\Program Files\InstallShield Installation Information 2012-03-04 16:30 - 2011-11-01 19:45 - 0000967 ____A C:\Users\Liam\Start Menu\Programs\Startup\Dropbox.lnk 2012-03-04 16:30 - 2011-11-01 19:45 - 0000967 ____A C:\Users\Liam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk 2012-03-03 15:31 - 2012-05-12 18:41 - 1077248 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2012-03-01 15:46 - 2012-04-12 02:38 - 0019824 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fs_rec.sys 2012-03-01 15:37 - 2012-04-12 02:38 - 0172544 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll 2012-03-01 15:33 - 2012-04-12 02:38 - 0159232 ____A (Microsoft Corporation) C:\Windows\System32\imagehlp.dll 2012-03-01 15:29 - 2012-04-12 02:38 - 0005120 ____A (Microsoft Corporation) C:\Windows\System32\wmi.dll 2012-02-29 21:02 - 2012-02-29 21:02 - 0000000 ____D C:\Program Files\Nodtronics 2012-02-29 20:56 - 2012-02-29 20:56 - 0000000 ____D C:\Program Files\Common Files\WinHelp 2012-02-28 11:52 - 2012-04-12 02:40 - 12281856 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-02-28 11:27 - 2012-04-12 02:40 - 9705984 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-02-28 11:18 - 2012-04-12 02:40 - 1799168 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-02-28 11:12 - 2012-04-12 02:40 - 1103360 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-02-28 11:11 - 2012-04-12 02:40 - 1427456 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-02-28 11:11 - 2012-04-12 02:40 - 1127424 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-02-28 11:09 - 2012-04-12 02:40 - 0231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-02-28 11:08 - 2012-04-12 02:40 - 0065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-02-28 11:06 - 2012-04-12 02:40 - 0716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-02-28 11:04 - 2012-04-12 02:40 - 1792000 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-02-28 11:03 - 2012-04-12 02:40 - 2382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-02-28 11:03 - 2012-04-12 02:40 - 0072704 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-02-28 10:59 - 2012-04-12 02:40 - 0176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-02-26 16:43 - 2012-02-26 16:43 - 0000000 ____D C:\Program Files\Adobe 2012-02-26 16:43 - 2011-10-08 22:26 - 0000000 ____D C:\Program Files\Common Files\Adobe 2012-02-26 16:43 - 2011-03-11 14:06 - 0000000 ____D C:\Users\All Users\Adobe 2012-02-26 16:43 - 2011-03-11 14:06 - 0000000 ____D C:\ProgramData\Adobe 2012-02-26 16:42 - 2011-10-08 19:25 - 0000000 ____D C:\Users\Liam\AppData\Local\Adobe 2012-02-25 23:34 - 2012-02-25 23:34 - 1664192 ____A (W3i, LLC) C:\Users\Liam\Downloads\applianflv_upgrade_1472.exe 2012-02-25 23:34 - 2012-02-25 23:34 - 1664192 ____A (W3i, LLC) C:\Users\Liam\Downloads\applianflv_upgrade_1472 (1).exe 2012-02-25 10:54 - 2012-02-25 10:49 - 0000000 ____D C:\Users\Liam\AppData\Roaming\uTorrent 2012-02-25 10:49 - 2012-02-25 10:49 - 0000000 ____D C:\Users\Liam\AppData\Local\uTorrent 2012-02-24 01:03 - 2012-02-24 01:03 - 3695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat 2012-02-24 01:03 - 2012-02-24 01:03 - 0580608 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0434176 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0367104 ____A (Microsoft Corporation) C:\Windows\System32\html.iec 2012-02-24 01:03 - 2012-02-24 01:03 - 0353792 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0353584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0227840 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0223232 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0203776 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0162304 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0161792 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0152064 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe 2012-02-24 01:03 - 2012-02-24 01:03 - 0150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe 2012-02-24 01:03 - 2012-02-24 01:03 - 0142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-02-24 01:03 - 2012-02-24 01:03 - 0130560 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0123392 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0118784 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0101888 