This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Explorer.exe problems, possible Malware? [Solved]

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

First, the instructions say for Windows 7 or Vista users but I still have XP. As you will see in the scan text that I have not yet upgraded this computer to SP3. I will do that this weekend. Also, I have not run any of my regular scans for a while. I've also been having issues with my Acronis backup software which I've been working with them to solve. I'm still not certain if this is a hardware issue, because I am currently on my fourth SSD drive. The first one died after two months, the second after a year, the third (refurbished) died almost immediately, and I just installed the recent one within the last month or two. I also recently replaced the power supply and RAM when the system became unresponsive. The reason I am not entirely convinced at this point whether or not it's a hardware issue with the new SSD drive, is that I dumped the most recent image back onto the original platter drive, and chose that drive from the boot menu (which still starts on the SSD drive), and when I got up this morning the computer was completely froze and I had a hard boot It. So I would appreciate your help to see if I have something else going on here.

Thanks
Eric

OTL.txt


OTL logfile created on: 5/31/2012 7:25:01 AM - Run 1
OTL by OldTimer - Version 3.2.44.0 Folder = C:Documents and SettingsericjsDesktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.12 Gb Total Physical Memory | 2.03 Gb Available Physical Memory | 65.02% Memory free
8.82 Gb Paging File | 7.86 Gb Available in Paging File | 89.02% Paging File free
Paging file location(s): E:pagefile.sys 6000 6000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:WINDOWS | %ProgramFiles% = C:Program Files
Drive C: | 55.90 Gb Total Space | 18.21 Gb Free Space | 32.57% Space Free | Partition Type: NTFS
Drive E: | 249.32 Gb Total Space | 88.78 Gb Free Space | 35.61% Space Free | Partition Type: NTFS
Drive F: | 59.62 Gb Total Space | 22.04 Gb Free Space | 36.97% Space Free | Partition Type: NTFS
Drive G: | 401.11 Gb Total Space | 144.43 Gb Free Space | 36.01% Space Free | Partition Type: NTFS
Drive H: | 156.82 Gb Total Space | 27.70 Gb Free Space | 17.67% Space Free | Partition Type: NTFS
Drive I: | 470.78 Gb Total Space | 420.63 Gb Free Space | 89.35% Space Free | Partition Type: NTFS
Drive K: | 292.48 Gb Total Space | 14.04 Gb Free Space | 4.80% Space Free | Partition Type: NTFS

Computer Name: MAIN | User Name: ericjs | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:Documents and SettingsericjsDesktopOTL.exe (OldTimer Tools)
PRC - C:WINDOWSsystem32MacromedFlashFlashPlayerUpdateService.exe (Adobe Systems Incorporated)
PRC - C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe (Malwarebytes Corporation)
PRC - C:Program FilesAcronisARSMarsm.exe (Acronis)
PRC - C:Program FilesCommon FilesAcronisTimounterTimounterMonitor.exe (Acronis)
PRC - C:Program FilesAcronisBackupAndRecoverymms.exe (Acronis)
PRC - C:Program FilesAcronisTrayMonitorTrayMonitor.exe (Acronis)
PRC - C:Program FilesCommon FilesAcronisSchedule2schedul2.exe (Acronis)
PRC - C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe (Acronis)
PRC - C:Program FilesCommon FilesAcronisAgentagent.exe (Acronis)
PRC - C:Program FilesMotorolaMotoHelperMotoHelperAgent.exe ()
PRC - C:Program FilesMotorolaMotoHelperMotoHelperService.exe ()
PRC - C:Program FilesAlwil SoftwareAvast5AvastUI.exe (AVAST Software)
PRC - C:Program FilesAlwil SoftwareAvast5AvastSvc.exe (AVAST Software)
PRC - C:Program FilesDivXDivX UpdateDivXUpdate.exe ()
PRC - C:Program FilesUltraMonUltraMonTaskbar.exe (Realtime Soft Ltd)
PRC - C:Program FilesUltraMonUltraMon.exe (Realtime Soft Ltd)
PRC - C:Program FilesMicrosoft Forefront UAGEndpoint Components3.1.0uagqecsvc.exe (Microsoft Corporation)
PRC - C:Program FilesToshibaBluetooth Toshiba StackTosBtSrv.exe (TOSHIBA CORPORATION)
PRC - C:Program FilesFolderSizeFolderSizeSvc.exe (Brio)
PRC - C:Program FilesLogitechLogitech WebCam SoftwareLWS.exe ()
PRC - C:Program FilesCommon FilesLogiShrdLQCVFXCOCIManager.exe ()
PRC - C:Program FilesCommon FilesLogiShrdLVMVFMLVPrcSrv.exe (Logitech Inc.)
PRC - C:Program FilesSpybot - Search & DestroyTeaTimer.exe (Safer-Networking Ltd.)
PRC - C:WINDOWSsystem32CtHelper.exe (Creative Technology Ltd)
PRC - C:WINDOWSsystem32rserver30rserver3.exe (Famatech International Corp.)
PRC - C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe (NeoSmart Technologies)
PRC - C:Program FilesMacro Express3MacExp.exe (Insight Software Solutions)
PRC - C:WINDOWSsystem32WTabletPen_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:WINDOWSsystem32Pen_Tablet.exe (Wacom Technology, Corp.)
PRC - C:WINDOWSsystem32rserver30FamItrfc.Exe (Famatech International Corp.)
PRC - C:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe (Protexis Inc.)
PRC - C:WINDOWSexplorer.exe (Microsoft Corporation)
PRC - C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe (InterVideo)
PRC - C:Program FilesMagicDiscMagicDisc.exe ()
PRC - C:Program FilesAPCAPC PowerChute Personal Editionapcsystray.exe (American Power Conversion Corporation)
PRC - C:Program FilesAPCAPC PowerChute Personal Editionmainserv.exe (American Power Conversion Corporation)
PRC - C:WINDOWSsystem32sndvol32.exe (Microsoft Corporation)
PRC - G:dlUtilsNetPerSecNetPerSec.exe (Ziff-Davis Media, Inc.)


========== Modules (No Company Name) ==========

MOD - C:Program FilesAlwil SoftwareAvast5defs12053100algo.dll ()
MOD - C:Program FilesAlwil SoftwareAvast5defs12053002algo.dll ()
MOD - C:Program FilesCommon FilesAcronisBackupAndRecoveryCommonFileTrace.dll ()
MOD - C:Program FilesCommon FilesAcronisBackupAndRecoveryCommonevents_trace.dll ()
MOD - C:Program FilesCommon FilesAcronisBackupAndRecoveryCommonfnls.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DisplaysManager.Graphics.Wizard2.0.3343
.28228__90ba9c70f846762eCLI.Aspect.DisplaysManager.Graphics.Wizard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceCV.Graphics.Wizard2.0.3343.28295_
_90ba9c70f846762eCLI.Aspect.DeviceCV.Graphics.Wizard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.TransCode.Graphics.Wizard2.0.3343.28338
__90ba9c70f846762eCLI.Aspect.TransCode.Graphics.Wizard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceTV.Graphics.Wizard2.0.3343.28315_
_90ba9c70f846762eCLI.Aspect.DeviceTV.Graphics.Wizard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Caste.Graphics.Runtime2.0.3343.28200__90ba9c70
f846762eCLI.Caste.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.InfoCentre.Graphics.Wizard2.0.3343.2822
9__90ba9c70f846762eCLI.Aspect.InfoCentre.Graphics.Wizard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceTV.Graphics.Runtime2.0.3343.28309
__90ba9c70f846762eCLI.Aspect.DeviceTV.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceCV.Graphics.Runtime2.0.3343.28281
__90ba9c70f846762eCLI.Aspect.DeviceCV.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Caste.Graphics.Wizard2.0.3343.28221__90ba9c70f
846762eCLI.Caste.Graphics.Wizard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceProperty.Graphics.Runtime2.0.3343
.28263__90ba9c70f846762eCLI.Aspect.DeviceProperty.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.HotkeysHandling.Graphics.Runtime2.0.334
3.28213__90ba9c70f846762eCLI.Aspect.HotkeysHandling.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Caste.HydraVision.Runtime2.0.3343.28356__90ba9
c70f846762eCLI.Caste.HydraVision.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Caste.HydraVision.Shared2.0.3343.28356__90ba9c
70f846762eCLI.Caste.HydraVision.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Caste.HydraVision.Wizard2.0.3343.28359__90ba9c
70f846762eCLI.Caste.HydraVision.Wizard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Caste.HydraVision.Dashboard2.0.3343.28356__90b
a9c70f846762eCLI.Caste.HydraVision.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.Radeon3D.Graphics.Dashboard2.0.3343.282
88__90ba9c70f846762eCLI.Aspect.Radeon3D.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.Welcome.Graphics.Dashboard2.0.3343.2833
9__90ba9c70f846762eCLI.Aspect.Welcome.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.VPURecover.Graphics.Dashboard2.0.3343.2
8229__90ba9c70f846762eCLI.Aspect.VPURecover.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.Radeon3D.Graphics.Wizard2.0.3343.28289_
_90ba9c70f846762eCLI.Aspect.Radeon3D.Graphics.Wizard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Caste.Graphics.Dashboard2.0.3343.28213__90ba9c
70f846762eCLI.Caste.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.Radeon3D.Graphics.Runtime2.0.3343.28288
__90ba9c70f846762eCLI.Aspect.Radeon3D.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.VPURecover.Graphics.Runtime2.0.3343.282
28__90ba9c70f846762eCLI.Aspect.VPURecover.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.MMVideo.Graphics.Dashboard2.0.3343.2826
5__90ba9c70f846762eCLI.Aspect.MMVideo.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.OverDrive5.Graphics.Dashboard2.0.3343.2
8355__90ba9c70f846762eCLI.Aspect.OverDrive5.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.MMVideo.Graphics.Wizard2.0.3343.28301__
90ba9c70f846762eCLI.Aspect.MMVideo.Graphics.Wizard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.InfoCentre.Graphics.Dashboard2.0.3343.2
8230__90ba9c70f846762eCLI.Aspect.InfoCentre.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.MMVideo.Graphics.Runtime2.0.3343.28264_
_90ba9c70f846762eCLI.Aspect.MMVideo.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.OverDrive5.Graphics.Runtime2.0.3343.283
54__90ba9c70f846762eCLI.Aspect.OverDrive5.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceTV.Graphics.Dashboard2.0.3343.283
10__90ba9c70f846762eCLI.Aspect.DeviceTV.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DisplaysManager.Graphics.Dashboard2.0.3
343.28215__90ba9c70f846762eCLI.Aspect.DisplaysManager.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceCV.Graphics.Dashboard2.0.3343.282
82__90ba9c70f846762eCLI.Aspect.DeviceCV.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DisplaysColour2.Graphics.Dashboard2.0.3
343.28230__90ba9c70f846762eCLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceDFP.Graphics.Dashboard2.0.3343.28
257__90ba9c70f846762eCLI.Aspect.DeviceDFP.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceCRT.Graphics.Dashboard2.0.3343.28
264__90ba9c70f846762eCLI.Aspect.DeviceCRT.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DisplaysOptions.Graphics.Dashboard2.0.3
343.28278__90ba9c70f846762eCLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceDFP.Graphics.Runtime2.0.3343.2826
3__90ba9c70f846762eCLI.Aspect.DeviceDFP.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DisplaysColour2.Graphics.Runtime2.0.334
3.28236__90ba9c70f846762eCLI.Aspect.DisplaysColour2.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceCRT.Graphics.Runtime2.0.3343.2826
4__90ba9c70f846762eCLI.Aspect.DeviceCRT.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DisplaysOptions.Graphics.Runtime2.0.334
3.28278__90ba9c70f846762eCLI.Aspect.DisplaysOptions.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceLCD.Graphics.Runtime2.0.3343.2827
9__90ba9c70f846762eCLI.Aspect.DeviceLCD.Graphics.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAEM.Plugin.Hotkeys.Shared2.0.3309.28617__90ba9c70f
846762eAEM.Plugin.Hotkeys.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAEM.Plugin.WinMessages.Shared2.0.3309.28629__90ba9
c70f846762eAEM.Plugin.WinMessages.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILDEM.Graphics.I06012.0.2573.17685__90ba9c70f846762e
DEM.Graphics.I0601.dll ()
MOD - C:WINDOWSassemblyGAC_MSILLOG.Foundation2.0.3309.28601__90ba9c70f846762eLOG
.Foundation.dll ()
MOD - C:WINDOWSassemblyGAC_MSILNEWAEM.Foundation2.0.3309.28603__90ba9c70f846762e
NEWAEM.Foundation.dll ()
MOD - C:WINDOWSassemblyGAC_MSILDEM.OS.I06022.0.3309.28630__90ba9c70f846762eDEM.O
S.I0602.dll ()
MOD - C:WINDOWSassemblyGAC_MSILDEM.Graphics.I07032.0.2651.18802__90ba9c70f846762e
DEM.Graphics.I0703.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAEM.Actions.CCAA.Shared2.0.3309.28608__90ba9c70f84
6762eAEM.Actions.CCAA.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILMOM.Foundation2.0.3309.28626__90ba9c70f846762eMOM
.Foundation.dll ()
MOD - C:WINDOWSassemblyGAC_MSILDEM.OS2.0.3309.28645__90ba9c70f846762eDEM.OS.dll ()
MOD - C:WINDOWSassemblyGAC_MSILDEM.Graphics.I07062.0.2743.23304__90ba9c70f846762e
DEM.Graphics.I0706.dll ()
MOD - C:WINDOWSassemblyGAC_MSILDEM.Graphics2.0.3309.28630__90ba9c70f846762eDEM.G
raphics.dll ()
MOD - C:WINDOWSassemblyGAC_MSILDEM.Foundation2.0.2573.17684__90ba9c70f846762eDEM
.Foundation.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAEM.Plugin.REG.Shared2.0.3309.28645__90ba9c70f8467
62eAEM.Plugin.REG.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAEM.Plugin.GD.Shared2.0.3309.28647__90ba9c70f84676
2eAEM.Plugin.GD.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAEM.Plugin.EEU.Shared2.0.3309.28627__90ba9c70f8467
62eAEM.Plugin.EEU.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAEM.Plugin.DPPE.Shared2.0.3309.28647__90ba9c70f846
762eAEM.Plugin.DPPE.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILatixclib1.0.0.0__90ba9c70f846762eatixclib.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Foundation2.0.3309.28604__90ba9c70f846762eCLI
.Foundation.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Caste.Graphics.Shared2.0.3309.28618__90ba9c70f
846762eCLI.Caste.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.OverDrive5.Graphics.Shared2.0.3309.2864
7__90ba9c70f846762eCLI.Aspect.OverDrive5.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.Radeon3D.Graphics.Shared2.0.3309.28636_
_90ba9c70f846762eCLI.Aspect.Radeon3D.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.MMVideo.Graphics.Shared2.0.3309.28634__
90ba9c70f846762eCLI.Aspect.MMVideo.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.TransCode.Graphics.Shared2.0.3309.28644
__90ba9c70f846762eCLI.Aspect.TransCode.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Foundation.XManifest2.0.3309.28669__90ba9c70f8
46762eCLI.Foundation.XManifest.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Wizard.Shared2.0.3309.28620__90ba9c7
0f846762eCLI.Component.Wizard.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Dashboard.Shared2.0.3309.28617__90ba
9c70f846762eCLI.Component.Dashboard.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Client.Shared2.0.3309.28611__90ba9c7
0f846762eCLI.Component.Client.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.VPURecover.Graphics.Shared2.0.3309.2863
1__90ba9c70f846762eCLI.Aspect.VPURecover.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Runtime.Shared2.0.3309.28617__90ba9c
70f846762eCLI.Component.Runtime.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Caste.Graphics.Wizard.Shared2.0.3309.28631__90
ba9c70f846762eCLI.Caste.Graphics.Wizard.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Caste.Graphics.Dashboard.Shared2.0.3309.28630_
_90ba9c70f846762eCLI.Caste.Graphics.Dashboard.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILResourceManagement.Foundation.Implementation2.0.33
43.28368__90ba9c70f846762eResourceManagement.Foundation.Implementation.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceTV.Graphics.Shared2.0.3309.28636_
_90ba9c70f846762eCLI.Aspect.DeviceTV.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceCRT.Graphics.Shared2.0.3309.28634
__90ba9c70f846762eCLI.Aspect.DeviceCRT.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceDFP.Graphics.Shared2.0.3309.28634
__90ba9c70f846762eCLI.Aspect.DeviceDFP.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAEM.Plugin.Source.Kit.Server2.0.3343.28347__90ba9c
70f846762eAEM.Plugin.Source.Kit.Server.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceCV.Graphics.Shared2.0.3309.28636_
_90ba9c70f846762eCLI.Aspect.DeviceCV.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceProperty.Graphics.Shared2.0.3309.
28624__90ba9c70f846762eCLI.Aspect.DeviceProperty.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DisplaysColour2.Graphics.Shared2.0.3309
.28632__90ba9c70f846762eCLI.Aspect.DisplaysColour2.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DeviceLCD.Graphics.Shared2.0.3309.28630
__90ba9c70f846762eCLI.Aspect.DeviceLCD.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.CustomFormats.Graphics.Shared2.0.3309.2
8627__90ba9c70f846762eCLI.Aspect.CustomFormats.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.DisplaysOptions.Graphics.Shared2.0.3309
.28635__90ba9c70f846762eCLI.Aspect.DisplaysOptions.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILACE.Graphics.DisplaysManager.Shared2.0.2573.17685_
_90ba9c70f846762eACE.Graphics.DisplaysManager.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Aspect.HotkeysHandling.Graphics.Shared2.0.3309
.28630__90ba9c70f846762eCLI.Aspect.HotkeysHandling.Graphics.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAPM.Foundation2.0.3309.28626__90ba9c70f846762eAPM
.Foundation.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAEM.Server.Shared2.0.3309.28617__90ba9c70f846762e
AEM.Server.Shared.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAxInterop.WBOCXLib1.0.0.0__90ba9c70f846762eAxInte
rop.WBOCXLib.dll ()
MOD - C:WINDOWSassemblyGACInterop.WBOCXLib1.0.0.0__90ba9c70f846762eInterop.WBOCX
Lib.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Runtime.Extension.EEU2.0.3343.28197_
_90ba9c70f846762eCLI.Component.Runtime.Extension.EEU.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Systemtray2.0.3343.28321__90ba9c70f8
46762eCLI.Component.Systemtray.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Wizard2.0.3343.28221__90ba9c70f84676
2eCLI.Component.Wizard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILMOM.Implementation2.0.3343.28330__90ba9c70f846762e
MOM.Implementation.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Runtime2.0.3343.28198__90ba9c70f8467
62eCLI.Component.Runtime.dll ()
MOD - C:WINDOWSassemblyGAC_MSILLOG.Foundation.Implementation2.0.3343.28328__90ba9
c70f846762eLOG.Foundation.Implementation.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.SkinFactory2.0.3343.28199__90ba9c70f
846762eCLI.Component.SkinFactory.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Runtime.Shared.Private2.0.3309.28628
__90ba9c70f846762eCLI.Component.Runtime.Shared.Private.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Foundation.Private2.0.3309.28608__90ba9c70f846
762eCLI.Foundation.Private.dll ()
MOD - C:WINDOWSassemblyGAC_MSILLOG.Foundation.Private2.0.3309.28614__90ba9c70f846
762eLOG.Foundation.Private.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Wizard.Shared.Private2.0.3309.28627_
_90ba9c70f846762eCLI.Component.Wizard.Shared.Private.dll ()
MOD - C:WINDOWSassemblyGAC_MSILResourceManagement.Foundation.Private2.0.3309.2861
2__90ba9c70f846762eResourceManagement.Foundation.Private.dll ()
MOD - C:WINDOWSassemblyGAC_MSILLOG.Foundation.Implementation.Private2.0.3309.2862
6__90ba9c70f846762eLOG.Foundation.Implementation.Private.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Dashboard.Shared.Private2.0.3309.286
24__90ba9c70f846762eCLI.Component.Dashboard.Shared.Private.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Dashboard2.0.3343.28207__90ba9c70f84
6762eCLI.Component.Dashboard.dll ()
MOD - C:WINDOWSassemblyGAC_MSILATIDEMOS2.0.3343.28199__90ba9c70f846762eATIDEMOS.
dll ()
MOD - C:WINDOWSassemblyGAC_MSILAPM.Server2.0.3343.28198__90ba9c70f846762eAPM.Ser
ver.dll ()
MOD - C:WINDOWSassemblyGAC_MSILAEM.Server2.0.3343.28197__90ba9c70f846762eAEM.Ser
ver.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Component.Client.Shared.Private2.0.3309.28621_
_90ba9c70f846762eCLI.Component.Client.Shared.Private.dll ()
MOD - C:WINDOWSassemblyGAC_MSILATICCCom2.0.0.0__90ba9c70f846762eATICCCom.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCCC.Implementation2.0.3343.28329__90ba9c70f846762e
CCC.Implementation.dll ()
MOD - C:WINDOWSassemblyGAC_MSILCLI.Caste.Graphics.Runtime.Shared.Private2.0.3309.
28637__90ba9c70f846762eCLI.Caste.Graphics.Runtime.Shared.Private.dll ()
MOD - C:Program FilesMotorolaMotoHelperMotoHelperAgent.exe ()
MOD - C:Program FilesMotorolaMotoHelperMotoHelperService.exe ()
MOD - C:Program FilesDivXDivX UpdateDivXUpdateCheck.dll ()
MOD - C:Program FilesDivXDivX UpdateDivXUpdate.exe ()
MOD - C:WINDOWSassemblyGACExtensibility7.0.3300.0__b03f5f7f11d50a3aExtensibility
.dll ()
MOD - C:WINDOWSassemblyGAC_MSILTTSBundlingNet2.0.2958.27934__4b827ebe229d539fTTS
BundlingNet.dll ()
MOD - C:WINDOWSassemblyNativeImages_v2.0.50727_32System.Webd987cf1de4ba688da92e21
2a374232c2System.Web.ni.dll ()
MOD - C:WINDOWSassemblyNativeImages_v2.0.50727_32System.Configuration631b3eba1ba5
bd3c3f027f34011cadebSystem.Configuration.ni.dll ()
MOD - C:WINDOWSassemblyGAC_MSILSystem.Runtime.Remoting2.0.0.0__b77a5c561934e089S
ystem.Runtime.Remoting.dll ()
MOD - C:WINDOWSassemblyGAC_MSILMicrosoft.VisualBasic8.0.0.0__b03f5f7f11d50a3aMic
rosoft.VisualBasic.dll ()
MOD - C:WINDOWSassemblyGAC_32CustomMarshalers2.0.0.0__b03f5f7f11d50a3aCustomMars
halers.dll ()
MOD - C:WINDOWSassemblyNativeImages_v2.0.50727_32System.Xml563a54b98adb70fae86297
4042298348System.Xml.ni.dll ()
MOD - C:WINDOWSassemblyNativeImages_v2.0.50727_32System.Windows.Forms2dfe045e4b15
77fdea9a2f456db0afc2System.Windows.Forms.ni.dll ()
MOD - C:WINDOWSassemblyNativeImages_v2.0.50727_32System.Drawingf3440ea00eb3c40dc0
73b2fe03843638System.Drawing.ni.dll ()
MOD - C:WINDOWSassemblyNativeImages_v2.0.50727_32System37217abe2c5164e59aba251860
f4c79eSystem.ni.dll ()
MOD - C:WINDOWSassemblyNativeImages_v2.0.50727_32Accessibilitye63d6d26b8a664cfdfb
d4ad75e03c14dAccessibility.ni.dll ()
MOD - C:WINDOWSassemblyNativeImages_v2.0.50727_32mscorlib7124a40b9998f7b63c86bd1a
2125ce26mscorlib.ni.dll ()
MOD - C:Program FilesLogitechLogitech WebCam SoftwareLWS.exe ()
MOD - C:Program FilesCommon FilesLogiShrdLQCVFXCOCIManager.exe ()
MOD - C:Program FilesNaturalSoftnaturalreader10NaturalReaderOutLook.dll ()
MOD - C:Program FilesATI TechnologiesATI.ACEBrandingBranding.dll ()
MOD - C:WINDOWSsystem32AcaTtsSapi5.dll ()
MOD - C:Program FilesNaturalSoftnaturalreader10AcaTtsSapi5.dll ()
MOD - C:Program FilesInternet ExplorerAcaTtsSapi5.dll ()
MOD - C:Program FilesMagicDiscMagicDisc.exe ()