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0086528 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0078848 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0076800 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe 2012-02-24 01:03 - 2012-02-24 01:03 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe 2012-02-24 01:03 - 2012-02-24 01:03 - 0074752 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0074240 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2012-02-24 01:03 - 2012-02-24 01:03 - 0072822 ____A C:\Windows\System32\ieuinit.inf 2012-02-24 01:03 - 2012-02-24 01:03 - 0066048 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0063488 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx 2012-02-24 01:03 - 2012-02-24 01:03 - 0054272 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0041472 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0035840 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0031744 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0023552 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll 2012-02-24 01:03 - 2012-02-24 01:03 - 0011776 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe 2012-02-24 01:03 - 2012-02-24 01:03 - 0010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe 2012-02-24 01:03 - 2012-02-24 01:02 - 0003397 ____A C:\Windows\IE9_main.log 2012-02-23 13:54 - 2011-10-08 22:30 - 0000000 ____D C:\Program Files\World of Warcraft ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\…\.exe: <===== ATTENTION! HKLM\…\exefile\DefaultIcon: <===== ATTENTION! HKLM\…\exefile\open\command: <===== ATTENTION! ========================= Memory info ====================== Percentage of memory in use: 31% Total physical RAM: 2765.86 MB Available physical RAM: 1900.59 MB Total Pagefile: 5530 MB Available Pagefile: 4676.57 MB Total Virtual: 2047.88 MB Available Virtual: 1931.99 MB ======================= Partitions ========================= 1 Drive c: (S3A8972D004) (Fixed) (Total:455.03 GB) (Free:200.12 GB) NTFS ==>[System with boot components (obtained from reading drive)] 3 Drive e: () (Removable) (Total:14.8 GB) (Free:14.8 GB) FAT32 Disk ### Status Size Free Dyn Gpt ——– ————- ——- ——- — — Disk 0 Online 465 GB 0 B Disk 1 Online 14 GB 0 B Partitions of Disk 0: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Recovery 1500 MB 1024 KB Partition 2 Primary 455 GB 1501 MB Partition 3 Primary 9 GB 456 GB ================================================================================ ====================== Disk: 0 Partition 1 Type : 27 Hidden: Yes Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 2 System NTFS Partition 1500 MB Healthy Hidden ================================================================================ ====================== Disk: 0 Partition 2 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 1 C S3A8972D004 NTFS Partition 455 GB Healthy Boot ================================================================================ ====================== Disk: 0 Partition 3 Type : 17 (Suspicious Type) Hidden: Yes Active: No There is no volume associated with this partition. ================================================================================ ====================== Partitions of Disk 1: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Primary 14 GB 4096 KB ================================================================================ ====================== Disk: 1 Partition 1 Type : 0C Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 3 E FAT32 Removable 14 GB Healthy ================================================================================ ====================== ========================================================== Last Boot: 2012-05-02 22:19 ======================= End Of Log ==========================