========== Win32 Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:WINDOWSsystem32MacromedFlashFlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) – C:Program FilesMalwarebytes' Anti-Malwarembamservice.exe (Malwarebytes Corporation)
SRV - (ARSM) – C:Program FilesAcronisARSMarsm.exe (Acronis)
SRV - (MMS) – C:Program FilesAcronisBackupAndRecoverymms.exe (Acronis)
SRV - (AcrSch2Svc) – C:Program FilesCommon FilesAcronisSchedule2schedul2.exe (Acronis)
SRV - (AcronisAgent) – C:Program FilesCommon FilesAcronisAgentagent.exe (Acronis)
SRV - (MotoHelper) – C:Program FilesMotorolaMotoHelperMotoHelperService.exe ()
SRV - (avast! Antivirus) – C:Program FilesAlwil SoftwareAvast5AvastSvc.exe (AVAST Software)
SRV - (Lavasoft Ad-Aware Service) – C:Program FilesLavasoftAd-AwareAAWService.exe (Lavasoft Limited)
SRV - (DMService) – C:WINDOWSDownloaded Program FilesDM.0DMService.exe ()
SRV - (uagqecsvc) – C:Program FilesMicrosoft Forefront UAGEndpoint Components3.1.0uagqecsvc.exe (Microsoft Corporation)
SRV - (TOSHIBA Bluetooth Service) – C:Program FilesToshibaBluetooth Toshiba StackTosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (FolderSize) – C:Program FilesFolderSizeFolderSizeSvc.exe (Brio)
SRV - (NetTcpPortSharing) – C:WINDOWSMicrosoft.NETFrameworkv4.0.30319SMSvcHost.exe (Microsoft Corporation)
SRV - (LVPrcSrv) – C:Program FilesCommon FilesLogiShrdLVMVFMLVPrcSrv.exe (Logitech Inc.)
SRV - (RServer3) – C:WINDOWSSystem32rserver30RServer3.exe (Famatech International Corp.)
SRV - (ToolTipFixer) – C:Program FilesNeoSmart TechnologiesToolTipFixerToolTipFixer.exe (NeoSmart Technologies)
SRV - (clr_optimization_v2.0.50727_32) – C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe (Microsoft Corporation)
SRV - (TabletServicePen) – C:WINDOWSsystem32Pen_Tablet.exe (Wacom Technology, Corp.)
SRV - (PSI_SVC_2) – C:Program FilesCommon FilesProtexisLicense ServicePsiService_2.exe (Protexis Inc.)
SRV - (IviRegMgr) – C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe (InterVideo)
SRV - (APC UPS Service) – C:Program FilesAPCAPC PowerChute Personal Editionmainserv.exe (American Power Conversion Corporation)
SRV - (UMWdf) – C:WINDOWSsystem32wdfmgr.exe (Microsoft Corporation)
SRV - (NetDDEdsdm) – C:WINDOWSsystem32netdde.exe (Microsoft Corporation)
SRV - (NetDDE) – C:WINDOWSsystem32netdde.exe (Microsoft Corporation)
SRV - (RemoteRegistry) – C:WINDOWSsystem32regsvc.dll (Microsoft Corporation)
SRV - (RemoteAccess) – C:WINDOWSsystem32mprdim.dll (Microsoft Corporation)
SRV - (Messenger) – C:WINDOWSsystem32msgsvc.dll (Microsoft Corporation)
SRV - (CiSvc) – C:WINDOWSsystem32cisvc.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (vsdatant) – C:WINDOWSsystem32vsdatant.sys File not found
DRV - (UltraMonMirror) – system32DRIVERSUltraMonMirror.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (eusrws) – System32driversdpvuck.sys File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:DOCUME~1ericjsLOCALS~1Tempcatchme.sys File not found
DRV - (BVRPMPR5) – D:INSTAL~ECoreBVRPMPR5.SYS File not found
DRV - (Ad-Watch Connect Filter) – C:WINDOWSsystem32driversNSDriver.sys File not found
DRV - (a40tszwz) – File not found
DRV - (timounter) – C:WINDOWSsystem32driverstimntr.sys (Acronis)
DRV - (snapman) – C:WINDOWSsystem32driverssnapman.sys (Acronis)
DRV - (fltsrv) – C:WINDOWSsystem32driversfltsrv.sys (Acronis)
DRV - (MBAMProtector) – C:WINDOWSsystem32driversmbam.sys (Malwarebytes Corporation)
DRV - (pneteth) – C:WINDOWSsystem32driverspneteth.sys (June Fabrics Technology Inc.)
DRV - (aswSnx) – C:WINDOWSSystem32driversaswSnx.sys (AVAST Software)
DRV - (aswSP) – C:WINDOWSSystem32driversaswSP.sys (AVAST Software)
DRV - (aswRdr) – C:WINDOWSSystem32driversaswRdr.sys (AVAST Software)
DRV - (aswTdi) – C:WINDOWSSystem32driversaswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:WINDOWSSystem32driversaswmon2.sys (AVAST Software)
DRV - (aswFsBlk) – C:WINDOWSSystem32driversaswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) – C:WINDOWSSystem32driversaavmker4.sys (AVAST Software)
DRV - (Lbd) – C:WINDOWSsystem32driversLbd.sys (Lavasoft AB)
DRV - (Lavasoft Kernexplorer) – C:Program FilesLavasoftAd-Awarekernexplorer.sys ()
DRV - (sptd) – C:WINDOWSsystem32driverssptd.sys ()
DRV - (Tosrfusb) – C:WINDOWSsystem32driverstosrfusb.sys (TOSHIBA CORPORATION)
DRV - (tosrfbd) – C:WINDOWSsystem32driverstosrfbd.sys (TOSHIBA CORPORATION)
DRV - (LVPr2Mon) – C:WINDOWSsystem32driversLVPr2Mon.sys ()
DRV - (FilterService) – C:WINDOWSsystem32driverslvuvcflt.sys (Logitech Inc.)
DRV - (LVUVC) Logitech Webcam 500(UVC) – C:WINDOWSsystem32driverslvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:WINDOWSsystem32driverslvrs.sys (Logitech Inc.)
DRV - (TosRfSnd) – C:WINDOWSsystem32driversTosRfSnd.sys (TOSHIBA Corporation)
DRV - (Tosrfcom) – C:WINDOWSsystem32driverstosrfcom.sys (TOSHIBA Corporation)
DRV - (tosrfnds) – C:WINDOWSsystem32driverstosrfnds.sys (TOSHIBA Corporation.)
DRV - (motandroidusb) – C:WINDOWSsystem32driversmotoandroid.sys (Motorola)
DRV - (androidusb) – C:WINDOWSsystem32driversmotoandroid.sys (Motorola)
DRV - (pavboot) – C:WINDOWSsystem32driverspavboot.sys (Panda Security, S.L.)
DRV - (Tosrfhid) – C:WINDOWSsystem32driversTosrfhid.sys (TOSHIBA Corporation.)
DRV - (tosrfbnp) – C:WINDOWSsystem32driverstosrfbnp.sys (TOSHIBA Corporation)
DRV - (tosporte) – C:WINDOWSsystem32driverstosporte.sys (TOSHIBA Corporation)
DRV - (ati2mtag) – C:WINDOWSsystem32driversati2mtag.sys (ATI Technologies Inc.)
DRV - (ha10kx2k) – C:WINDOWSsystem32driversha10kx2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:WINDOWSsystem32driversemupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:WINDOWSsystem32driversctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:WINDOWSsystem32driversctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:WINDOWSsystem32driversctoss2k.sys (Creative Technology Ltd.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:WINDOWSsystem32driversctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:WINDOWSsystem32driversctac32k.sys (Creative Technology Ltd)
DRV - (CTEXFIFX.SYS) – C:WINDOWSsystem32driversCTEXFIFX.sys (Creative Technology Ltd.)
DRV - (CTEXFIFX) – C:WINDOWSsystem32driversCTEXFIFX.sys (Creative Technology Ltd.)
DRV - (CTEDSPIO.SYS) – C:WINDOWSsystem32driversCTEDSPIO.sys (Creative Technology Ltd)
DRV - (CTEDSPIO) – C:WINDOWSsystem32driversCTEDSPIO.sys (Creative Technology Ltd)
DRV - (CTEDSPSY.SYS) – C:WINDOWSsystem32driversCTEDSPSY.sys (Creative Technology Ltd)
DRV - (CTEDSPSY) – C:WINDOWSsystem32driversCTEDSPSY.sys (Creative Technology Ltd)
DRV - (CTHWIUT.SYS) – C:WINDOWSsystem32driversCTHWIUT.sys (Creative Technology Ltd.)
DRV - (CTHWIUT) – C:WINDOWSsystem32driversCTHWIUT.sys (Creative Technology Ltd.)
DRV - (CT20XUT.SYS) – C:WINDOWSsystem32driversCT20XUT.sys (Creative Technology Ltd.)
DRV - (CT20XUT) – C:WINDOWSsystem32driversCT20XUT.sys (Creative Technology Ltd.)
DRV - (CTERFXFX.SYS) – C:WINDOWSsystem32driversCTERFXFX.sys (Creative Technology Ltd)
DRV - (CTERFXFX) – C:WINDOWSsystem32driversCTERFXFX.sys (Creative Technology Ltd)
DRV - (CTEDSPFX.SYS) – C:WINDOWSsystem32driversCTEDSPFX.sys (Creative Technology Ltd)
DRV - (CTEDSPFX) – C:WINDOWSsystem32driversCTEDSPFX.sys (Creative Technology Ltd)
DRV - (CTEAPSFX.SYS) – C:WINDOWSsystem32driversCTEAPSFX.sys (Creative Technology Ltd)
DRV - (CTEAPSFX) – C:WINDOWSsystem32driversCTEAPSFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX.SYS) – C:WINDOWSsystem32driversCTSBLFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX) – C:WINDOWSsystem32driversCTSBLFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX.SYS) – C:WINDOWSsystem32driversCTAUDFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX) – C:WINDOWSsystem32driversCTAUDFX.sys (Creative Technology Ltd)
DRV - (COMMONFX.SYS) – C:WINDOWSsystem32driversCOMMONFX.sys (Creative Technology Ltd)
DRV - (COMMONFX) – C:WINDOWSsystem32driversCOMMONFX.sys (Creative Technology Ltd)
DRV - (tifsfilter) – C:WINDOWSsystem32driverstifsfilt.sys (Acronis)
DRV - (UltraMonUtility) – C:Program FilesCommon FilesRealtime SoftUltraMonMirrorDrvx32UltraMonUtility.sys (Realtime Soft Ltd)
DRV - (AtiHdmiService) – C:WINDOWSsystem32driversAtiHdmi.sys (ATI Research Inc.)
DRV - (DNE) – C:WINDOWSsystem32driversdne2000.sys (Deterministic Networks, Inc.)
DRV - (wacmoumonitor) – C:WINDOWSsystem32driverswacmoumonitor.sys (Wacom Technology)
DRV - (BANTExt) – C:WINDOWSsystem32driversBANTExt.sys ()
DRV - (wacomvhid) – C:WINDOWSsystem32driverswacomvhid.sys (Wacom Technology)
DRV - (raddrvv3) – C:WINDOWSsystem32rserver30raddrvv3.sys (Famatech International Corp.)
DRV - (maxivista) – C:WINDOWSsystem32driversmaxivista.sys (MaxiVista)
DRV - (MaxiAcom) – C:WINDOWSsystem32driversMaxiacom.SYS (MaxiVista)
DRV - (regi) – C:WINDOWSsystem32driversregi.sys (InterVideo)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:WINDOWSsystem32driversRtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (wacommousefilter) – C:WINDOWSsystem32driverswacommousefilter.sys (Wacom Technology)
DRV - (WacomVKHid) – C:WINDOWSsystem32driversWacomVKHid.sys (Wacom Technology)
DRV - (CVirtA) – C:WINDOWSsystem32driversCVirtA.sys (Cisco Systems, Inc.)
DRV - (mirrorv3) – C:WINDOWSsystem32driversrminiv3.sys (Famatech International Corp.)
DRV - (mcdbus) – C:WINDOWSsystem32driversmcdbus.sys (MagicISO, Inc.)
DRV - (RTLE8023xp) – C:WINDOWSsystem32driversRtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (AmdK8) – C:WINDOWSsystem32driversAmdK8.sys (Advanced Micro Devices)
DRV - (USBModem) – C:WINDOWSsystem32driverslgusbmodem.sys (LG Electronics Inc.)
DRV - (UsbDiag) – C:WINDOWSsystem32driverslgusbdiag.sys (LG Electronics Inc.)
DRV - (usbbus) – C:WINDOWSsystem32driverslgusbbus.sys (LG Electronics Inc.)
DRV - (Afc) – C:WINDOWSsystem32driversafc.sys (Arcsoft, Inc.)
DRV - (MTsensor) – C:WINDOWSsystem32driversASACPI.sys ()
DRV - (dmboot) – C:WINDOWSsystem32driversdmboot.sys (Microsoft Corp., Veritas Software)
DRV - (Fastfat) – C:WINDOWSSystem32driversfastfat.sys (Microsoft Corporation)
DRV - (Pcmcia) – C:WINDOWSSystem32driverspcmcia.sys (Microsoft Corporation)
DRV - (Udfs) – C:WINDOWSSystem32driversudfs.sys (Microsoft Corporation)
DRV - (cbidf2k) – C:WINDOWSSystem32driverscbidf2k.sys (Microsoft Corporation)
DRV - (ACPIEC) – C:WINDOWSSystem32driversacpiec.sys (Microsoft Corporation)
DRV - (VNic) – C:WINDOWSsystem32driversVNic.sys (Provider)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM..SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM..SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://www.google.com/
IE - HKCU..SearchScopes,DefaultScope = {6B7EA1AE-8F26-446C-9450-43FB9D5A5546}
IE - HKCU..SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU..SearchScopes{6B7EA1AE-8F26-446C-9450-43FB9D5A5546}: "URL" = http://www.google.com/search?q={searchTerm…age={startPage}
IE - HKCU..SearchScopes{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}
IE - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - [removed]/FlashPlayer: C:WINDOWSsystem32MacromedFlashNPSWF32_11_2_202_228.dll ()
FF - [removed]/ShockwavePlayer: C:WINDOWSsystem32AdobeDirectornp32dsw.dll (Adobe Systems, Inc.)
FF - [removed]/DivX Browser Plugin,version=1.0.0: C:Program FilesDivXDivX Plus Web Playernpdivx32.dll (DivX, LLC)
FF - [removed]/DivX VOD Helper,version=1.0.0: C:Program FilesDivXDivX OVS Helpernpovshelper.dll (DivX, LLC.)
FF - [removed]/WPF,version=3.5: C:WINDOWSMicrosoft.NETFrameworkv3.5Windows Presentation FoundationNPWPF.dll (Microsoft Corporation)
FF - [removed]/activescan: C:Program FilesPanda SecurityActiveScan 2.0npwrapper.dll (Panda Security)
FF - HKLMSoftwareMozillaPluginsAdobe Reader: C:Program FilesAdobeReader 9.0ReaderAIRnppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINEsoftwaremozillaFirefoxextensions{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:Program FilesDivXDivX Plus Web PlayerfirefoxDivXHTML5 [2012/04/07 18:59:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 8.0.1extensionsComponents: C:Program FilesMozilla Firefoxcomponents [2011/11/23 14:57:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINEsoftwaremozillaMozilla Firefox 8.0.1extensionsPlugins: C:Program FilesMozilla Firefoxplugins [2012/04/14 11:54:18 | 000,000,000 | —D | M]