Heres the DDS.txt, and the program said to zip and attach the other one. . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29 Run by [removed] at 12:24:18 on 2012-05-24 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.2766.1471 [GMT 10:00] . AV: Trend Micro Titanium Maximum Security 2012 *Disabled/Updated* {7193B549-236F-55EE-9AEC-F65279E59A92} SP: Trend Micro Titanium Maximum Security 2012 *Disabled/Updated* {CAF254AD-0555-5A60-A05C-CD200262D02F} . ============== Running Processes =============== . C:\windows\system32\wininit.exe C:\windows\system32\lsm.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\svchost.exe -k RPCSS C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\windows\system32\svchost.exe -k LocalService C:\windows\system32\svchost.exe -k NetworkService C:\windows\system32\WLANExt.exe C:\windows\system32\conhost.exe C:\windows\System32\spoolsv.exe C:\windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe C:\Program Files\Ant.com\IE add-on\AntUpdaterService.exe C:\windows\system32\taskhost.exe C:\windows\system32\Dwm.exe C:\windows\Explorer.EXE C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\windows\system32\igfxsrvc.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\BSD\AppUpdater\BSDChecker.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\DYMO\DYMO Label Software\DLSService.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\DivX\DivX Update\DivXUpdate.exe C:\Program Files\BOINC\boinctray.exe C:\Program Files\Steam\Steam.exe C:\Program Files\ManyCam\Bin\ManyCam.exe C:\windows\system32\igfxext.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\System32\StikyNot.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe C:\Users\Liam\AppData\Local\vghd\bin\vghd.exe C:\Users\Liam\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\windows\system32\taskeng.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe C:\Program Files\Norton PC Checkup\Engine\2.0.3.202\SymcPCCULaunchSvc.exe C:\Program Files\Norton PC Checkup\Engine\2.0.3.202\ccSvcHst.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\windows\system32\svchost.exe -k imgsvc C:\windows\system32\TODDSrv.exe C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\windows\system32\SearchIndexer.exe C:\Users\Liam\AppData\Local\vghd\bin\VirtuaGirl_Downloader.exe C:\Program Files\iPod\bin\iPodService.exe C:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Norton PC Checkup\Engine\2.0.3.202\ccSvcHst.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe C:\windows\system32\conhost.exe C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe C:\Program Files\Common Files\Apple\Mobile Device Support\SyncServer.exe C:\windows\system32\conhost.exe C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\windows\system32\wuauclt.exe C:\Program Files\Common Files\Java\Java Update\jucheck.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Ant.com\IE add-on\antmaintainer.exe C:\Users\Liam\AppData\Local\Google\Chrome\Application\19.0.1084.52\chrome_frame_helper.exe C:\windows\system32\msiexec.exe C:\Program Files\Internet Explorer\iexplore.exe C:\windows\system32\SearchProtocolHost.exe C:\windows\system32\SearchFilterHost.exe C:\windows\system32\conhost.exe C:\windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com.au/ uDefault_Page_URL = hxxp://toshiba.msn.com mStart Page = about:blank uInternet Settings,ProxyOverride = *.local BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - c:\program files\trend micro\amsp\module\20004\2.0.1313\6.8.1078\TmIEPlg.dll BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll BHO: Ant.com browser helper (video detector): {346fde31-dff9-418a-90c8-ba31dc9ff2ef} - c:\program files\ant.com\ie add-on\download.dll BHO: TSToolbarBHO: {43c6d902-a1c5-45c9-91f6-fd9e90337e18} - c:\program files\trend micro\titanium\uiframework\ToolbarIE.dll BHO: StartNow Toolbar Helper: {6e13d095-45c3-4271-9475-f3b48227dd9f} - c:\program files\startnow toolbar\Toolbar32.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\mif5ba~1\office14\URLREDIR.DLL BHO: TmBpIeBHO Class: {bbacbafd-fa5e-4079-8b33-00eb9f13d4ac} - c:\program files\trend micro\amsp\module\20002\7.1.1102\7.1.1102\TmBpIe32.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: TOSHIBA Media Controller Plug-in: {f3c88694-effa-4d78-b409-54b7b2535b14} - c:\program files\toshiba\toshiba media controller plug-in\TOSHIBAMediaControllerIE.dll BHO: Yontoo Layers (Drop Down Deals): {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo layers runtime (drop down deals)\YontooIEClient.dll TB: Trend Micro Toolbar: {ccac5586-44d7-4c43-b64a-f042461a97d2} - c:\program files\trend micro\titanium\uiframework\ToolbarIE.dll TB: StartNow Toolbar: {5911488e-9d1e-40ec-8cbb-06b231cc153f} - c:\program files\startnow toolbar\Toolbar32.dll TB: Ant.com Video Downloader toolbar: {2e924f4f-67f0-4bd8-9560-49f468e843d2} - c:\program files\ant.com\ie add-on\anttoolbar.dll TB: Alexa Toolbar: {ea582743-9076-4178-9aa6-7393fdf4d5ce} - c:\program files\alexa toolbar\AlexaToolbar.10.0.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [Steam] "c:\program files\steam\Steam.exe" -silent uRun: [Facebook Update] "c:\users\liam\appdata\local\facebook\update\FacebookUpdate.exe" /c /nocrashserver uRun: [Google Update] "c:\users\liam\appdata\local\google\update\GoogleUpdate.exe" /c uRun: [ManyCam] "c:\program files\manycam\bin\ManyCam.exe" /silent uRun: [Optimizer Pro] c:\program files\optimizer pro\OptProLauncher.exe uRun: [RESTART_STICKY_NOTES] c:\windows\system32\StikyNot.exe uRun: [ChromeFrameHelper] "c:\users\liam\appdata\local\google\chrome\application\19.0.1084.52\chrome_frame_helper.exe" –startup mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE mRun: [TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe mRun: [SmartAudio] c:\program files\conexant\saii\SAIICpl.exe /t mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe mRun: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START mRun: [TosSENotify] c:\program files\toshiba\toshiba hdd ssd alert\TosWaitSrv.exe mRun: [NortonOnlineBackup] c:\program files\symantec\norton online backup\NOBuClient.exe mRun: [TosVolRegulator] c:\program files\toshiba\tosvolregulator\TosVolRegulator.exe mRun: [TosNC] %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe mRun: [TosReelTimeMonitor] %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe mRun: [Trend Micro Titanium] "c:\program files\trend micro\titanium\uiframework\uiWinMgr.exe" -set Silent "1" SplashURL "" mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [BSDAppUpdater] c:\program files\common files\bsd\appupdater\BSDChecker.exe mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [DLSService] "c:\program files\dymo\dymo label software\DLSService.exe" mRun: [Talk] "c:\program files\nch software\talk\talk.exe" -logon mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [Trend Micro Client Framework] "c:\program files\trend micro\uniclient\uifrmwrk\UIWatchDog.exe" mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW mRun: [boincmgr] "c:\program files\boinc\boincmgr.exe" /a /s mRun: [boinctray] "c:\program files\boinc\boinctray.exe" StartupFolder: c:\users\liam\appdata\roaming\micros~1\windows\startm~1\programs\startup\deskto~1.lnk - c:\users\liam\appdata\local\vghd\bin\vghd.exe StartupFolder: c:\users\liam\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\liam\appdata\roaming\dropbox\bin\Dropbox.exe StartupFolder: c:\users\liam\appdata\roaming\micros~1\windows\startm~1\programs\startup\facebo~1.lnk - c:\users\liam\appdata\local\facebook\messenger\2.1.4520.0\FacebookMessenger.exe StartupFolder: c:\users\liam\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office14\ONENOTEM.EXE StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: Add to TOSHIBA Bulletin Board - c:\program files\toshiba\bulletinboard\TosBBCom.dll/1000 IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\mif5ba~1\office14\ONBttnIE.dll/105 IE: {76c5fb99-dd0a-4186-9e75-65d1bf3da283} - c:\program files\amazon\add to wish list ie extension\run.htm IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll IE: {70AF6C9F-0818-4cf7-924A-BBDBB24211D3} - {70AF6C9F-0818-4cf7-924A-BBDBB24211D3} - c:\program files\ant.com\ie add-on\download.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {97F922BD-8563-4184-87EE-8C4ACA438823} - {5D29E593-73A5-400A-B3BD-6B7A1AF05A31} - c:\program files\toshiba\bulletinboard\TosBBCom.dll DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab TCP: DhcpNameServer = 10.0.0.138 TCP: Interfaces\{0157329A-30D5-472A-A22A-FBEC916FD376} : DhcpNameServer = 10.0.0.138 TCP: Interfaces\{0157329A-30D5-472A-A22A-FBEC916FD376}\76C6F626F64697E6560296E636E202C4C434E2 : DhcpNameServer = 192.168.0.1 TCP: Interfaces\{0157329A-30D5-472A-A22A-FBEC916FD376}\E4544574541425 : DhcpNameServer = [removed] [removed] TCP: Interfaces\{0EF42FF1-5F08-4E45-A150-7F0F8E641BA0} : DhcpNameServer = 10.0.0.138 TCP: Interfaces\{2C5719F9-2429-4ADE-B29D-843F67C9A841} : DhcpNameServer = [removed] [removed] Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\users\liam\appdata\local\google\chrome\application\19.0.1084.52\npchrome_frame.