[2010/06/16 13:46:33 | 000,000,000 | —D | M] (No name found) – C:Documents and SettingsericjsApplication DataMozillaExtensions
[2012/05/11 13:35:36 | 000,000,000 | —D | M] (No name found) – C:Documents and SettingsericjsApplication DataMozillaFirefoxProfilesbwi5qfu2.defaultextensions
[2010/06/16 14:26:20 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:Documents and SettingsericjsApplication DataMozillaFirefoxProfilesbwi5qfu2.defaultextensions{20a82645-c095-46ed-80e3-08825760534b}
[2011/11/23 14:57:33 | 000,000,000 | —D | M] (No name found) – C:Program FilesMozilla Firefoxextensions
[2012/05/07 21:41:19 | 000,634,964 | —- | M] () (No name found) – C:DOCUMENTS AND SETTINGSERICJSAPPLICATION DATAMOZILLAFIREFOXPROFILESBWI5QFU2.DEFAULTEXTENSIONS{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012/05/11 13:35:36 | 000,185,022 | —- | M] () (No name found) – C:DOCUMENTS AND SETTINGSERICJSAPPLICATION [removed]
M.XPI
[2012/04/07 18:59:15 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:PROGRAM FILESDIVXDIVX PLUS WEB PLAYERFIREFOXDIVXHTML5
[2011/11/20 21:04:51 | 000,134,104 | —- | M] (Mozilla Foundation) – C:Program Filesmozilla firefoxcomponentsbrowsercomps.dll
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:Program Filesmozilla firefoxpluginsnpdeployJava1.dll
[2010/07/12 09:33:56 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:Program Filesmozilla firefoxpluginsnpwachk.dll
[2011/11/20 18:04:05 | 000,002,252 | —- | M] () – C:Program Filesmozilla firefoxsearchpluginsbing.xml
[2011/11/20 18:04:05 | 000,002,040 | —- | M] () – C:Program Filesmozilla firefoxsearchpluginstwitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:Documents and SettingsericjsLocal SettingsApplication DataGoogleChromeApplication13.0.782.215gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:WINDOWSsystem32MacromedFlashNPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:Program FilesMozilla Firefoxpluginsnpqtplugin7.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = C:Program FilesJavajre6binnew_pluginnpjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:Program FilesMozilla FirefoxpluginsnpdeployJava1.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:Program FilesAdobeReader 9.0ReaderBrowsernppdf32.dll
CHR - plugin: Shockwave for Director (Enabled) = C:WINDOWSsystem32AdobeDirectornp32dsw.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:Program FilesWindows Media Playernpdsplay.dll
CHR - plugin: Chrome NaCl (Disabled) = C:Documents and SettingsericjsLocal SettingsApplication DataGoogleChromeApplication13.0.782.215ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:Documents and SettingsericjsLocal SettingsApplication DataGoogleChromeApplication13.0.782.215pdf.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:Program FilesMozilla Firefoxpluginsnpwachk.dll
CHR - plugin: Microsoftu00AE DRM (Enabled) = C:Program FilesWindows Media Playernpdrmv2.dll
CHR - plugin: Microsoftu00AE DRM (Enabled) = C:Program FilesWindows Media Playernpwmsdrm.dll
CHR - plugin: Google Update (Enabled) = C:Documents and SettingsericjsLocal SettingsApplication DataGoogleUpdate1.3.21.69npGoogleUpdate3.dll
CHR - plugin: Panda ActiveScan 2.0 (Enabled) = C:Program FilesPanda SecurityActiveScan 2.0npwrapper.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:WINDOWSMicrosoft.NETFrameworkv3.5Windows Presentation FoundationNPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2010/06/27 17:01:13 | 000,000,027 | —- | M]) - C:WINDOWSsystem32driversetchosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (IE7Pro BHO) - {00011268-E188-40DF-A514-835FCD78B1BF} - C:Program FilesIEProIEPro.dll (IE7Pro.com)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:Program FilesDivXDivX Plus Web PlayerieDivXHTML5DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:Program FilesSpybot - Search & DestroySDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - No CLSID value found.
O3 - HKLM..Toolbar: (no name) - - No CLSID value found.
O3 - HKLM..Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:Program FilesIEProIEProRecorder.dll ()
O3 - HKCU..ToolbarWebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKCU..ToolbarWebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:Program FilesIEProIEProRecorder.dll ()
O4 - HKLM..Run: [Acronis Scheduler2 Service] C:Program FilesCommon FilesAcronisSchedule2schedhlp.exe (Acronis)
O4 - HKLM..Run: [AcronisTimounterMonitor] C:Program FilesCommon FilesAcronisTimounterTimounterMonitor.exe (Acronis)
O4 - HKLM..Run: [avast] C:Program FilesAlwil SoftwareAvast5avastUI.exe (AVAST Software)
O4 - HKLM..Run: [BackupAndRecoveryMonitor.exe] C:Program FilesAcronisBackupAndRecoveryBackupAndRecoveryMonitor.exe (Acronis)
O4 - HKLM..Run: [CTHelper] C:WINDOWSSystem32CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..Run: [CTxfiHlp] C:WINDOWSSystem32Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..Run: [DivXUpdate] C:Program FilesDivXDivX UpdateDivXUpdate.exe ()
O4 - HKLM..Run: [EPSON Stylus CX3800 Series] C:WINDOWSSystem32spoolDRIVERSW32X863E_FATIACA.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..Run: [ITSecMng] C:Program FilesTOSHIBABluetooth Toshiba StackItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..Run: [LogitechQuickCamRibbon] C:Program FilesLogitechLogitech WebCam SoftwareLWS.exe ()
O4 - HKLM..Run: [Malwarebytes' Anti-Malware] C:Program FilesMalwarebytes' Anti-Malwarembamgui.exe (Malwarebytes Corporation)
O4 - HKLM..Run: [NeroFilterCheck] C:Program FilesCommon FilesAheadLibNeroCheck.exe (Nero AG)
O4 - HKLM..Run: [OSSelectorReinstall] C:Program FilesCommon FilesAcronisAcronis Disk Directoross_reinstall.exe ()
O4 - HKLM..Run: [StartCCC] C:Program FilesATI TechnologiesATI.ACECore-StaticCLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..Run: [TrayMonitor.exe] C:Program FilesAcronisTrayMonitorTrayMonitor.exe (Acronis)
O4 - HKLM..Run: [UpdReg] C:WINDOWSUpdreg.EXE (Creative Technology Ltd.)
O4 - HKCU..Run: [dxlock] File not found
O4 - HKCU..Run: [SetDefaultMIDI] C:WINDOWSSystem32MIDIDEF.EXE (Creative Technology Ltd)
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:Documents and SettingsAll UsersStart MenuProgramsStartupAPC UPS Status.lnk = C:Program FilesAPCAPC PowerChute Personal EditionDisplay.exe (American Power Conversion Corporation)
O4 - Startup: C:Documents and SettingsAll UsersStart MenuProgramsStartupMacro Express 3.lnk = C:Program FilesMacro Express3MacExp.exe (Insight Software Solutions)
O4 - Startup: C:Documents and SettingsAll UsersStart MenuProgramsStartupUltraMon.lnk = C:WINDOWSInstaller{537056B7-32A4-4408-9B54-0341963C7C9C}IcoUltraMon.ico ()
O4 - Startup: C:Documents and SettingsericjsStart MenuProgramsStartupMagicDisc.lnk = C:Program FilesMagicDiscMagicDisc.exe ()
O4 - Startup: C:Documents and SettingsericjsStart MenuProgramsStartupNetPerSec.lnk = G:dlUtilsNetPerSecNetPerSec.exe (Ziff-Davis Media, Inc.)
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: HonorAutoRunSetting = 1
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveAutoRun = 67108863
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 323
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDrives = 0
O7 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O7 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerMain present
O7 - HKCUSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 145
O7 - HKCUSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveAutoRun = 67108863
O7 - HKCUSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDrives = 03 00 00 00 [binary data]
O9 - Extra Button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:Program FilesIEProIEPro.dll (IE7Pro.com)
O9 - Extra 'Tools' menuitem : IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:Program FilesIEProIEPro.dll (IE7Pro.com)
O9 - Extra Button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:Program FilesIEProIEPro.dll (IE7Pro.com)
O9 - Extra 'Tools' menuitem : IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:Program FilesIEProIEPro.dll (IE7Pro.com)
O9 - Extra Button: Toggle Flash - {93089660-AD23-44F1-AF37-54011A1A5A22} - C:Program FilesToggle Flashtogflash.exe ( )
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program FilesSpybot - Search & DestroySDHelper.dll (Safer Networking Limited)
O15 - HKCU..Trusted Domains: acs-inc.com ([essloginpage] https in Trusted sites)
O15 - HKCU..Trusted Domains: microsoft.com ([*.update] https in Trusted sites)
O15 - HKCU..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKCU..Trusted Domains: solanocounty.com ([mail] https in Trusted sites)
O15 - HKCU..Trusted Domains: windowsupdate.com ([download] http in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} http://picture.vzw.com/activex/VerizonWire…loadControl.cab (Verizon Wireless Media Upload)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} https://mail.solanocounty.com/InternalSite/WhlCompMgr.cab (Forefront UAG client components)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://acs-inc.webex.com/client/wbs26-vzbp…ing/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLMSystemCCSServicesTcpipParameters: DhcpNameServer = 192.168.1.1
O17 - HKLMSystemCCSServicesTcpipParametersInterfaces{1E97555A-0A9E-4D52-8B50-CD05A08CC9AC}: DhcpNameServer = 192.168.1.1
O18 - ProtocolHandlerbelarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:Program FilesBelarcAdvisorSystemBAVoilaX.dll (Belarc, Inc.)
O18 - ProtocolHandlerskype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:Program FilesCommon FilesSkypeSkype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:WINDOWSexplorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:WINDOWSsystem32userinit.exe) - C:WINDOWSsystem32userinit.exe (Microsoft Corporation)
O20 - WinlogonNotifyAtiExtEvent: DllName - (Ati2evxx.dll) - C:WINDOWSSystem32ati2evxx.dll (ATI Technologies Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/11/27 22:49:30 | 000,000,000 | —- | M] () - C:AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2008/11/27 22:49:30 | 000,000,000 | —- | M] () - F:AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2{14c711ca-117d-11e1-8d68-001bfc1a4340}Shell - "" = AutoRun
O33 - MountPoints2{14c711ca-117d-11e1-8d68-001bfc1a4340}ShellAutoRun - "" = Auto&Play;
O33 - MountPoints2{14c711ca-117d-11e1-8d68-001bfc1a4340}ShellAutoRuncommand - "" = I:setup.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM..comfile [open] – "%1" %*
O35 - HKLM..exefile [open] – "%1" %*
O37 - HKLM…com [@ = comfile] – "%1" %*
O37 - HKLM…exe [@ = exefile] – "%1" %*
O38 - SubSystemsWindows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystemsWindows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3filter - C:WINDOWSSystem32ac3filter.acm ()
Drivers32: msacm.avis - C:WINDOWSSystem32ff_acm.acm ()
Drivers32: msacm.iac2 - C:WINDOWSsystem32iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:WINDOWSsystem32l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:WINDOWSSystem32sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:WINDOWSSystem32tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:WINDOWSSystem32vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:WINDOWSSystem32vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:WINDOWSSystem32iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:WINDOWSSystem32DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:WINDOWSSystem32ff_vfw.dll ()
Drivers32: VIDC.FMVC - C:WINDOWSSystem32fmcodec.DLL (Fox Magic Software)
Drivers32: VIDC.I420 - C:WINDOWSSystem32i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv31 - C:WINDOWSSystem32ir32_32.dll ()
Drivers32: vidc.iv32 - C:WINDOWSSystem32ir32_32.dll ()
Drivers32: vidc.iv41 - C:WINDOWSSystem32ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:WINDOWSSystem32ir50_32.dll (Intel Corporation)
Drivers32: vidc.mjpg - C:WINDOWSSystem32pvmjpg30.dll (Pegasus Imaging Corporation)
Drivers32: vidc.xvid - C:WINDOWSSystem32xvid.dll ()
Drivers32: vidc.yv12 - C:WINDOWSSystem32DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/05/31 07:11:18 | 000,595,968 | —- | C] (OldTimer Tools) – C:Documents and SettingsericjsDesktopOTL.exe
[2012/05/30 20:22:36 | 000,000,000 | RH-D | C] – C:Documents and SettingsericjsRecent
[2012/05/30 19:54:04 | 000,000,000 | RHSD | C] – C:acroldr
[2012/05/30 07:40:46 | 000,000,000 | —D | C] – C:Documents and SettingsericjsLocal SettingsApplication DataPCHealth
[2012/05/26 15:21:34 | 000,080,416 | —- | C] (Acronis) – C:WINDOWSSystem32driversfltsrv.sys
[2012/05/26 14:30:23 | 000,000,000 | —D | C] – C:Documents and SettingsericjsApplication DataAC3Filter
[2012/05/12 12:15:39 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersStart MenuProgramsTools
[2012/05/12 12:15:39 | 000,000,000 | —D | C] – C:Program FilesAppMove
[2012/05/07 08:40:44 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersStart MenuProgramsMalwarebytes' Anti-Malware
[9 C:Documents and SettingsericjsMy Documents*.tmp files -> C:Documents and SettingsericjsMy Documents*.tmp -> ]
[1 C:WINDOWSSystem32*.tmp files -> C:WINDOWSSystem32*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/05/31 07:25:15 | 000,000,830 | —- | M] () – C:WINDOWStasksAdobe Flash Player Updater.job
[2012/05/31 07:11:23 | 000,595,968 | —- | M] (OldTimer Tools) – C:Documents and SettingsericjsDesktopOTL.exe
[2012/05/31 06:53:52 | 000,002,206 | —- | M] () – C:WINDOWSSystem32wpa.dbl
[2012/05/31 06:53:29 | 000,002,299 | —- | M] () – C:Documents and SettingsAll UsersStart MenuProgramsStartupUltraMon.lnk
[2012/05/31 06:53:22 | 000,002,048 | –S- | M] () – C:WINDOWSbootstat.dat
[2012/05/31 06:53:15 | 3353,858,048 | -HS- | M] () – C:hiberfil.sys
[2012/05/30 20:22:43 | 000,011,564 | —- | M] () – C:WINDOWSSystem32DVCState-{00000004-00000000-00000004-00001102-00000008-40071102}.rfx
[2012/05/30 20:22:43 | 000,001,044 | —- | M] () – C:WINDOWSSystem32BMXCtrlState-{00000004-00000000-00000004-00001102-00000008-40071102}.rfx
[2012/05/30 20:22:43 | 000,001,044 | —- | M] () – C:WINDOWSSystem32BMXBkpCtrlState-{00000004-00000000-00000004-00001102-00000008-40071102}.rfx
[2012/05/30 20:22:43 | 000,000,064 | —- | M] () – C:WINDOWSSystem32BMXStateBkp-{00000004-00000000-00000004-00001102-00000008-40071102}.rfx
[2012/05/30 20:22:43 | 000,000,064 | —- | M] () – C:WINDOWSSystem32BMXState-{00000004-00000000-00000004-00001102-00000008-40071102}.rfx
[2012/05/30 16:20:01 | 000,000,354 | —- | M] () – C:WINDOWStasksMotoHelper Routing.job
[2012/05/30 14:16:49 | 000,000,486 | —- | M] () – C:WINDOWStasksAd-Aware Update (Weekly).job
[2012/05/30 14:16:28 | 000,000,064 | —- | M] () – C:WINDOWSSystem32rp_stats.dat
[2012/05/30 14:16:28 | 000,000,044 | —- | M] () – C:WINDOWSSystem32rp_rules.dat
[2012/05/30 07:21:23 | 000,000,673 | —- | M] () – C:Documents and SettingsericjsStart MenuProgramsStartupNetPerSec.lnk
[2012/05/28 14:54:56 | 000,000,116 | —- | M] () – C:WINDOWSNeroDigital.ini
[2012/05/26 15:27:00 | 000,001,216 | —- | M] () – C:Documents and SettingsAll UsersDesktopAcronis Backup & Recovery 11.lnk
[2012/05/26 15:21:37 | 000,614,560 | —- | M] (Acronis) – C:WINDOWSSystem32driverstimntr.sys
[2012/05/26 15:21:35 | 000,177,600 | —- | M] (Acronis) – C:WINDOWSSystem32driverssnapman.sys
[2012/05/26 15:21:34 | 000,080,416 | —- | M] (Acronis) – C:WINDOWSSystem32driversfltsrv.sys
[2012/05/16 16:20:02 | 000,000,358 | —- | M] () – C:WINDOWStasksMotoHelper MUM.job
[2012/05/16 16:20:00 | 000,000,370 | —- | M] () – C:WINDOWStasksMotoHelper Update.job
[2012/05/14 18:40:55 | 000,000,471 | —- | M] () – C:Documents and SettingsericjsApplication Mover.cfg
[2012/05/12 12:39:03 | 000,496,288 | —- | M] () – C:WINDOWSSystem32perfh009.dat
[2012/05/12 12:39:03 | 000,084,646 | —- | M] () – C:WINDOWSSystem32perfc009.dat
[2012/05/12 12:39:03 | 000,000,799 | —- | M] () – C:Documents and SettingsericjsApplication DataMicrosoftInternet ExplorerQuick LaunchLaunch Microsoft Office Outlook.lnk
[2012/05/12 11:43:13 | 000,000,308 | -HS- | M] () – C:boot.ini
[2012/05/07 21:39:47 | 000,000,219 | —- | M] () – C:Documents and SettingsericjsDesktopCan I play DDP files with ZP - Inmatrix Forums.url
[2012/05/07 18:18:16 | 000,000,146 | —- | M] () – C:Documents and SettingsericjsDesktopWatch Online Chopped Season 11 Episode 14 - Yuzu Never Know - Watch Series.url
[2012/05/07 14:41:07 | 000,000,200 | —- | M] () – C:Documents and SettingsericjsDesktopWatch The Next Food Network Star Serie Online - Watch Series.url
[2012/05/07 08:40:44 | 000,000,791 | —- | M] () – C:Documents and SettingsAll UsersDesktopMalwarebytes Anti-Malware.lnk
[9 C:Documents and SettingsericjsMy Documents*.tmp files -> C:Documents and SettingsericjsMy Documents*.tmp -> ]
[1 C:WINDOWSSystem32*.tmp files -> C:WINDOWSSystem32*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/05/26 15:27:00 | 000,001,216 | —- | C] () – C:Documents and SettingsAll UsersDesktopAcronis Backup & Recovery 11.lnk
[2012/05/14 18:29:47 | 000,000,471 | —- | C] () – C:Documents and SettingsericjsApplication Mover.cfg
[2012/05/12 11:45:26 | 3353,858,048 | -HS- | C] () – C:hiberfil.sys
[2012/05/07 18:18:16 | 000,000,146 | —- | C] () – C:Documents and SettingsericjsDesktopWatch Online Chopped Season 11 Episode 14 - Yuzu Never Know - Watch Series.url
[2012/05/06 20:25:22 | 000,000,200 | —- | C] () – C:Documents and SettingsericjsDesktopWatch The Next Food Network Star Serie Online - Watch Series.url
[2012/04/20 10:57:04 | 000,002,560 | —- | C] () – C:WINDOWSCTXFIRES.DLL
[2012/04/20 10:43:14 | 000,274,587 | R— | C] () – C:WINDOWSSystem32ctsbas2w.dat
[2012/04/20 10:43:14 | 000,149,838 | R— | C] () – C:WINDOWSSystem32ctbas2w.dat
[2012/04/20 10:43:12 | 000,043,520 | R— | C] () – C:WINDOWSSystem32CTBurst.dll
[2012/04/20 10:43:11 | 000,071,680 | R— | C] () – C:WINDOWSSystem32ctmmactl.dll
[2012/04/20 10:43:10 | 000,041,472 | R— | C] () – C:WINDOWSSystem32psconv.exe
[2012/04/20 10:43:10 | 000,007,680 | R— | C] () – C:WINDOWSSystem32enlocstr.exe
[2012/04/20 10:43:09 | 000,012,800 | R— | C] ( ) – C:WINDOWSSystem32killapps.exe
[2012/04/20 10:43:01 | 000,034,816 | R— | C] ( ) – C:WINDOWSSystem32a3d.dll
[2012/04/20 10:43:01 | 000,016,384 | R— | C] () – C:WINDOWSSystem32regplib.exe
[2012/04/20 10:42:55 | 000,000,307 | R— | C] () – C:WINDOWSSystem32kill.ini
[2012/04/20 10:42:54 | 000,099,922 | R— | C] () – C:WINDOWSSystem32instwdm.ini
[2012/04/20 10:42:54 | 000,053,932 | R— | C] () – C:WINDOWSSystem32ctdaught.dat
[2012/04/20 10:42:54 | 000,000,054 | R— | C] () – C:WINDOWSSystem32ctzapxx.ini
[2012/04/20 10:42:53 | 000,325,821 | —- | C] () – C:WINDOWSSystem32ctdlang.dat
[2012/04/20 10:42:53 | 000,313,207 | R— | C] () – C:WINDOWSSystem32ctstatic.dat
[2012/04/20 10:42:53 | 000,046,273 | —- | C] () – C:WINDOWSSystem32ctdnlstr.dat
[2011/12/05 23:04:00 | 000,059,904 | —- | C] () – C:WINDOWSSystem32OpenVideo.dll
[2011/12/05 23:03:52 | 000,054,784 | —- | C] () – C:WINDOWSSystem32OVDecode.dll
[2011/11/17 17:20:46 | 000,000,056 | —- | C] () – C:WINDOWSTUTORI~1.INI
[2011/11/11 02:53:07 | 000,005,358 | —- | C] () – C:WINDOWSSystem32M5633.bin
[2011/11/11 02:51:10 | 000,005,358 | —- | C] () – C:WINDOWSSystem32driversM5633.bin
[2011/08/28 14:36:21 | 000,000,218 | —- | C] () – C:WINDOWScdplayer.ini
[2011/08/28 14:24:02 | 000,001,492 | —- | C] () – C:Documents and SettingsAll UsersApplication Datass.ini
[2011/05/21 14:16:56 | 000,000,064 | —- | C] () – C:WINDOWSSystem32rp_stats.dat
[2011/05/21 14:16:56 | 000,000,044 | —- | C] () – C:WINDOWSSystem32rp_rules.dat
[2010/12/12 18:46:50 | 000,027,648 | —- | C] () – C:WINDOWSSystem32AVSredirect.dll
[2010/09/18 19:22:04 | 000,000,038 | —- | C] () – C:WINDOWSosAviSplitter.INI
[2010/09/17 07:15:27 | 000,962,560 | —- | C] () – C:WINDOWStesseract.exe
[2010/08/22 10:55:23 | 000,031,053 | —- | C] () – C:WINDOWSSystem32EPPICPattern131.dat
[2010/08/22 10:55:23 | 000,027,417 | —- | C] () – C:WINDOWSSystem32EPPICPattern121.dat
[2010/06/26 22:37:49 | 000,000,036 | —- | C] () – C:Documents and SettingsericjsLocal SettingsApplication Datahousecall.guid.cache
[2010/06/16 13:46:14 | 000,000,000 | —- | C] () – C:WINDOWSnsreg.dat
[2010/06/15 20:46:40 | 000,009,216 | —- | C] () – C:Documents and SettingsericjsLocal SettingsApplication DataDCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/08 20:58:36 | 000,000,552 | —- | C] () – C:WINDOWSSystem32d3d8caps.dat