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - c:\program files\trend micro\amsp\module\20002\7.1.1102\7.1.1102\TmBpIe32.dll Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\program files\trend micro\amsp\module\20004\2.0.1313\6.8.1078\TmIEPlg.dll Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - c:\program files\trend micro\titanium\uiframework\ToolbarIE.dll Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - c:\program files\trend micro\titanium\uiframework\ProToolbarIMRatingActiveX.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll Notify: igfxcui - igfxdev.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\users\liam\appdata\roaming\mozilla\firefox\profiles\9uxzcp68.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/?pc=Z190&ocid=zdhp&install_date=20111126 FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z190&form=ZGAADF&install_date=20111126&q= FF - plugin: c:\progra~1\mif5ba~1\office14\NPAUTHZ.DLL FF - plugin: c:\progra~1\mif5ba~1\office14\NPSPWRAP.DLL FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll FF - plugin: c:\program files\dymo\dymo label software\framework\npDYMOLabelFramework.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll FF - plugin: c:\program files\trend micro\titanium\uiframework\toolbar\firefoxextension\components\npToolbarChrome.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - plugin: c:\users\liam\appdata\local\facebook\messenger\2.1.4520.0\npFbDesktopPlugin.dll FF - plugin: c:\users\liam\appdata\local\facebook\video\skype\npFacebookVideoCalling.dll FF - plugin: c:\users\liam\appdata\local\google\update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_235.dll . —- FIREFOX POLICIES —- FF - user.js: general.useragent.extra.brc - FF - user.js: extentions.y2layers.installId - 3847906a-066e-4d4e-a9b8-f519f984b11f FF - user.js: extentions.y2layers.defaultEnableAppsList - BuzzDock,Buzzdock,BuzzdockTease,DropDownDeals, . ============= SERVICES / DRIVERS =============== . R0 SCMNdisP;General NDIS Protocol Driver;c:\windows\system32\drivers\SCMNdisP.sys [2011-11-4 21728] R1 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2011-10-8 68368] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128] R2 AntUpdaterService;Ant Toolbar updater service;c:\program files\ant.com\ie add-on\AntUpdaterService.exe [2011-6-29 520216] R2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\toshiba\configfree\CFIWmxSvcs.exe [2010-1-29 185712] R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2009-3-11 46448] R2 MSSQL$INFLOWSQL;SQL Server (INFLOWSQL);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-11 29293408] R2 NOBU;Norton Online Backup;c:\program files\symantec\norton online backup\nobuagent.exe service –> c:\program files\symantec\norton online backup\NOBuAgent.exe service [?] R2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files\norton pc checkup\engine\2.0.3.202\SymcPCCULaunchSvc.exe [2011-7-23 103792] R2 PCCUJobMgr;Common Client Job Manager Service;c:\program files\norton pc checkup\engine\2.0.3.202\ccSvcHst.exe [2011-7-23 126392] R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\intel\intel® management engine components\uns\UNS.exe [2011-7-22 2656280] R3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\drivers\btfilter.sys [2011-7-23 33640] R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2011-7-22 7680] R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C62x86.sys [2011-2-10 68720] R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-1-14 21632] R3 MEI;Intel® Management Engine Interface;c:\windows\system32\drivers\HECI.sys [2011-7-22 41088] R3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [2011-7-23 33616] R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\toshiba\toshiba hdd ssd alert\TosSmartSrv.exe [2010-12-9 112032] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336] S2 Amsp;Trend Micro Solution Platform;c:\program files\trend micro\amsp\coreServiceShell.exe [2011-10-8 200632] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 DymoPnpService;DYMO PnP Service;"c:\program files\dymo\dymo label software\dymopnpservice.exe" –> c:\program files\dymo\dymo label software\DymoPnpService.exe [?] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-11-22 136176] S2 WSWNA3100;WSWNA3100;c:\program files\netgear\wna3100\WifiSvc.exe [2011-11-4 285152] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888] S3 ExpressAccountsService;Express Accounts;c:\program files\nch software\expressaccounts\expressaccounts.exe [2012-2-4 2985988] S3 ExpressInvoiceService;Express Invoice;c:\program files\nch software\expressinvoice\expressinvoice.exe [2012-2-4 1987588] S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-7-23 39272] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-11-22 136176] S3 InventoriaService;Inventoria Stock Manager;c:\program files\nch software\inventoria\inventoria.exe [2012-2-4 1511428] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232] S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2011-8-2 18432] S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2011-7-23 190464] S3 TMachInfo;TMachInfo;c:\program files\toshiba\toshiba service station\TMachInfo.exe [2011-7-23 54136] S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2010-11-21 52224] S3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 27264] S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-10-10 1343400] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520] S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-23 51040] . =============== Created Last 30 ================ . 2012-05-23 12:47:39 ——– d—–w- c:\users\liam\appdata\roaming\Malwarebytes 2012-05-22 12:41:20 ——– d—–w- c:\programdata\Malwarebytes 2012-05-22 12:41:17 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-05-22 12:41:17 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2012-05-22 10:23:33 ——– d—–w- C:\FRST 2012-05-22 08:27:42 ——– d-s—w- C:\ComboFix 2012-05-22 03:10:40 ——– d—–w- c:\users\liam\appdata\local\temp 2012-05-22 02:55:59 98816 —-a-w- c:\windows\sed.exe 2012-05-22 02:55:59 518144 —-a-w- c:\windows\SWREG.exe 2012-05-22 02:55:59 256000 —-a-w- c:\windows\PEV.exe 2012-05-22 02:55:59 208896 —-a-w- c:\windows\MBR.exe 2012-05-21 12:21:46 ——– d—–w- C:\_OTL 2012-05-20 12:58:10 ——– d—–w- c:\users\liam\appdata\local\ElevatedDiagnostics 2012-05-20 12:13:27 108048 —-a-w- c:\windows\RegBootClean.exe 2012-05-14 11:00:45 334008 —-a-r- c:\users\liam\appdata\roaming\microsoft\installer\{905d6095-7f38-43f3-82a4-8a36e5a00fad}\BOINCMGRLink_B65C4A4D2B2A46CCA2D918164C6297B8.exe 2012-05-14 11:00:45 334008 —-a-r- c:\users\liam\appdata\roaming\microsoft\installer\{905d6095-7f38-43f3-82a4-8a36e5a00fad}\ARPPRODUCTICON.exe 2012-05-14 11:00:43 ——– d—–w- c:\program files\BOINC 2012-05-12 08:41:32 56176 —-a-w- c:\windows\system32\drivers\partmgr.sys 2012-05-12 08:41:31 1077248 —-a-w- c:\windows\system32\DWrite.dll 2012-05-12 08:31:45 1291632 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-05-12 08:31:44 989184 —-a-w- c:\program files\windows journal\JNTFiltr.dll 2012-05-12 08:31:44 969216 —-a-w- c:\program files\windows journal\JNWDRV.dll 2012-05-12 08:31:44 936960 —-a-w- c:\program files\common files\microsoft shared\ink\journal.dll 2012-05-12 08:31:44 1221632 —-a-w- c:\program files\windows journal\NBDoc.DLL 2012-05-12 08:31:38 3968368 —-a-w- c:\windows\system32\ntkrnlpa.exe 2012-05-12 08:31:37 3913072 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-12 08:31:37 2343424 —-a-w- c:\windows\system32\win32k.sys 2012-05-11 12:16:23 ——– d—–w- c:\program files\common files\PX Storage Engine 2012-05-11 12:14:53 ——– d—–w- c:\program files\common files\DivX Shared 2012-05-11 11:59:11 ——– d—–w- c:\program files\DivX 2012-05-11 11:56:49 ——– d—–w- c:\programdata\DivX . ==================== Find3M ==================== . 2012-05-12 08:57:32 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-05-12 08:57:32 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-04-04 02:05:44 869552 —-a-w- c:\windows\boinc.scr 2012-03-01 05:46:57 19824 —-a-w- c:\windows\system32\drivers\fs_rec.sys 2012-03-01 05:37:41 172544 —-a-w- c:\windows\system32\wintrust.dll 2012-03-01 05:33:23 159232 —-a-w- c:\windows\system32\imagehlp.dll 2012-03-01 05:29:16 5120 —-a-w- c:\windows\system32\wmi.dll 2012-02-28 01:18:55 1799168 —-a-w- c:\windows\system32\jscript9.dll 2012-02-28 01:11:21 1427456 —-a-w- c:\windows\system32\inetcpl.cpl 2012-02-28 01:11:07 1127424 —-a-w- c:\windows\system32\wininet.dll 2012-02-28 01:03:16 2382848 —-a-w- c:\windows\system32\mshtml.tlb . ============= FINISH: 12:28:29.47 ===============