========== LOP Check ==========

[2012/04/20 18:37:01 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataAbleton
[2012/05/27 04:00:05 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataAcronis
[2010/06/10 22:52:46 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataAlwil Software
[2011/08/28 14:22:51 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataFreeRIP
[2012/04/07 18:49:05 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataGraboid Inc
[2008/11/29 19:46:24 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataInsight Software
[2008/11/29 19:46:28 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataInsight Software Solutions
[2012/01/12 02:31:17 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataMetaQuotes
[2010/09/16 22:20:21 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataMSScanAppDataDir
[2010/09/16 07:25:25 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataNaturalSoft
[2010/09/16 18:07:24 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataNaturalSoft Co. Ltd
[2008/11/28 16:04:20 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataNewsBin
[2010/10/03 15:00:44 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataOrbNetworks
[2010/12/18 13:47:35 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataPinnacle
[2010/12/18 14:05:51 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataPinnacle VideoSpin
[2010/01/25 21:22:57 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataScanSoft
[2009/06/06 15:56:12 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataSimply Super Software
[2010/09/16 22:20:46 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataSSScanAppDataDir
[2010/09/17 07:15:19 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataTarma Installer
[2010/06/27 12:20:18 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataTEMP
[2010/08/24 18:51:17 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataTOSHIBA
[2011/06/03 13:03:20 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataXHEO INC
[2012/05/30 20:20:16 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataZoom Player
[2012/04/20 18:43:36 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataAbleton
[2012/05/26 14:30:23 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataAC3Filter
[2010/09/16 18:03:09 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataAcapela Group
[2010/07/18 12:00:39 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataAcronis
[2010/10/08 19:18:33 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataAnvSoft
[2012/04/07 19:00:47 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataDDMSettings
[2012/04/20 11:06:09 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataEmuPatchMixDSP
[2009/04/21 09:02:00 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataEPSON
[2012/02/18 14:35:20 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataFileZilla
[2010/12/02 09:00:14 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataGrabPro
[2008/12/15 10:04:33 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataICAClient
[2010/12/04 11:42:34 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataIEPro
[2009/04/11 09:00:57 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataLeadertech
[2012/03/25 17:06:31 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataMetaQuotes
[2010/12/04 16:59:11 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataMiniDm
[2012/01/17 17:20:02 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataMotorola
[2008/12/06 16:44:15 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataNewsbin
[2008/12/03 14:35:08 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataOEC
[2010/08/02 21:50:11 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataOpera
[2009/05/25 08:17:29 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataProfessional
[2010/12/02 09:01:10 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataProgSense
[2008/11/28 01:07:42 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataRadmin
[2010/01/25 21:23:55 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataScanSoft
[2009/06/06 15:56:12 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataSimply Super Software
[2008/11/29 11:24:54 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataThumbsPlus
[2009/03/18 08:50:53 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication Datawebex
[2010/10/27 16:24:51 | 000,000,000 | —D | M] – C:Documents and SettingsericjsApplication DataWinFF
[2012/05/30 14:16:49 | 000,000,486 | —- | M] () – C:WINDOWSTasksAd-Aware Update (Weekly).job
[2012/05/16 16:20:02 | 000,000,358 | —- | M] () – C:WINDOWSTasksMotoHelper MUM.job
[2012/05/30 16:20:01 | 000,000,354 | —- | M] () – C:WINDOWSTasksMotoHelper Routing.job
[2012/05/16 16:20:00 | 000,000,370 | —- | M] () – C:WINDOWSTasksMotoHelper Update.job

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%*.* >
[2011/10/07 17:34:32 | 000,008,059 | —- | M] () – C:aaw7boot.log
[2012/02/18 14:23:01 | 002,996,897 | —- | M] () – C:AcronisInfo.zip
[2004/08/03 22:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) – C:atapi.sys
[2008/11/27 22:49:30 | 000,000,000 | —- | M] () – C:AUTOEXEC.BAT
[2011/09/05 17:39:04 | 000,048,762 | —- | M] () – C:barstyle.dat
[2010/06/27 05:15:40 | 000,000,212 | -HS- | M] () – C:Boot.bak
[2012/05/12 11:43:13 | 000,000,308 | -HS- | M] () – C:boot.ini
[2004/08/03 23:00:00 | 000,260,272 | —- | M] () – C:cmldr
[2010/06/27 17:06:07 | 000,031,951 | —- | M] () – C:ComboFix.txt
[2008/11/27 22:49:30 | 000,000,000 | —- | M] () – C:CONFIG.SYS
[2009/12/22 21:26:13 | 000,041,172 | —- | M] () – C:debug.log
[2012/05/31 06:53:15 | 3353,858,048 | -HS- | M] () – C:hiberfil.sys
[2008/11/27 22:49:30 | 000,000,000 | RHS- | M] () – C:IO.SYS
[2008/10/26 15:22:18 | 003,045,668 | —- | M] () – C:Johnna9.mp3
[2011/05/13 12:15:07 | 000,001,168 | —- | M] () – C:Log.xml
[2010/06/10 15:50:24 | 000,000,009 | —- | M] () – C:maxres
[2008/11/27 22:49:30 | 000,000,000 | RHS- | M] () – C:MSDOS.SYS
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () – C:NTDETECT.COM
[2004/08/04 05:00:00 | 000,250,032 | RHS- | M] () – C:ntldr
[2008/11/27 23:31:28 | 000,000,575 | —- | M] () – C:RHDSetup.log
[2011/06/19 09:29:08 | 000,141,198 | —- | M] () – C:r_server.zip
[2010/09/16 22:16:24 | 000,000,205 | —- | M] () – C:Shortcut to CD Drive.lnk
[2011/03/04 17:14:42 | 000,094,208 | —- | M] () – C:TMA.dll
[2009/11/21 10:36:28 | 000,483,632 | —- | M] () – C:vcredist_x86.log
[2004/04/03 02:26:34 | 000,001,101 | —- | M] () – C:zplayer.regkey

< %systemroot%Fonts*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:WINDOWSFontsGlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:WINDOWSFontsGlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:WINDOWSFontsGlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:WINDOWSFontsGlobalUserInterface.CompositeFont

< %systemroot%Fonts*.dll >

< %systemroot%Fonts*.ini >
[2008/11/27 22:49:12 | 000,000,067 | -HS- | M] () – C:WINDOWSFontsdesktop.ini

< %systemroot%Fonts*.ini2 >

< %systemroot%Fonts*.exe >

< %systemroot%system32spoolprtprocsw32x86*.* >
[2008/07/06 05:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:WINDOWSsystem32spoolprtprocsw32x86filterpipelineprintproc.dll
[2007/04/09 14:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:WINDOWSsystem32spoolprtprocsw32x86mdippr.dll
[2008/07/06 03:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:WINDOWSsystem32spoolprtprocsw32x86printfilterpipelinesvc.exe

< %systemroot%REPAIR*.bak1 >

< %systemroot%REPAIR*.ini >

< %systemroot%system32*.jpg >

< %systemroot%*.jpg >

< %systemroot%*.png >

< %systemroot%*.scr >
[2011/09/06 13:45:29 | 000,041,184 | —- | M] (AVAST Software) – C:WINDOWSavastSS.scr
[2010/12/20 19:08:46 | 000,245,248 | —- | M] (Realtime Soft Ltd) – C:WINDOWSUltraMon.scr

< %systemroot%*._sy >

< %APPDATA%AdobeUpdate*.* >

< %ALLUSERSPROFILE%Favorites*.* >

< %APPDATA%Microsoft*.* >

< %PROGRAMFILES%*.* >

< %APPDATA%Update*.* >

< %systemroot%*. /mp /s >

< %systemroot%System32config*.sav >
[2008/11/27 14:34:30 | 000,094,208 | —- | M] () – C:WINDOWSSystem32configdefault.sav
[2008/11/27 14:34:30 | 000,659,456 | —- | M] () – C:WINDOWSSystem32configsoftware.sav
[2008/11/27 14:34:30 | 000,933,888 | —- | M] () – C:WINDOWSSystem32configsystem.sav

< %PROGRAMFILES%bak. /s >

< %systemroot%system32bak. /s >

< %ALLUSERSPROFILE%Start Menu*.lnk /x >
[2008/11/27 22:49:34 | 000,000,294 | -HS- | M] () – C:Documents and SettingsAll UsersStart Menudesktop.ini

< %systemroot%system32configsystemprofile*.dat /x >

< %systemroot%*.config >

< %systemroot%system32*.db >

< %PROGRAMFILES%Internet Explorer*.dat >

< %APPDATA%MicrosoftInternet ExplorerQuick Launch*.lnk /x >
[2008/11/27 22:53:40 | 000,000,119 | -HS- | M] () – C:Documents and SettingsericjsApplication DataMicrosoftInternet ExplorerQuick Launchdesktop.ini

< %USERPROFILE%Desktop*.exe >
[2012/02/18 14:21:00 | 002,154,444 | —- | M] () – C:Documents and SettingsericjsDesktopAcronisInfo.exe
[2011/11/11 02:04:56 | 001,163,272 | —- | M] () – C:Documents and SettingsericjsDesktopMaxiVistaViewerA.exe
[2012/05/31 07:11:23 | 000,595,968 | —- | M] (OldTimer Tools) – C:Documents and SettingsericjsDesktopOTL.exe

< %PROGRAMFILES%Common Files*.* >

< %systemroot%*.src >

< %systemroot%install*.* >

< %systemroot%system32DLL*.* >

< %systemroot%system32HelpFiles*.* >

< %systemroot%system32rundll*.* >

< %systemroot%winn32*.* >

< %systemroot%Java*.* >

< %systemroot%system32test*.* >

< %systemroot%system32Rundll32*.* >

< %systemroot%AppPatchCustom*.* >

< HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU >

< HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto UpdateResultsInstall|LastSuccessTime /rs >
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto UpdateResultsInstallLastSuccessTime: 2012-05-12 18:50:39

========== Alternate Data Streams ==========

@Alternate Data Stream - 8 bytes -> C:Documents and SettingsericjsMy DocumentsEric.nbi:Version
@Alternate Data Stream - 108 bytes -> C:Documents and SettingsAll UsersApplication DataTEMP:CB0AACC9

< End of report >


Extras.txt

Extras.txt

OTL Extras logfile created on: 5/31/2012 7:25:01 AM - Run 1
OTL by OldTimer - Version 3.2.44.0 Folder = C:Documents and SettingsericjsDesktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.12 Gb Total Physical Memory | 2.03 Gb Available Physical Memory | 65.02% Memory free
8.82 Gb Paging File | 7.86 Gb Available in Paging File | 89.02% Paging File free
Paging file location(s): E:pagefile.sys 6000 6000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:WINDOWS | %ProgramFiles% = C:Program Files
Drive C: | 55.90 Gb Total Space | 18.21 Gb Free Space | 32.57% Space Free | Partition Type: NTFS
Drive E: | 249.32 Gb Total Space | 88.78 Gb Free Space | 35.61% Space Free | Partition Type: NTFS
Drive F: | 59.62 Gb Total Space | 22.04 Gb Free Space | 36.97% Space Free | Partition Type: NTFS
Drive G: | 401.11 Gb Total Space | 144.43 Gb Free Space | 36.01% Space Free | Partition Type: NTFS
Drive H: | 156.82 Gb Total Space | 27.70 Gb Free Space | 17.67% Space Free | Partition Type: NTFS
Drive I: | 470.78 Gb Total Space | 420.63 Gb Free Space | 89.35% Space Free | Partition Type: NTFS
Drive K: | 292.48 Gb Total Space | 14.04 Gb Free Space | 4.80% Space Free | Partition Type: NTFS

Computer Name: MAIN | User Name: ericjs | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINESOFTWAREClasses]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USERSOFTWAREClasses]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINESOFTWAREClassesshell[command]command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%system32rundll32.exe %SystemRoot%system32shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:Program FilesVideoLANVLCvlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:Program FilesVideoLANVLCvlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:Program FilesWinampwinamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:Program FilesWinampwinamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:Program FilesWinampwinamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoring]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringAhnlabAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringKasperskyAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSophosAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTinyFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows NTSystemRestore]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSr]
"Start" = 0

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsFirewall]

[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsFirewallDomainProfile]

[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsFirewallStandardProfile]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFi
rewallPolicyDomainProfile]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFi
rewallPolicyDomainProfileGloballyOpenPortsList]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFi
rewallPolicyStandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFi
rewallPolicyStandardProfileGloballyOpenPortsList]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"23:TCP" = 23:TCP:*:Enabled:Radmin
"5951:TCP" = 5951:TCP:*:Enabled:MaxiVista Server
"5952:TCP" = 5952:TCP:*:Enabled:MaxiVista Server
"5953:TCP" = 5953:TCP:*:Enabled:MaxiVista Server

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFi
rewallPolicyDomainProfileAuthorizedApplicationsList]
"C:Program FilesCommon FilesAcronisAgentagent.exe" = C:Program FilesCommon FilesAcronisAgentagent.exe:*:Enabled:Acronis Remote Agent Service – (Acronis)
"C:Program FilesAcronisBackupAndRecoverymms.exe" = C:Program FilesAcronisBackupAndRecoverymms.exe:*:Enabled:Acronis Managed Machine Service – (Acronis)

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFi
rewallPolicyStandardProfileAuthorizedApplicationsList]
"C:Program FilesAcronisTrueImageWorkstationTrueImage.exe" = C:Program FilesAcronisTrueImageWorkstationTrueImage.exe:*:Enabled:Acronis True Image
"C:WINDOWSsystem32rserver30rserver3.exe" = C:WINDOWSsystem32rserver30rserver3.exe:*:Enabled:Radmin Server 3 – (Famatech International Corp.)
"C:Program FilesRadmin Viewer 3Radmin.exe" = C:Program FilesRadmin Viewer 3Radmin.exe:*:Enabled:Radmin Viewer 3 – (Famatech International Corp.)
"C:Program FilesOECTraderTrader.exe" = C:Program FilesOECTraderTrader.exe:*:Enabled:OEC Trader
"C:Program FilesMetaTrader 4 at FOREX.comterminal.exe" = C:Program FilesMetaTrader 4 at FOREX.comterminal.exe:*:Enabled:MetaTrader – (MetaQuotes Software Corp.)
"C:Program FilesMetatrader 4 by Gallant FXterminal.exe" = C:Program FilesMetatrader 4 by Gallant FXterminal.exe:*:Enabled:MetaTrader
"C:Documents and SettingsericjsIAG Remote Access Agentmailsolanocountycomowa1ProxyProcess_Win.exe" = C:Documents and SettingsericjsIAG Remote Access Agentmailsolanocountycomowa1ProxyProcess_Win.exe:*:Enabled:ProxyProcess_Win – ()
"C:Program FilesOperaopera.exe" = C:Program FilesOperaopera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:Program FilesWinamp RemotebinOrb.exe" = C:Program FilesWinamp RemotebinOrb.exe:*:Enabled:Orb – (Orb Networks, Inc.)
"C:Program FilesWinamp RemotebinOrbTray.exe" = C:Program FilesWinamp RemotebinOrbTray.exe:*:Enabled:OrbTray – (Orb Networks)
"C:Program FilesWinamp RemotebinOrbStreamerClient.exe" = C:Program FilesWinamp RemotebinOrbStreamerClient.exe:*:Enabled:Orb Stream Client – (Orb Networks)
"C:Program FilesIEProMiniDM.exe" = C:Program FilesIEProMiniDM.exe:*:Enabled:MiniDM – (IE7Pro.com)
"C:Program FilesPinnacleVideoSpinProgramsRM.exe" = C:Program FilesPinnacleVideoSpinProgramsRM.exe:*:Enabled:Render Manager – (Pinnacle Systems)
"C:Program FilesPinnacleVideoSpinProgramsumi.exe" = C:Program FilesPinnacleVideoSpinProgramsumi.exe:*:Enabled:umi – (Pinnacle Systems)
"C:Program FilesPinnacleVideoSpinProgramsVideoSpin.exe" = C:Program FilesPinnacleVideoSpinProgramsVideoSpin.exe:*:Enabled:Pinnacle VideoSpin – (Pinnacle Systems)
"C:WINDOWSsystem32dpvsetup.exe" = C:WINDOWSsystem32dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test – (Microsoft Corporation)
"G:NewsBin5nbpro.exe" = G:NewsBin5nbpro.exe:*:Enabled:NewsBin Pro – (CMCEI)
"G:NewsBin5NewsbinPro.exe" = G:NewsBin5NewsbinPro.exe:*:Enabled:Newsbin Pro – (CMCEI)
"C:Program FilesMaxiVista Standard ServerMaxiVistaA.exe" = C:Program FilesMaxiVista Standard ServerMaxiVistaA.exe:*:Enabled:MaxiVista – ()
"C:Program FilesCommon FilesAcronisAgentagent.exe" = C:Program FilesCommon FilesAcronisAgentagent.exe:*:Enabled:Acronis Remote Agent Service – (Acronis)
"C:Program FilesAcronisBackupAndRecoverymms.exe" = C:Program FilesAcronisBackupAndRecoverymms.exe:*:Enabled:Acronis Managed Machine Service – (Acronis)
"C:Program FilesWinampwinamp.exe" = C:Program FilesWinampwinamp.exe:*:Enabled:Winamp – (Nullsoft, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{016CF441-8F40-469E-923B-35E2F9363E54}" = Radmin Viewer 3.1
"{04356461-0ED1-4987-B16B-C28FF91DFB96}" = Acronis Backup & Recovery 11 Tray Monitor
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0E8261F0-C53B-490A-8B19-FA0A372A7BAA}" = Toggle Flash
"{108A39BF-4ED1-4293-B11A-06BD521FB8F7}" = FreeOCR 3.0
"{12F88D4F-B525-4F01-BD5E-522D81F049AF}" = PaulVoice
"{1BDFFDBB-A0AB-469B-AEE2-245F2E80D768}" = Walk Forward Analyzer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20187EBD-71B1-4913-AEFF-6E2E2A444434}" = Giganews Accelerator
"{211543D1-F7F8-4FF6-B008-34AB89D62A1D}_is1" = MaxiVista Standard Server v3.0.29
"{2300EE96-0A41-4FAB-BD03-989EC44577A0}" = Acronis Disk Director Suite
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 20
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2D7D9D86-923A-41A8-919F-437332AB1033}" = Nero 7 Ultra Edition
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{384A95F1-EDDA-4BBE-BC6B-7FAA886380F6}" = Trade Navigator
"{385DD1DD-65AA-408D-8E70-74601C2DB7E6}" = Ad-Aware
"{3ACA2514-480B-4774-B986-AE4546B00381}" = KateVoice
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D2008B2-9C81-4122-BE3F-688B55FA55C5}" = Microsoft Report Viewer Redistributable 2005
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HYDRAVISION
"{4269F3F3-4E5A-47A4-B0AB-258BC659AFB3}" = Acronis Backup & Recovery 11 Agent for Windows
"{4324BC93-C82F-ED16-BA86-5E34B9E05303}" = ccc-core-static
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E455777-DEF7-43CA-AA0E-3A268F55974A}" = Acronis Backup & Recovery 11 Agent Core
"{4ED118EE-785C-CC18-5D2E-D5CA4BAA03F0}" = Catalyst Control Center Graphics Full New
"{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1" = Data Lifeguard Diagnostic for Windows 1.21
"{537056B7-32A4-4408-9B54-0341963C7C9C}" = UltraMon
"{539475B7-44B7-8B0A-134C-F01B9C8B7569}" = ccc-core-preinstall
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5A0C892E-FD1C-4203-941E-0956AED20A6A}" = APC PowerChute Personal Edition
"{5AC7AE54-55DF-1126-076C-623F008D40B6}" = Catalyst Control Center Graphics Full Existing
"{5D8AA350-2C1F-4B9C-8866-4064AEBCAD35}" = Ableton Live 8
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{6351D217-3EE3-1967-29BE-6A77635FE485}" = Skins
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AB9CD3A-F91F-233B-923B-6C59BA63524D}" = Catalyst Control Center HydraVision Full
"{6BF1780B-36EA-432B-9451-DD84FF5C9D52}" = Radmin Server 3.1
"{6C12B6BF-3891-497B-B5CA-3D64DA093947}" = Motorola Mobile Drivers Installation 5.4.0
"{6D420D94-7B4A-4213-B8D4-AEC3B45B5158}" = Digital Audio System
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{783E0AD7-C128-4398-9F74-99D3EFF2875D}" = Deep Space Nine The Fallen
"{79F86C69-2B17-4368-9234-472A23639E16}" = Ad-Aware
"{7C9944A5-90DF-4B7B-A06E-F815B3AD6CAF}" = Topmost Clock
"{83657363-98CE-4579-AEF0-ECE2B9790C60}" = Acronis Backup & Recovery 11 Management Console
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85A91C22-C369-FCFB-5F1F-D59EB21AD0E1}" = CCC Help English
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{8E776491-AB5A-4304-AEB3-20A3CE57713E}" = Acronis Backup & Recovery 11 Bootable Media Builder
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6D0140F-E62F-9D1E-2408-9CFF91FF6FC8}" = ccc-utility
"{A97657A7-A685-4EC4-AB91-534819E88EF9}" = NaturalReader10
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1
"{ADD24D05-DDEA-39CB-0E92-AA371AEE2894}" = Catalyst Control Center InstallProxy
"{B1756286-6BE5-4AA5-BEC9-BAD90A274E37}" = Acronis Backup & Recovery 11 Command-Line Tool
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software
"{C4186C0D-FB9F-5D83-21FB-A737A13EFAE6}" = AMD Catalyst Install Manager
"{C44A7422-E380-44BE-79FE-1C032D8A03A7}" = Catalyst Control Center Core Implementation
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}" = ClearType Tuning Control Panel Applet
"{CCF6F57B-F6B4-4508-BF45-63AAC9DE416A}" = Quicken 2010
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D3B1C799-CB73-42DE-BA0F-2344793A095C}" = Catalyst Control Center - Branding
"{D433ABC3-0CD8-4BB0-B6A9-84501B4B47B7}" = ArcSoft PhotoImpression 5
"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime
"{DDDD0C4B-57F7-4A85-ACF0-DB3FC8F1DBB4}" = Dragon NaturallySpeaking 8
"{E3993D46-AE3F-402E-9F9D-EEBDFBEC3564}" = Corel WinDVD 9
"{E5D24929-91A4-B0A1-DE00-AFC453921EF7}" = Catalyst Control Center Graphics Light
"{E6C09BFB-BA75-15C7-5B18-A2CE31C4F42B}" = Catalyst Control Center Graphics Previews Common
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F5EC7F6B-B68B-433C-AA20-54EDFE76191D}_is1" = Forex Tester 2.8.5
"{FC8D21C8-7B29-4104-ADB0-FEE9CA1C7922}" = Folder Size for Windows
"{FEB15887-0932-4D2D-BB85-6AC03FBF1AA8}" = Pinnacle VideoSpin
"53F13DB4D9611FD63BE580F06F0729BF236ABE68" = Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
"7-Zip" = 7-Zip 9.20
"AC3Filter_is1" = AC3Filter 2.1a
"ActiveScan 2.0" = Panda ActiveScan 2.0
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"All ATI Software" = ATI - Software Uninstall Utility
"Ant Movie Catalog_is1" = Ant Movie Catalog
"Any Video Converter_is1" = Any Video Converter 3.0.7
"Application Mover (Shareware)_is1" = Application Mover
"ATI Display Driver" = ATI Display Driver
"avast" = avast! Free Antivirus
"AviSynth" = AviSynth 2.5
"Bass Audio Decoder" = Bass Audio Decoder (remove only)
"Belarc Advisor" = Belarc Advisor 7.2
"CCleaner" = CCleaner
"CD Audio Reader Filter" = CD Audio Reader Filter (remove only)
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Convergence" = Convergence
"DC-Bass Source" = DC-Bass Source 1.1.1
"DCoder Image Source" = DCoder Image Source (remove only)
"DirectVobSub" = DirectVobSub (remove only)
"DivX Setup" = DivX Setup
"DScaler 5 Mpeg Decoders_is1" = DScaler 5 Mpeg Decoders
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"ESET Online Scanner" = ESET Online Scanner v3
"ffdshow_is1" = ffdshow v1.2.4436 [2012-04-22]
"FFMPEG Core Files" = FFMPEG Core Files (remove only)
"FitDay_is1" = FitDay PC version 1.0
"FMCODEC" = FM Screen Capture Codec (Remove Only)
"Foxit PDF Editor" = Foxit PDF Editor
"FullDisk" = FullDisk
"Gabest MPEG Splitter" = Gabest MPEG Splitter (remove only)
"GearVolt MP3_is1" = GearVolt
"GetRight_is1" = GetRight
"HaaliMkx" = Haali Media Splitter
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"IE7Pro" = IE7Pro
"ie8" = Windows Internet Explorer 8
"InstallShield_{E3993D46-AE3F-402E-9F9D-EEBDFBEC3564}" = Corel WinDVD 9
"LAV Filters" = LAV Filters (remove only)
"lavfilters_is1" = LAV Filters 0.50.2
"lvdrivers_12.10" = Logitech Webcam Software Driver Package
"Macro Express 3" = Macro Express 3
"Magic ISO Maker v5.3 (build 0209)" = Magic ISO Maker v5.3 (build 0209)
"Magic ISO Maker v5.3 (build 0229)" = Magic ISO Maker v5.3 (build 0229)
"MagicDisc 2.5.74" = MagicDisc 2.5.74
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Matroska" = Matroska (remove only)
"MediaInfo" = MediaInfo 0.7.48
"MetaFrame Presentation Server Web Client for Win32" = MetaFrame Presentation Server Web Client for Win32
"MetaTrader - Alpari (US)" = MetaTrader - Alpari (US)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Forefront UAG endpoint components 3.1.0" = Microsoft Forefront UAG endpoint components v4.0.0
"Microsoft Report Viewer Redistributable 2005" = Microsoft Report Viewer Redistributable 2005
"MONOGRAM AMR Splitter/Decoder" = MONOGRAM AMR Splitter/Decoder (remove only)
"MotoHelper" = MotoHelper 2.1.32 Driver 5.4.0
"Mozilla Firefox 8.0.1 (x86 en-US)" = Mozilla Firefox 8.0.1 (x86 en-US)
"MP3 Edit Magic Platinum_is1" = MP3 Edit Magic Platinum version 2005
"MultiRes (remove only)" = MultiRes (remove only)
"NewsBin5" = NewsBin Pro
"Newsbin6" = Newsbin Pro
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OpenSource AVI Splitter" = OpenSource AVI Splitter (remove only)
"OpenSource DTS/AC3/DD+ Source Filter" = OpenSource DTS/AC3/DD+ Source Filter (remove only)
"OpenSource Flash Video Splitter" = OpenSource Flash Video Splitter (remove only)
"Opera 11.11.2109" = Opera 11.11
"Orb" = Winamp Remote
"PdaNet_is1" = PdaNet for Android 3.02
"Pen Tablet Driver" = Pen Tablet
"ProgSense_is1" = ProgSense
"QuickPar" = QuickPar 0.9
"RealMedia" = RealMedia (remove only)
"ScreenVirtuoso 3.10_is1" = ScreenVirtuoso 3.10
"ScreenVirtuoso PRO_is1" = ScreenVirtuoso PRO 4.15
"SHOUTcast Source" = SHOUTcast Source (remove only)
"Silent Package Run-Time Sample" = EPSON CX 3800 Guide
"ST6UNST #1" = FolderMatch v3.4.8
"Tag&Rename;_is1" = Tag&Rename; 3.5.6
"Taskbar Shuffle_is1" = Taskbar Shuffle version 2.5
"ThumbsPlus6" = ThumbsPlus version 6.0
"Tomb Raider: Anniversary" = Tomb Raider: Anniversary 1.0
"Tomb Raider: Underworld" = Tomb Raider: Underworld 1.1
"ToolTipFixer" = ToolTipFixer 2.0
"Trojan Remover_is1" = Trojan Remover 6.7.9
"Tweak UI 2.10" = Tweak UI
"VLC media player" = VLC media player 1.0.1
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"WinAVI Video Converter_is1" = WinAVI Video Converter 5.8
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinFF_is1" = WinFF 1.3.1
"WinRAR archiver" = WinRAR archiver
"XviD" = XviD MPEG-4 Codec
"ZoomPlayer" = Zoom Player (remove only)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionUninstall]
"1df0cdb088182ccc" = FOREXTraderPro
"Fathom It" = Fathom It!
"GoToMeeting" = GoToMeeting 4.5.0.457
"Winamp Detect" = Winamp Detector Plug-in

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/27/2012 6:17:32 PM | Computer Name = MAIN | Source = FolderSize | ID = 0
Description =

Error - 5/28/2012 12:38:23 AM | Computer Name = MAIN | Source = FolderSize | ID = 0
Description =

Error - 5/29/2012 8:35:15 PM | Computer Name = MAIN | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 giganewsaccelerator.exe, P2 [removed], P3 4daf079f,
P4 system.windows.forms, P5 2.0.0.0, P6 4889dee7, P7 48b9, P8 96, P9 system.invalidoperationexception,
P10 NIL.

Error - 5/29/2012 11:34:45 PM | Computer Name = MAIN | Source = FolderSize | ID = 0
Description =

Error - 5/30/2012 10:18:05 AM | Computer Name = MAIN | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.3156, faulting
module unknown, version 0.0.0.0, fault address 0x059229c0.

Error - 5/30/2012 11:32:03 AM | Computer Name = MAIN | Source = FolderSize | ID = 0
Description =

Error - 5/30/2012 9:01:13 PM | Computer Name = MAIN | Source = FolderSize | ID = 0
Description =

Error - 5/30/2012 10:47:24 PM | Computer Name = MAIN | Source = FolderSize | ID = 0
Description =

Error - 5/30/2012 11:07:53 PM | Computer Name = MAIN | Source = FolderSize | ID = 0
Description =

Error - 5/30/2012 11:20:28 PM | Computer Name = MAIN | Source = FolderSize | ID = 0
Description =

[ System Events ]
Error - 5/26/2012 6:14:47 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Acronis Removable Storage
Management Service service to connect.

Error - 5/26/2012 6:14:47 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7000
Description = The Acronis Removable Storage Management Service service failed to
start due to the following error: %%1053

Error - 5/26/2012 6:14:48 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Acronis Managed Machine
Service service to connect.

Error - 5/26/2012 6:14:48 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7000
Description = The Acronis Managed Machine Service service failed to start due to
the following error: %%1053

Error - 5/26/2012 6:21:45 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Acronis Removable Storage
Management Service service to connect.

Error - 5/26/2012 6:21:45 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7000
Description = The Acronis Removable Storage Management Service service failed to
start due to the following error: %%1053

Error - 5/26/2012 6:23:19 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Acronis Removable Storage
Management Service service to connect.

Error - 5/26/2012 6:23:19 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7000
Description = The Acronis Removable Storage Management Service service failed to
start due to the following error: %%1053

Error - 5/28/2012 11:54:19 AM | Computer Name = MAIN | Source = Service Control Manager | ID = 7031
Description = The Acronis Managed Machine Service service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in
0 milliseconds: Restart the service.

Error - 5/30/2012 11:07:14 PM | Computer Name = MAIN | Source = Distributed Link Tracking Client | ID = 12507
Description = The volume ID for F: has been reset, since it was a duplicate of that
on C:. This volume ID is used by Distributed Link Tracking to automatically repair
file links, such as Shell Shortcuts and OLE links, when for some reason those links
become broken.


< End of report >
Hi

There is nothing obvious in the logs, but we can run a couple of scans

Please do the following:


Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
    O2 - BHO: (no name) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
    
    :Files
    ipconfig /flushdns /c
    
    :Commands
    [resethosts]
    [purity]
    [emptytemp]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post the OTL log


NEXT


Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.




NEXT


Go here to run an online scanner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish
Hi, tried to run OTL twice and both times it crashed. First my Ultramon bar and Start bar disappeared, then got an error that OTL.exe encountered an error and had to close, then my Internet Explorer crashed, then the Task Manager. Luckily I could reopen task manager and reboot. Tried again, same thing. Ideas? Second time I see a cmd.bat and cmd.txt on my desktop.
Didn't know the ESET was going to take 5 or 6 hours! Oh, well. Had already run MBAM before, nothing found. The RAdmin is not infected and not installed either; I use it on a different PC. I uninstalled the IE7Pro and FolderSize a few days ago, and so far have not had the PC lock or crash other than the OTL issue. The rest of the "problems" found by ESET are either false positives and others I have never installed so don't know. Thanks. MBAM: Malwarebytes Anti-Malware (PRO) 1.61.0.1400 www.malwarebytes.org Database version: v2012.06.05.06 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 ericjs :: MAIN [administrator] Protection: Disabled 6/5/2012 6:54:44 PM mbam-log-2012-06-05 (18-54-44).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 210711 Time elapsed: 10 minute(s), 53 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) —————– ESET: C:\r_server.zip Win32/RemoteAdmin.RAdmin.20 application C:\Documents and Settings\ericjs\My Documents\Downloads\freeripmp3-setup.exe multiple threats F:\dl\audio\freeripmp4.exe a variant of Win32/AdInstaller application F:\dl\audio\winamp5623_full_emusic-7plus_all.exe Win32/OpenCandy application F:\dl\other\BitComet\Downloads\Cell Phone Software bitpim\P2kCommander-V329.zip probably a variant of Win32/TrojanDownloader.Agent.CPFHFTM trojan F:\dl\popup stopper\IE7ProSetup_2.5.1.exe Win32/OpenCandy application F:\dl\Quicken\Intuit Quicken Home & Business 2012\Intuit Quicken Home & Business 2012.rar a variant of MSIL/Injector.TK trojan F:\dl\Quicken\Quicken Home And Business 2010_par2\Quicken Home And Business 2010\Quicken_Home_and_Business_2010.iso multiple threats F:\dl\Utils\cnet_FolderSize-2_5-x86_msi.exe a variant of Win32/InstallCore.D application F:\dl\video\alt.binaries.warez\Ahead Nero v8.1.1.4 Ultra Edition\Nero 8 Ultra Keygen.rar a variant of Win32/Keygen.DA application F:\dl\video\alt.binaries.warez\Dragon Naturally Speaking Pref v9.51\Dragon Naturally Speaking Pref v9.51 Keygen.rar probably a variant of Win32/Agent.KLCXOLV trojan F:\dl\video\alt.binaries.warez\Dragon Naturally Speaking Pref v9.51\Dragon NaturallySpeaking v9.51 Preferred.iso probably a variant of Win32/Agent.KLCXOLV trojan F:\dl\video\Sounds-Music\Setup_FreeConverter.exe Win32/Toolbar.Widgi application F:\dl\video\Utils\MediaInfo_GUI_0.7.25_Windows_i386.exe Win32/OpenCandy application F:\dl\video\Utils\avisplitter1.0-crack\avisplitter1.0birdman.zip a variant of Win32/Tool.TPE.A application F:\dl\video\Utils\cdrwin\CDRWin.v3.8G.Keygen.zip a variant of Win32/Keygen.CY application F:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\ag-dxc321.zip a variant of Win32/Keygen.AF application F:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Copy Platinum 3.2.1\Keymaker\Keymaker.exe a variant of Win32/Keygen.AF application F:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Copy Xpress 3.2.1\Keymaker\Keymaker.exe a variant of Win32/Keygen.AF application F:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Point 2.1.0\Keymaker\Keymaker.exe a variant of Win32/Keygen.AF application F:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Show 2.2\Keymaker\Keymaker.exe a variant of Win32/Keygen.AF application F:\dl\video\Utils\DVD2SVCDstuff\D2SRoBa360.exe Win32/PrcView application F:\dl\video\Utils\dvd_kit\dvd_kit\win_rar\cr-winrar300.zip probably a variant of Win32/Agent.EQHKZOI trojan F:\dl\video\Utils\dvd_kit\dvd_kit\win_rar\CRK-WinRAR.exe probably a variant of Win32/Agent.EQHKZOI trojan F:\dl\video\Utils\MKV Video Converter\avc-free.exe Win32/OpenCandy application F:\dl\video\Utils\Morph\Morph20.exe multiple threats F:\dl\video\Utils\Nero\Nero Burning Rom V 6.3.1.1\Nero Burning Rom V 6.3.1.1.zip probably a variant of Win32/Agent.NIXPMNB trojan F:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Keygen.exe a variant of Win32/Keygen.CY application F:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Nero KeyGen's\Keygen-NeroMediaPlayer_1404.exe a variant of Win32/Keygen.CY application F:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Nero KeyGen's\Keygen-NeroMix_1404.exe a variant of Win32/Keygen.CY application F:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Nero KeyGen's\Keygen-NeroVisionExpress_20022.exe a variant of Win32/Keygen.CY application F:\dl\video\Utils\Newbie Kit\Alcohol.120%1.9.5.3105.Retail.BLZ.rar a variant of Win32/HackTool.Patcher.A application F:\dl\video\Utils\VCDCutter\Jiao_VCDCutter_v4[1].03_by_LasH.zip a variant of Win32/Tool.TPE.A application F:\dl\video\Utils\VCDCutter\Jiao_VCDCutter_v4[1].03_by_LasH\PatcH.exe a variant of Win32/Tool.TPE.A application F:\dl\video\Utils\WinDVD\Corel WinDVD Plus Blu-ray v.9.0 Multilingual\Keygen.exe a variant of Win32/Keygen.AF application F:\dl\video\Utils\WinRAR\winrarv3.30beta4crackcursed.zip a variant of Win32/Tool.TPE.A application F:\dl\video\Utils\WM Recorder 10.2\10.2crack.zip probably a variant of Win32/Agent.FAWLJXK trojan F:\dl\video\Utils\WM Recorder 10.2\10.2patch.zip a variant of Win32/HackTool.Patcher.A application F:\dl\video\Utils\WM Recorder 10.2\10.2crack\WM.Recorder.v10.2.Incl.Keygen.and.Patch-iNFECTED\Crack.rar probably a variant of Win32/Agent.FAWLJXK trojan F:\dl\video\Utils\wmv2avi\ossvc.exe a variant of Win32/Adware.NavExcel application F:\dl\Windows\VirtualPC\VMware Workstation v5.5.1.19175\Keygen.exe probably a variant of Win32/Agent.MUFXBEF trojan
Hi,

I notice the proliferation of cracks and keygens on your system. Pirating software in most Countries is considered theft and against the law.

As well as being a Criminal offence it can severely compromise your system as we find that those pirated programs are often injected with malicious code. Often the malware is what's known as a "back door" which allows hackers access to your system and can compromise your personal information.

Your personal identity may already be at risk.

From a computer that has never been infected, you should change all your on-line passwords and advise all your financial institutions that your personal information may be compromised.

Refer to this article: http://www.dslreports.com/faq/10451

I urge you to uninstall any pirated programs that you may have installed. What the Tech does not condone the use of pirated software.




Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
You're right I should remove them. I don't even know why I have them because I have not installed anything pirated for a long time and I purchased licenses for the ones I wanted to keep. I will remove them.

Here is the TXT. I need to know how to put back the Orphans that were removed (from the registry?) because I still have these programs and the drive letter changed from G to F. Thanks.

ComboFix 12-06-06.02 - ericjs 06/06/2012 17:59:13.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3198.1308 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\ericjs\Application Data\Microsoft\Office\Recent\Amsterdam Metro.doc.LNK
c:\documents and settings\ericjs\Application Data\Microsoft\Office\Recent\Before your work.doc.LNK
c:\documents and settings\ericjs\Application Data\Microsoft\Office\Recent\###### - Meredith Brooks.doc.LNK
c:\documents and settings\ericjs\Application Data\Microsoft\Office\Recent\eu_trade_examples.doc.LNK
c:\documents and settings\ericjs\Application Data\Microsoft\Office\Recent\FAP Questions and Answers ml=0i.doc.LNK
c:\documents and settings\ericjs\Application Data\Microsoft\Office\Recent\if.doc.LNK
c:\documents and settings\ericjs\Application Data\Microsoft\Office\Recent\Invictus.doc.LNK
c:\documents and settings\ericjs\Application Data\Microsoft\Office\Recent\Langton.doc.LNK
c:\documents and settings\ericjs\Application Data\Microsoft\Office\Recent\Movies.doc.LNK
c:\documents and settings\ericjs\Application Data\Microsoft\Office\Recent\New Microsoft Word Document.doc.LNK
c:\documents and settings\ericjs\Application Data\Microsoft\Office\Recent\posts.doc.LNK
c:\documents and settings\ericjs\g2mdlhlpx.exe
c:\documents and settings\ericjs\WINDOWS
c:\windows\Downloaded Program Files\DM.0
c:\windows\Downloaded Program Files\DM.0\DMService.exe
c:\windows\Downloaded Program Files\DM.0\WhlMgr.dll
c:\windows\system32\avisynth.dll
c:\windows\system32\devil.dll
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\PowerToyReadme.htm
c:\windows\system32\tmpF9.tmp
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_DMService
——-\Legacy_DMService
——-\Service_DMService
——-\Service_DMService
.
.
((((((((((((((((((((((((( Files Created from 2012-05-07 to 2012-06-07 )))))))))))))))))))))))))))))))
.
.
2012-06-06 00:39 . 2012-06-06 00:39 ——– d—–w- C:\_OTL
2012-06-03 02:06 . 2010-09-18 06:53 953856 -c—-w- c:\windows\system32\dllcache\mfc40u.dll
2012-06-03 02:05 . 2010-08-23 16:12 617472 -c—-w- c:\windows\system32\dllcache\comctl32.dll
2012-06-03 02:02 . 2010-11-02 15:17 40960 -c—-w- c:\windows\system32\dllcache\ndproxy.sys
2012-06-03 02:01 . 2011-04-21 13:37 105472 -c—-w- c:\windows\system32\dllcache\mup.sys
2012-06-03 01:57 . 2011-07-08 14:02 10496 -c—-w- c:\windows\system32\dllcache\ndistapi.sys
2012-06-03 01:57 . 2012-01-11 19:06 3072 -c—-w- c:\windows\system32\dllcache\iacenc.dll
2012-06-03 01:57 . 2012-01-11 19:06 3072 ——w- c:\windows\system32\iacenc.dll
2012-06-03 01:57 . 2010-10-11 14:59 45568 -c—-w- c:\windows\system32\dllcache\wab.exe
2012-06-03 01:56 . 2012-01-09 16:20 139784 -c—-w- c:\windows\system32\dllcache\rdpwd.sys
2012-06-02 18:45 . 2008-04-14 12:42 294912 ——w- c:\program files\Windows Media Player\dlimport.exe
2012-06-02 18:43 . 2008-04-14 12:41 25471 ——w- c:\windows\system32\drivers\atv04nt5.dll
2012-06-02 18:42 . 2006-12-29 07:31 19569 —-a-w- c:\windows\003201_.tmp
2012-05-31 02:54 . 2012-05-31 02:54 ——– d—–r- C:\acroldr
2012-05-30 14:40 . 2012-05-30 14:40 ——– d—–w- c:\documents and settings\ericjs\Local Settings\Application Data\PCHealth
2012-05-26 22:21 . 2012-05-26 22:21 80416 —-a-w- c:\windows\system32\drivers\fltsrv.sys
2012-05-26 21:30 . 2012-05-26 21:30 ——– d—–w- c:\documents and settings\ericjs\Application Data\AC3Filter
2012-05-12 19:15 . 2012-05-15 01:29 ——– d—–w- c:\program files\AppMove
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-02 16:37 . 2012-02-18 21:22 2994412 —-a-w- C:\AcronisInfo.zip
2012-05-26 22:21 . 2008-11-28 07:09 614560 —-a-w- c:\windows\system32\drivers\timntr.sys
2012-05-26 22:21 . 2008-11-28 06:07 177600 —-a-w- c:\windows\system32\drivers\snapman.sys
2012-05-01 16:36 . 2012-05-01 16:36 140376 —-a-w- c:\windows\system32\MicrosoftUpdateCatalogWebControl.dll
2012-04-20 18:00 . 2012-04-20 17:44 409600 —-a-w- c:\windows\system32\wrap_oal.dll
2012-04-20 18:00 . 2012-04-20 17:44 114688 —-a-w- c:\windows\system32\OpenAL32.dll
2012-04-17 18:49 . 2012-04-08 19:57 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-17 18:49 . 2011-05-18 20:29 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-11 13:14 . 2004-08-04 12:00 2148352 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-04-11 13:12 . 2004-08-04 12:00 1862272 —-a-w- c:\windows\system32\win32k.sys
2012-04-11 12:35 . 2004-08-03 22:59 2026496 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-09 07:40 . 2008-11-28 21:51 79360 —-a-w- c:\windows\system32\ff_vfw.dll
2012-04-09 07:39 . 2009-11-19 05:15 48128 —-a-w- c:\windows\system32\ff_acm.acm
2012-04-04 22:56 . 2009-06-06 16:47 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-11-21 04:04 . 2011-11-23 21:57 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{127AD70F-B2B7-4f6a-ACD9-C7B1FE48C8C0}]
2008-04-14 12:42 78848 —-a-w- c:\windows\system32\msiexec.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SetDefaultMIDI"="MIDIDef.exe" [2009-02-23 31232]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 155648]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" [2007-02-26 16125440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"OSSelectorReinstall"="c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-02-23 2209224]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"EPSON Stylus CX3800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE" [2005-02-08 98304]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"AcronisTimounterMonitor"="c:\program files\Common Files\Acronis\Timounter\TimounterMonitor.exe" [2012-03-16 937024]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2012-03-16 394944]
"TrayMonitor.exe"="c:\program files\Acronis\TrayMonitor\TrayMonitor.exe" [2012-03-16 1502256]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-09-06 3722416]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"CTHelper"="CTHELPER.EXE" [2009-02-23 23040]
"CTxfiHlp"="CTXFIHLP.EXE" [2009-02-23 23552]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"BackupAndRecoveryMonitor.exe"="c:\program files\Acronis\BackupAndRecovery\BackupAndRecoveryMonitor.exe" [2012-03-16 1529704]
.
c:\documents and settings\ericjs\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-11-28 534016]
NetPerSec.lnk - f:\dl\Utils\NetPerSec\NetPerSec.exe [2012-4-18 192512]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2010-2-3 221247]
Macro Express 3.lnk - c:\program files\Macro Express3\MacExp.exe [2008-11-29 3556864]
UltraMon.lnk - c:\windows\Installer\{537056B7-32A4-4408-9B54-0341963C7C9C}\IcoUltraMon.ico [2010-12-24 29310]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\klmdb.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\rserver30\\rserver3.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Radmin Viewer 3\\Radmin.exe"=
"c:\\Program Files\\MetaTrader 4 at FOREX.com\\terminal.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Documents and Settings\\ericjs\\IAG Remote Access Agent\\mailsolanocountycom\\owa1\\ProxyProcess_Win.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\MaxiVista Standard Server\\MaxiVistaA.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Common Files\\Acronis\\Agent\\agent.exe"=
"c:\\Program Files\\Acronis\\BackupAndRecovery\\mms.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"23:TCP"= 23:TCP:Radmin
"5951:TCP"= 5951:TCP:MaxiVista Server
"5952:TCP"= 5952:TCP:MaxiVista Server
"5953:TCP"= 5953:TCP:MaxiVista Server
.
R0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\drivers\fltsrv.sys [5/26/2012 3:21 PM 80416]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [10/15/2011 2:31 PM 64512]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [6/9/2010 7:22 PM 28552]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/6/2010 10:46 PM 436792]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [3/28/2012 5:26 PM 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/10/2010 10:53 PM 320856]
R1 raddrvv3;raddrvv3;c:\windows\system32\rserver30\raddrvv3.sys [10/31/2007 4:30 PM 45976]
R2 AcronisAgent;Acronis Remote Agent Service;c:\program files\Common Files\Acronis\Agent\agent.exe [2/10/2012 1:02 PM 2021248]
R2 ARSM;Acronis Removable Storage Management Service;c:\program files\Acronis\ARSM\arsm.exe [3/16/2012 4:03 AM 4663584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/10/2010 10:53 PM 20568]
R2 MaxiAcom;MaxiAcom;c:\windows\system32\drivers\Maxiacom.SYS [11/11/2011 1:59 AM 9824]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/6/2009 9:47 AM 654408]
R2 MMS;Acronis Managed Machine Service;c:\program files\Acronis\BackupAndRecovery\mms.exe [8/19/2011 6:24 PM 9352352]
R2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [12/6/2011 2:00 PM 214896]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [4/17/2007 9:09 PM 11032]
R2 RServer3;Radmin Server V3;c:\windows\system32\rserver30\rserver3.exe [12/6/2008 2:22 PM 1246536]
R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [11/27/2008 11:49 PM 3032360]
R2 ToolTipFixer;ToolTipFixer;c:\program files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe [10/14/2008 10:33 AM 61952]
R2 uagqecsvc;Microsoft Forefront UAG Quarantine Enforcement Client;c:\program files\Microsoft Forefront UAG\Endpoint Components\3.1.0\uagqecsvc.exe [7/18/2011 9:05 AM 150928]
R2 UltraMonUtility;UltraMon Utility Driver;c:\program files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [11/14/2008 3:11 AM 17184]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [4/20/2012 10:42 AM 98328]
R3 CTEDSPFX.SYS;CTEDSPFX.SYS;c:\windows\system32\drivers\CTEDSPFX.sys [4/20/2012 10:42 AM 259096]
R3 CTEDSPIO.SYS;CTEDSPIO.SYS;c:\windows\system32\drivers\CTEDSPIO.sys [4/20/2012 10:42 AM 134168]
R3 CTEDSPSY.SYS;CTEDSPSY.SYS;c:\windows\system32\drivers\CTEDSPSY.sys [4/20/2012 10:42 AM 309784]
R3 maxivista;Maxi_Vista_DriverA;c:\windows\system32\drivers\maxivista.sys [11/11/2011 1:59 AM 9952]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/6/2009 9:47 AM 22344]
R3 pneteth;PdaNet Broadband;c:\windows\system32\drivers\pneteth.sys [1/7/2012 5:29 PM 13440]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [11/27/2008 11:49 PM 15144]
S0 eusrws;eusrws;c:\windows\system32\drivers\dpvuck.sys –> c:\windows\system32\drivers\dpvuck.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\motoandroid.sys [1/17/2012 5:19 PM 25856]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [4/20/2012 10:42 AM 98328]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [4/20/2012 10:42 AM 171032]
S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [4/20/2012 10:42 AM 171032]
S3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [4/20/2012 10:42 AM 528920]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [4/20/2012 10:42 AM 528920]
S3 CTEAPSFX.SYS;CTEAPSFX.SYS;c:\windows\system32\drivers\CTEAPSFX.sys [4/20/2012 10:42 AM 163352]
S3 CTEAPSFX;CTEAPSFX;c:\windows\system32\drivers\CTEAPSFX.sys [4/20/2012 10:42 AM 163352]
S3 CTEDSPFX;CTEDSPFX;c:\windows\system32\drivers\CTEDSPFX.sys [4/20/2012 10:42 AM 259096]
S3 CTEDSPIO;CTEDSPIO;c:\windows\system32\drivers\CTEDSPIO.sys [4/20/2012 10:42 AM 134168]
S3 CTEDSPSY;CTEDSPSY;c:\windows\system32\drivers\CTEDSPSY.sys [4/20/2012 10:42 AM 309784]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [4/20/2012 10:42 AM 99352]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [4/20/2012 10:42 AM 99352]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [4/20/2012 10:42 AM 1324056]
S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [4/20/2012 10:42 AM 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [4/20/2012 10:42 AM 72728]
S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [4/20/2012 10:42 AM 72728]
S3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [4/20/2012 10:42 AM 534040]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [4/20/2012 10:42 AM 534040]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [4/29/2011 12:11 PM 2152152]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [4/29/2011 12:11 PM 15232]
S3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\drivers\motoandroid.sys [1/17/2012 5:19 PM 25856]
S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\DRIVERS\UltraMonMirror.sys –> c:\windows\system32\DRIVERS\UltraMonMirror.sys [?]
S3 VNic;ULan Network Driver Module;c:\windows\system32\drivers\VNic.sys [11/11/2011 2:51 AM 57516]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
S4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/8/2012 12:57 PM 253088]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-04-29 07:40]
.
2012-06-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 18:49]
.
2012-05-16 c:\windows\Tasks\MotoHelper MUM.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-12-06 21:00]
.
2012-06-06 c:\windows\Tasks\MotoHelper Routing.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-12-06 21:00]
.
2012-05-16 c:\windows\Tasks\MotoHelper Update.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-12-06 21:00]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{93089660-AD23-44F1-AF37-54011A1A5A22} - c:\program files\Toggle Flash\togflash.exe
Trusted Zone: acs-inc.com\essloginpage
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: solanocounty.com\mail
Trusted Zone: windowsupdate.com\download
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\ericjs\Application Data\Mozilla\Firefox\Profiles\bwi5qfu2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-dxlock - (no file)
AddRemove-Ant Movie Catalog_is1 - g:\!video lists\Ant Movie Catalog\unins000.exe
AddRemove-Convergence - g:\games\DS9TheFallen\Uninstall Convergence.exe
AddRemove-NewsBin5 - g:\newsbin5\uninst.exe
AddRemove-Newsbin6 - g:\newsbin5\uninst.exe
AddRemove-Tomb Raider: Anniversary - g:\games\Tomb Raider - Anniversary\uninsttra.exe
AddRemove-Tomb Raider: Underworld - g:\games\Eidos\Tomb Raider - Underworld\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-06-06 18:17
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1547161642-1214440339-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1048)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(3368)
c:\windows\system32\WININET.dll
c:\program files\Macro Express3\mexhook.dll
c:\windows\system32\ieframe.dll
c:\program files\UltraMon\RTSUltraMonHook.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\RTHDCPL.EXE
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Creative Professional\Digital Audio System\E-MU PatchMix DSP\EmuPMixDSP.exe
c:\program files\UltraMon\UltraMon.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\APC\APC PowerChute Personal Edition\apcsystray.exe
c:\program files\UltraMon\UltraMonTaskbar.exe
c:\program files\APC\APC PowerChute Personal Edition\mainserv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Motorola\MotoHelper\MotoHelperAgent.exe
c:\windows\system32\rserver30\FamItrfc.Exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\windows\system32\WTablet\Pen_TabletUser.exe
.
**************************************************************************
.
Completion time: 2012-06-06 18:22:56 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-07 01:22
ComboFix2.txt 2010-06-28 00:06
.
Pre-Run: 19,515,310,080 bytes free
Post-Run: 20,773,920,768 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Pro-WD (drive0)" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Windows XP Pro-WDC (drive1)" /noexecute=optin /fastdetect
.
- - End Of File - - F3870CC225A332436E1CCD7EFEAA6D92

I need to know how to put back the Orphans that were removed (from the registry?) because I still have these programs and the drive letter changed from G to F


I can dequarantine the files, but there must have been something wrong with the installation for them to have been removed. It may be better just to reinstall the programs on the proper drive, it was the exe's that were removed.


please run the following:

Press the WinKey + R to open a run box, copy/paste the following bolded text into the Run box and click OK:

C:\Qoobox\ComboFix-quarantined-files.txt

A report should pop open for you. Please post the contents in your next reply.


NEXT

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
C:\Documents and Settings\ericjs\My Documents\Downloads\freeripmp3-setup.exe 
F:\dl\audio\freeripmp4.exe 
F:\dl\audio\winamp5623_full_emusic-7plus_all.exe 
F:\dl\other\BitComet\Downloads\Cell Phone Software bitpim\P2kCommander-V329.zip 
F:\dl\popup stopper\IE7ProSetup_2.5.1.exe 
F:\dl\Quicken\Intuit Quicken Home & Business 2012\Intuit Quicken Home & Business 2012.rar 
F:\dl\Quicken\Quicken Home And Business 2010_par2\Quicken Home And Business 2010\Quicken_Home_and_Business_2010.iso 
F:\dl\Utils\cnet_FolderSize-2_5-x86_msi.exe 
F:\dl\video\alt.binaries.warez\Ahead Nero v8.1.1.4 Ultra Edition\Nero 8 Ultra Keygen.rar
F:\dl\video\alt.binaries.warez\Dragon Naturally Speaking Pref v9.51\Dragon Naturally Speaking Pref v9.51 Keygen.rar 
F:\dl\video\alt.binaries.warez\Dragon Naturally Speaking Pref v9.51\Dragon NaturallySpeaking v9.51 Preferred.iso 
F:\dl\video\Utils\avisplitter1.0-crack\avisplitter1.0birdman.zip 
F:\dl\video\Utils\cdrwin\CDRWin.v3.8G.Keygen.zip 
F:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\ag-dxc321.zip 
F:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Copy Platinum 3.2.1\Keymaker\Keymaker.exe 
F:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Copy Xpress 3.2.1\Keymaker\Keymaker.exe 
F:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Point 2.1.0\Keymaker\Keymaker.exe 
F:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Show 2.2\Keymaker\Keymaker.exe 
F:\dl\video\Utils\dvd_kit\dvd_kit\win_rar\cr-winrar300.zip 
F:\dl\video\Utils\dvd_kit\dvd_kit\win_rar\CRK-WinRAR.exe 
F:\dl\video\Utils\Morph\Morph20.exe 
F:\dl\video\Utils\Nero\Nero Burning Rom V 6.3.1.1\Nero Burning Rom V 6.3.1.1.zip 
F:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Keygen.exe 
F:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Nero KeyGen's\Keygen-NeroMediaPlayer_1404.exe 
F:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Nero KeyGen's\Keygen-NeroMix_1404.exe 
F:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Nero KeyGen's\Keygen-NeroVisionExpress_20022.exe 
F:\dl\video\Utils\WinDVD\Corel WinDVD Plus Blu-ray v.9.0 Multilingual\Keygen.exe 
F:\dl\video\Utils\WinRAR\winrarv3.30beta4crackcursed.zip 
F:\dl\video\Utils\WM Recorder 10.2\10.2crack.zip probably 
F:\dl\video\Utils\WM Recorder 10.2\10.2patch.zip 
F:\dl\video\Utils\WM Recorder 10.2\10.2crack\WM.Recorder.v10.2.Incl.Keygen.and.Patch-iNFECTED\Crack.rar 
F:\dl\video\Utils\wmv2avi\ossvc.exe a variant of Win32/Adware.NavExcel application
F:\dl\Windows\VirtualPC\VMware Workstation v5.5.1.19175\Keygen.exe 
c:\windows\003201_.tmp

ClearJavaCache::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"


Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT

Please advise how the computer is running now and if there are any outstanding issues
Sorry, missed the email from your reply. Here is the first file and I will run the rest and post. Thanks. 2012-06-07 01:22:21 . 2012-06-07 01:22:21 0 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Tomb Raider 2012-06-07 01:22:21 . 2012-06-07 01:22:21 924 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Newsbin6.reg.dat 2012-06-07 01:22:21 . 2012-06-07 01:22:21 914 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-NewsBin5.reg.dat 2012-06-07 01:22:21 . 2012-06-07 01:22:21 896 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Convergence.reg.dat 2012-06-07 01:22:21 . 2012-06-07 01:22:21 2,224 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Ant Movie Catalog_is1.reg.dat 2012-06-07 01:21:28 . 2012-06-07 01:21:28 92 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-dxlock.reg.dat 2012-06-07 01:13:24 . 2012-06-07 01:13:24 54,019 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\logishrd\_LVPrcInj01_.dll.zip 2012-06-07 01:07:27 . 2012-06-07 01:07:28 210 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_DMService.reg.dat 2012-06-07 01:07:27 . 2012-06-07 01:07:27 842 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_DMService.reg.dat 2012-06-07 01:04:53 . 2012-06-07 01:04:53 10,431 —-a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2012-06-07 00:54:27 . 2012-06-07 01:17:26 237 —-a-w- C:\Qoobox\Quarantine\catchme.log 2012-06-06 00:52:36 . 2009-10-07 09:47:22 109,080 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\logishrd\LVPrcInj01.dll.vir 2012-06-02 18:45:20 . 2008-04-14 12:42:18 294,912 -c–a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\dllcache\dlimport.exe.vir 2012-04-20 17:44:59 . 2006-11-23 00:55:48 782,336 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\tmpF9.tmp.vir 2012-04-18 19:19:41 . 2012-04-18 19:19:41 422 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\Application Data\Microsoft\Office\Recent\Langton.doc.LNK.vir 2012-04-10 00:48:15 . 2012-04-10 00:48:15 1,032 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\Application Data\Microsoft\Office\Recent\Amsterdam Metro.doc.LNK.vir 2012-02-25 06:36:02 . 2012-02-25 06:36:02 465 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\Application Data\Microsoft\Office\Recent\Before your work.doc.LNK.vir 2012-02-25 06:34:57 . 2012-02-25 06:34:57 389 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\Application Data\Microsoft\Office\Recent\if.doc.LNK.vir 2012-02-18 18:59:58 . 2012-02-20 05:37:38 947 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\Application Data\Microsoft\Office\Recent\posts.doc.LNK.vir 2012-02-10 05:45:02 . 2012-02-10 05:45:02 1,004 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\Application Data\Microsoft\Office\Recent\eu_trade_examples.doc.LNK.vir 2012-02-09 15:29:36 . 2012-02-09 15:30:58 1,054 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\Application Data\Microsoft\Office\Recent\New Microsoft Word Document.doc.LNK.vir 2012-02-07 02:34:31 . 2012-02-07 02:42:27 959 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\Application Data\Microsoft\Office\Recent\Invictus.doc.LNK.vir 2012-01-26 04:39:55 . 2012-01-26 04:39:55 723 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\Application Data\Microsoft\Office\Recent\###### - Meredith Brooks.doc.LNK.vir 2011-10-16 18:19:53 . 2012-04-28 05:47:34 723 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\Application Data\Microsoft\Office\Recent\Movies.doc.LNK.vir 2011-07-18 16:05:22 . 2010-11-25 20:06:28 487,312 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\Downloaded Program Files\DM.0\DMService.exe.vir 2011-07-18 16:05:22 . 2010-11-25 20:08:44 978,832 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\Downloaded Program Files\DM.0\WhlMgr.dll.vir 2010-07-19 13:58:18 . 2010-07-19 13:58:18 72,080 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\g2mdlhlpx.exe.vir 2009-01-14 19:43:39 . 2009-01-15 21:54:01 1,224 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\ericjs\Application Data\Microsoft\Office\Recent\FAP Questions and Answers ml=0i.doc.LNK.vir 2008-12-21 21:46:54 . 2009-09-27 17:39:26 369,152 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\avisynth.dll.vir 2004-05-26 12:37:34 . 2004-05-26 12:37:34 719,872 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\devil.dll.vir 2002-03-20 01:30:00 . 2002-03-20 01:30:00 5,528 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\PowerToyReadme.htm.vir
Hi, Please advise what it is from this list that you need, that can't be re-installed? 2012-06-07 01:22:21 . 2012-06-07 01:22:21 0 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Tomb Raider 2012-06-07 01:22:21 . 2012-06-07 01:22:21 924 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Newsbin6.reg.dat 2012-06-07 01:22:21 . 2012-06-07 01:22:21 914 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-NewsBin5.reg.dat 2012-06-07 01:22:21 . 2012-06-07 01:22:21 896 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Convergence.reg.dat 2012-06-07 01:22:21 . 2012-06-07 01:22:21 2,224 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Ant Movie Catalog_is1.reg.dat 2012-06-07 01:21:28 . 2012-06-07 01:21:28 92 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-dxlock.reg.dat 2012-06-07 01:13:24 . 2012-06-07 01:13:24 54,019 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\logishrd\_LVPrcInj01_.dll.zip 2012-06-07 01:07:27 . 2012-06-07 01:07:28 210 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_DMService.reg.dat 2012-06-07 01:07:27 . 2012-06-07 01:07:27 842 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_DMService.reg.dat 2012-06-07 01:04:53 . 2012-06-07 01:04:53 10,431 —-a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg

Hi,

Please advise what it is from this list that you need, that can't be re-installed?


2012-06-07 01:22:21 . 2012-06-07 01:22:21 0 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Tomb Raider
2012-06-07 01:22:21 . 2012-06-07 01:22:21 924 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Newsbin6.reg.dat
2012-06-07 01:22:21 . 2012-06-07 01:22:21 914 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-NewsBin5.reg.dat
2012-06-07 01:22:21 . 2012-06-07 01:22:21 896 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Convergence.reg.dat
2012-06-07 01:22:21 . 2012-06-07 01:22:21 2,224 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Ant Movie Catalog_is1.reg.dat
2012-06-07 01:21:28 . 2012-06-07 01:21:28 92 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-dxlock.reg.dat
2012-06-07 01:13:24 . 2012-06-07 01:13:24 54,019 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\logishrd\_LVPrcInj01_.dll.zip
2012-06-07 01:07:27 . 2012-06-07 01:07:28 210 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_DMService.reg.dat
2012-06-07 01:07:27 . 2012-06-07 01:07:27 842 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_DMService.reg.dat
2012-06-07 01:04:53 . 2012-06-07 01:04:53 10,431 —-a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg


The first 5 I can reinstall if necessary, the others I don't really know what they are.

After Combofix was done it did not suggest a reboot, so I did anyway, and on shut down got a dumprep.exe failed error. After reboot I had a few Windows updates to install and rebooted again without any errors. Every time I launched the shortcut in my email to this page I got an error that a script was running and causing IE to run slowly and I chose to stop it. This last time I did not get that error. Since my problems seemed to be random I do not know how to reproduce the issue or tell that it is fixed completely, unless I get no errors which just means time. I did see that some things were removed that did look suspicious, at least in the earlier scans you requested. Here is the latest Combofix report:

ComboFix 12-06-10.01 - ericjs 06/10/2012 11:20:27.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3198.2022 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\ericjs\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.
FILE ::
"c:\documents and settings\ericjs\My Documents\Downloads\freeripmp3-setup.exe"
"c:\windows\003201_.tmp"
"f:\dl\audio\freeripmp4.exe"
"f:\dl\audio\winamp5623_full_emusic-7plus_all.exe"
"f:\dl\other\BitComet\Downloads\Cell Phone Software bitpim\P2kCommander-V329.zip"
"f:\dl\popup stopper\IE7ProSetup_2.5.1.exe"
"f:\dl\Quicken\Intuit Quicken Home & Business 2012\Intuit Quicken Home & Business 2012.rar"
"f:\dl\Quicken\Quicken Home And Business 2010_par2\Quicken Home And Business 2010\Quicken_Home_and_Business_2010.iso"
"f:\dl\Utils\cnet_FolderSize-2_5-x86_msi.exe"
"f:\dl\video\alt.binaries.warez\Ahead Nero v8.1.1.4 Ultra Edition\Nero 8 Ultra Keygen.rar"
"f:\dl\video\alt.binaries.warez\Dragon Naturally Speaking Pref v9.51\Dragon Naturally Speaking Pref v9.51 Keygen.rar"
"f:\dl\video\alt.binaries.warez\Dragon Naturally Speaking Pref v9.51\Dragon NaturallySpeaking v9.51 Preferred.iso"
"f:\dl\video\Utils\avisplitter1.0-crack\avisplitter1.0birdman.zip"
"f:\dl\video\Utils\cdrwin\CDRWin.v3.8G.Keygen.zip"
"f:\dl\video\Utils\dvd_kit\dvd_kit\win_rar\cr-winrar300.zip"
"f:\dl\video\Utils\dvd_kit\dvd_kit\win_rar\CRK-WinRAR.exe"
"f:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\ag-dxc321.zip"
"f:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Copy Platinum 3.2.1\Keymaker\Keymaker.exe"
"f:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Copy Xpress 3.2.1\Keymaker\Keymaker.exe"
"f:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Point 2.1.0\Keymaker\Keymaker.exe"
"f:\dl\video\Utils\DVD2DVD\321 Studios_DVD X Products\DVD X Show 2.2\Keymaker\Keymaker.exe"
"f:\dl\video\Utils\Morph\Morph20.exe"
"f:\dl\video\Utils\Nero\Nero Burning Rom V 6.3.1.1\Nero Burning Rom V 6.3.1.1.zip"
"f:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Keygen.exe"
"f:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Nero KeyGen's\Keygen-NeroMediaPlayer_1404.exe"
"f:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Nero KeyGen's\Keygen-NeroMix_1404.exe"
"f:\dl\video\Utils\Nero\Nero60011\Nero 6.0.0.11\Nero KeyGen's\Keygen-NeroVisionExpress_20022.exe"
"f:\dl\video\Utils\WinDVD\Corel WinDVD Plus Blu-ray v.9.0 Multilingual\Keygen.exe"
"f:\dl\video\Utils\WinRAR\winrarv3.30beta4crackcursed.zip"
"f:\dl\video\Utils\WM Recorder 10.2\10.2crack.zip probably"
"f:\dl\video\Utils\WM Recorder 10.2\10.2crack\WM.Recorder.v10.2.Incl.Keygen.and.Patch-iNFECTED\Crack.rar"
"f:\dl\video\Utils\WM Recorder 10.2\10.2patch.zip"
"f:\dl\video\Utils\wmv2avi\ossvc.exe a variant of Win32/Adware.NavExcel application"
"f:\dl\Windows\VirtualPC\VMware Workstation v5.5.1.19175\Keygen.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\ericjs\My Documents\Downloads\freeripmp3-setup.exe
c:\windows\003201_.tmp
f:\dl\audio\freeripmp4.exe
f:\dl\audio\winamp5623_full_emusic-7plus_all.exe
f:\dl\other\BitComet\Downloads\Cell Phone Software bitpim\P2kCommander-V329.zip
f:\dl\popup stopper\IE7ProSetup_2.5.1.exe
f:\dl\Quicken\Intuit Quicken Home & Business 2012\Intuit Quicken Home & Business 2012.rar
f:\dl\Quicken\Quicken Home And Business 2010_par2\Quicken Home And Business 2010\Quicken_Home_and_Business_2010.iso
f:\dl\Utils\cnet_FolderSize-2_5-x86_msi.exe
f:\dl\video\Utils\Morph\Morph20.exe
f:\dl\video\Utils\Nero\Nero Burning Rom V 6.3.1.1\Nero Burning Rom V 6.3.1.1.zip
.
.
((((((((((((((((((((((((( Files Created from 2012-05-10 to 2012-06-10 )))))))))))))))))))))))))))))))
.
.
2012-06-08 22:48 . 2012-06-08 22:48 ——– d—–w- c:\windows\LastGood
2012-06-06 00:39 . 2012-06-06 00:39 ——– d—–w- C:\_OTL
2012-06-03 02:06 . 2010-09-18 06:53 953856 -c—-w- c:\windows\system32\dllcache\mfc40u.dll
2012-06-03 02:05 . 2010-08-23 16:12 617472 -c—-w- c:\windows\system32\dllcache\comctl32.dll
2012-06-03 02:02 . 2010-11-02 15:17 40960 -c—-w- c:\windows\system32\dllcache\ndproxy.sys
2012-06-03 02:01 . 2011-04-21 13:37 105472 -c—-w- c:\windows\system32\dllcache\mup.sys
2012-06-03 01:57 . 2011-07-08 14:02 10496 -c—-w- c:\windows\system32\dllcache\ndistapi.sys
2012-06-03 01:57 . 2012-01-11 19:06 3072 -c—-w- c:\windows\system32\dllcache\iacenc.dll
2012-06-03 01:57 . 2012-01-11 19:06 3072 ——w- c:\windows\system32\iacenc.dll
2012-06-03 01:57 . 2010-10-11 14:59 45568 -c—-w- c:\windows\system32\dllcache\wab.exe
2012-06-03 01:56 . 2012-01-09 16:20 139784 -c—-w- c:\windows\system32\dllcache\rdpwd.sys
2012-06-02 18:45 . 2008-04-14 12:42 294912 ——w- c:\program files\Windows Media Player\dlimport.exe
2012-06-02 18:43 . 2008-04-14 12:41 25471 ——w- c:\windows\system32\drivers\atv04nt5.dll
2012-05-31 02:54 . 2012-05-31 02:54 ——– d—–r- C:\acroldr
2012-05-30 14:40 . 2012-05-30 14:40 ——– d—–w- c:\documents and settings\ericjs\Local Settings\Application Data\PCHealth
2012-05-26 22:21 . 2012-05-26 22:21 80416 —-a-w- c:\windows\system32\drivers\fltsrv.sys
2012-05-26 21:30 . 2012-05-26 21:30 ——– d—–w- c:\documents and settings\ericjs\Application Data\AC3Filter
2012-05-12 19:15 . 2012-05-15 01:29 ——– d—–w- c:\program files\AppMove
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-02 22:19 . 2008-10-16 22:09 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 22:19 . 2008-11-28 05:47 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 22:19 . 2008-11-28 05:47 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 22:19 . 2008-11-28 05:47 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 22:19 . 2008-10-16 22:07 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 22:19 . 2008-11-28 05:47 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2008-10-16 22:07 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 22:19 . 2004-08-04 12:00 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 22:19 . 2008-10-16 22:07 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 22:19 . 2008-11-28 05:47 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2008-11-28 05:47 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:18 . 2009-01-09 13:40 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-06-02 22:18 . 2009-01-09 13:40 214256 —-a-w- c:\windows\system32\muweb.dll
2012-06-02 22:18 . 2009-01-09 13:40 17136 —-a-w- c:\windows\system32\mucltui.dll.mui
2012-06-02 16:37 . 2012-02-18 21:22 2994412 —-a-w- C:\AcronisInfo.zip
2012-05-26 22:21 . 2008-11-28 07:09 614560 —-a-w- c:\windows\system32\drivers\timntr.sys
2012-05-26 22:21 . 2008-11-28 06:07 177600 —-a-w- c:\windows\system32\drivers\snapman.sys
2012-05-01 16:36 . 2012-05-01 16:36 140376 —-a-w- c:\windows\system32\MicrosoftUpdateCatalogWebControl.dll
2012-04-20 18:00 . 2012-04-20 17:44 409600 —-a-w- c:\windows\system32\wrap_oal.dll
2012-04-20 18:00 . 2012-04-20 17:44 114688 —-a-w- c:\windows\system32\OpenAL32.dll
2012-04-17 18:49 . 2012-04-08 19:57 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-17 18:49 . 2011-05-18 20:29 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-11 13:14 . 2004-08-04 12:00 2148352 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-04-11 13:12 . 2004-08-04 12:00 1862272 —-a-w- c:\windows\system32\win32k.sys
2012-04-11 12:35 . 2004-08-03 22:59 2026496 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-09 07:40 . 2008-11-28 21:51 79360 —-a-w- c:\windows\system32\ff_vfw.dll
2012-04-09 07:39 . 2009-11-19 05:15 48128 —-a-w- c:\windows\system32\ff_acm.acm
2012-04-04 22:56 . 2009-06-06 16:47 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-11-21 04:04 . 2011-11-23 21:57 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-06-07_01.13.13 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-06-08 22:48 . 2012-06-02 22:19 45080 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.6.7600.256\wups2.dll
+ 2012-06-08 22:48 . 2012-06-02 22:19 35864 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.6.7600.256\wups.dll
+ 2008-11-28 05:47 . 2012-06-02 22:19 53784 c:\windows\system32\dllcache\wuauclt.exe
+ 2004-08-04 12:00 . 2012-06-02 22:19 97304 c:\windows\system32\dllcache\cdm.dll
+ 2012-06-08 22:48 . 2009-08-07 02:24 44768 c:\windows\LastGood\system32\wups2.dll
+ 2012-06-08 22:48 . 2009-08-07 02:24 35552 c:\windows\LastGood\system32\wups.dll
+ 2012-06-08 22:48 . 2009-08-07 02:24 53472 c:\windows\LastGood\system32\wuauclt.exe
+ 2012-06-08 22:48 . 2009-08-07 02:24 96480 c:\windows\LastGood\system32\cdm.dll
+ 2008-11-28 05:47 . 2012-06-02 22:19 210968 c:\windows\system32\dllcache\wuweb.dll
+ 2008-11-28 05:47 . 2012-06-02 22:19 329240 c:\windows\system32\dllcache\wucltui.dll
+ 2008-11-28 05:47 . 2012-06-02 22:19 577048 c:\windows\system32\dllcache\wuapi.dll
+ 2012-06-08 22:48 . 2009-08-07 02:24 209632 c:\windows\LastGood\system32\wuweb.dll
+ 2012-06-08 22:48 . 2009-08-07 02:24 327896 c:\windows\LastGood\system32\wucltui.dll
+ 2012-06-08 22:48 . 2009-08-07 02:23 575704 c:\windows\LastGood\system32\wuapi.dll
+ 2012-06-08 22:48 . 2009-08-07 02:23 215920 c:\windows\LastGood\system32\muweb.dll
+ 2012-06-08 22:48 . 2009-08-07 02:23 274288 c:\windows\LastGood\system32\mucltui.dll
+ 2008-11-28 05:47 . 2012-06-02 22:19 1933848 c:\windows\system32\dllcache\wuaueng.dll
+ 2012-06-08 22:48 . 2009-08-07 02:23 1929952 c:\windows\LastGood\system32\wuaueng.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{127AD70F-B2B7-4f6a-ACD9-C7B1FE48C8C0}]
2008-04-14 12:42 78848 —-a-w- c:\windows\system32\msiexec.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SetDefaultMIDI"="MIDIDef.exe" [2009-02-23 31232]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 155648]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" [2007-02-26 16125440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"OSSelectorReinstall"="c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-02-23 2209224]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"EPSON Stylus CX3800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE" [2005-02-08 98304]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"AcronisTimounterMonitor"="c:\program files\Common Files\Acronis\Timounter\TimounterMonitor.exe" [2012-03-16 937024]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2012-03-16 394944]
"TrayMonitor.exe"="c:\program files\Acronis\TrayMonitor\TrayMonitor.exe" [2012-03-16 1502256]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-09-06 3722416]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"CTHelper"="CTHELPER.EXE" [2009-02-23 23040]
"CTxfiHlp"="CTXFIHLP.EXE" [2009-02-23 23552]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"BackupAndRecoveryMonitor.exe"="c:\program files\Acronis\BackupAndRecovery\BackupAndRecoveryMonitor.exe" [2012-03-16 1529704]
.
c:\documents and settings\ericjs\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-11-28 534016]
NetPerSec.lnk - f:\dl\Utils\NetPerSec\NetPerSec.exe [2012-4-18 192512]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2010-2-3 221247]
Macro Express 3.lnk - c:\program files\Macro Express3\MacExp.exe [2008-11-29 3556864]
UltraMon.lnk - c:\windows\Installer\{537056B7-32A4-4408-9B54-0341963C7C9C}\IcoUltraMon.ico [2010-12-24 29310]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\klmdb.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\rserver30\\rserver3.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Radmin Viewer 3\\Radmin.exe"=
"c:\\Program Files\\MetaTrader 4 at FOREX.com\\terminal.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Documents and Settings\\ericjs\\IAG Remote Access Agent\\mailsolanocountycom\\owa1\\ProxyProcess_Win.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\MaxiVista Standard Server\\MaxiVistaA.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Common Files\\Acronis\\Agent\\agent.exe"=
"c:\\Program Files\\Acronis\\BackupAndRecovery\\mms.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"23:TCP"= 23:TCP:Radmin
"5951:TCP"= 5951:TCP:MaxiVista Server
"5952:TCP"= 5952:TCP:MaxiVista Server
"5953:TCP"= 5953:TCP:MaxiVista Server
.
R0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\drivers\fltsrv.sys [5/26/2012 3:21 PM 80416]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [10/15/2011 2:31 PM 64512]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [6/9/2010 7:22 PM 28552]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/6/2010 10:46 PM 436792]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [3/28/2012 5:26 PM 442200]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/10/2010 10:53 PM 320856]
R1 raddrvv3;raddrvv3;c:\windows\system32\rserver30\raddrvv3.sys [10/31/2007 4:30 PM 45976]
R2 ARSM;Acronis Removable Storage Management Service;c:\program files\Acronis\ARSM\arsm.exe [3/16/2012 4:03 AM 4663584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/10/2010 10:53 PM 20568]
R2 MaxiAcom;MaxiAcom;c:\windows\system32\drivers\Maxiacom.SYS [11/11/2011 1:59 AM 9824]
R2 MMS;Acronis Managed Machine Service;c:\program files\Acronis\BackupAndRecovery\mms.exe [8/19/2011 6:24 PM 9352352]
R2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [12/6/2011 2:00 PM 214896]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [4/17/2007 9:09 PM 11032]
R2 RServer3;Radmin Server V3;c:\windows\system32\rserver30\rserver3.exe [12/6/2008 2:22 PM 1246536]
R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [11/27/2008 11:49 PM 3032360]
R2 ToolTipFixer;ToolTipFixer;c:\program files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe [10/14/2008 10:33 AM 61952]
R2 uagqecsvc;Microsoft Forefront UAG Quarantine Enforcement Client;c:\program files\Microsoft Forefront UAG\Endpoint Components\3.1.0\uagqecsvc.exe [7/18/2011 9:05 AM 150928]
R2 UltraMonUtility;UltraMon Utility Driver;c:\program files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [11/14/2008 3:11 AM 17184]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [4/20/2012 10:42 AM 98328]
R3 CTEDSPFX.SYS;CTEDSPFX.SYS;c:\windows\system32\drivers\CTEDSPFX.sys [4/20/2012 10:42 AM 259096]
R3 CTEDSPIO.SYS;CTEDSPIO.SYS;c:\windows\system32\drivers\CTEDSPIO.sys [4/20/2012 10:42 AM 134168]
R3 CTEDSPSY.SYS;CTEDSPSY.SYS;c:\windows\system32\drivers\CTEDSPSY.sys [4/20/2012 10:42 AM 309784]
R3 maxivista;Maxi_Vista_DriverA;c:\windows\system32\drivers\maxivista.sys [11/11/2011 1:59 AM 9952]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/6/2009 9:47 AM 22344]
R3 pneteth;PdaNet Broadband;c:\windows\system32\drivers\pneteth.sys [1/7/2012 5:29 PM 13440]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [11/27/2008 11:49 PM 15144]
S0 eusrws;eusrws;c:\windows\system32\drivers\dpvuck.sys –> c:\windows\system32\drivers\dpvuck.sys [?]
S2 AcronisAgent;Acronis Remote Agent Service;c:\program files\Common Files\Acronis\Agent\agent.exe [2/10/2012 1:02 PM 2021248]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/6/2009 9:47 AM 654408]
S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\motoandroid.sys [1/17/2012 5:19 PM 25856]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [4/20/2012 10:42 AM 98328]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [4/20/2012 10:42 AM 171032]
S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [4/20/2012 10:42 AM 171032]
S3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [4/20/2012 10:42 AM 528920]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [4/20/2012 10:42 AM 528920]
S3 CTEAPSFX.SYS;CTEAPSFX.SYS;c:\windows\system32\drivers\CTEAPSFX.sys [4/20/2012 10:42 AM 163352]
S3 CTEAPSFX;CTEAPSFX;c:\windows\system32\drivers\CTEAPSFX.sys [4/20/2012 10:42 AM 163352]
S3 CTEDSPFX;CTEDSPFX;c:\windows\system32\drivers\CTEDSPFX.sys [4/20/2012 10:42 AM 259096]
S3 CTEDSPIO;CTEDSPIO;c:\windows\system32\drivers\CTEDSPIO.sys [4/20/2012 10:42 AM 134168]
S3 CTEDSPSY;CTEDSPSY;c:\windows\system32\drivers\CTEDSPSY.sys [4/20/2012 10:42 AM 309784]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [4/20/2012 10:42 AM 99352]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [4/20/2012 10:42 AM 99352]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [4/20/2012 10:42 AM 1324056]
S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [4/20/2012 10:42 AM 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [4/20/2012 10:42 AM 72728]
S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [4/20/2012 10:42 AM 72728]
S3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [4/20/2012 10:42 AM 534040]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [4/20/2012 10:42 AM 534040]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [4/29/2011 12:11 PM 2152152]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [4/29/2011 12:11 PM 15232]
S3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\drivers\motoandroid.sys [1/17/2012 5:19 PM 25856]
S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\DRIVERS\UltraMonMirror.sys –> c:\windows\system32\DRIVERS\UltraMonMirror.sys [?]
S3 VNic;ULan Network Driver Module;c:\windows\system32\drivers\VNic.sys [11/11/2011 2:51 AM 57516]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
S4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/8/2012 12:57 PM 253088]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-04-29 07:40]
.
2012-06-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 18:49]
.
2012-05-16 c:\windows\Tasks\MotoHelper MUM.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-12-06 21:00]
.
2012-06-09 c:\windows\Tasks\MotoHelper Routing.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-12-06 21:00]
.
2012-05-16 c:\windows\Tasks\MotoHelper Update.job
- c:\program files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-12-06 21:00]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{93089660-AD23-44F1-AF37-54011A1A5A22} - c:\program files\Toggle Flash\togflash.exe
Trusted Zone: acs-inc.com\essloginpage
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: solanocounty.com\mail
Trusted Zone: windowsupdate.com\download
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\ericjs\Application Data\Mozilla\Firefox\Profiles\bwi5qfu2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-06-10 11:31
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1547161642-1214440339-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1048)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2012-06-10 11:36:47
ComboFix-quarantined-files.txt 2012-06-10 18:36
ComboFix2.txt 2012-06-07 01:22
ComboFix3.txt 2010-06-28 00:06
.
Pre-Run: 19,268,689,920 bytes free
Post-Run: 19,540,713,472 bytes free
.
- - End Of File - - 749755932E0DC73E574F178A6CED0475

Eric
let's leave the quarantine alone then for now, let me know if you come across something that doesn't work that you can't re-install, but I suspect that ComboFix has only removed what you will not need.

Your Java is out of date, so go to Start > Control Panel > Add/Remove programs > scroll down to the Java installation and Remove it now download the latest Java version 7 update 4 and install it: http://java.com/en/download/index.jsp


Try this

  • Click Start, click Run, type cmd.exe, and then click OK.
  • At the command prompt, type sfc /scannow, and then press ENTER.
    Note This command may take several minutes to finish. You may be prompted to provide Windows installation source files when you run the sfc /scannow command.
  • At the command prompt, type exit, and then press ENTER to close the command prompt.


let me know how that goes
I ran the sfc /scannow and had to insert the CD and then had to hit Retry about 8 times during the process. No messages when it was done. Uninstalled and upgraded Java. Then when I opened my Outlook (coincidence?) I got another "Explorer.exe has encountered a problem". Explorer.exe did restart itself and I rebooted. Confused and a little frustrated. Not sure how to find out what is causing this. The HD is relatively new. So is the power supply and RAM, same older Mobo. Side note: yesterday I reinstalled my SSD drive, not booting from it, but wanting to dump my latest image on it, hoping to use it as primary again, but Windows locked up during startup and the Start bar disappeared so I shut it down and removed it. Not sure what that means. There doesn't seem to be any useful info in the Event Viewer.
let's run a couple of deeper scans

please do the following:

  • Please download aswMBR.exe and save it to your desktop.
  • Double click aswMBR.exe to start the tool.
  • When asked if you want to download Avast's virus definitions please select Yes.
  • Click Scan

  • Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
  • You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.


NEXT



[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Ok, here is the aswmbr.txt: aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-06-11 12:13:10 —————————– 12:13:10.796 OS Version: Windows 5.1.2600 Service Pack 3 12:13:10.796 Number of processors: 2 586 0x4303 12:13:10.796 ComputerName: MAIN UserName: 12:13:11.062 Initialize success 12:13:11.125 AVAST engine defs: 12061100 12:13:35.125 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-3 12:13:35.125 Disk 0 Vendor: WDC_WD1001FALS-00Y6A0 05.01D05 Size: 953869MB BusType: 3 12:13:35.125 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-e 12:13:35.125 Disk 1 Vendor: ST3750528AS CC38 Size: 715404MB BusType: 3 12:13:35.140 Disk 0 MBR read successfully 12:13:35.140 Disk 0 MBR scan 12:13:35.140 Disk 0 unknown MBR code 12:13:35.140 Disk 0 Partition - 00 05 Extended 892815 MB offset 125033895 12:13:35.140 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 57239 MB offset 63 12:13:35.156 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 410739 MB offset 125033958 12:13:35.156 Disk 0 Partition - 00 05 Extended 482075 MB offset 966229425 12:13:35.171 Disk 0 scanning sectors +1953520065 12:13:35.203 Disk 0 scanning C:\WINDOWS\system32\drivers 12:13:46.593 Service scanning 12:13:48.390 Service BVRPMPR5 D:\INSTAL~E\Core\BVRPMPR5.SYS **LOCKED** 21 12:13:54.718 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 12:13:57.312 Modules scanning 12:14:02.343 Disk 0 trace - called modules: 12:14:02.359 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys pciide.sys PCIIDEX.SYS 12:14:02.359 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8b584ab8] 12:14:02.359 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\00000094[0x8b5c8ab8] 12:14:02.359 5 ACPI.sys[b9e54620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T1L0-3[0x8b59d390] 12:14:02.968 AVAST engine scan C:\WINDOWS 12:14:20.781 AVAST engine scan C:\WINDOWS\system32 12:16:03.718 AVAST engine scan C:\WINDOWS\system32\drivers 12:16:20.781 AVAST engine scan C:\Documents and Settings\ericjs 12:20:06.703 AVAST engine scan C:\Documents and Settings\All Users 12:28:41.656 Scan finished successfully 12:29:47.359 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\ericjs\Desktop\MBR.dat" 12:29:47.359 The log file has been saved successfully to "C:\Documents and Settings\ericjs\Desktop\aswMBR.txt" I'm attaching the MBR.zip and Gmer.txt (you said attach, not paste. let me know if you want it here as text).

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI