What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Cannot use task manager, system freezes, other problems [Solved]

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Lately I've been experiencing system freezes and lock ups. I cannot access the task manager to shut down anything that may be unneeded. I have had to do a forced shut down several times a day because of freezes. I've run Malwarebytes and SAS scans along with the Avast protections and nothing out of the ordinary gets detected so now I desperately need your professional help to get my system running correctly once again. Please let me know which programs I need to run for yuo to do an evaluation. Thanks very much in advance for your help. By the way my system is a Win7 64 Acer model# X1301
Post #2
Hi Bryan A,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

As we work through your logs. Please remember to run any tools by Right-clicking on the icon and selecting Run As Administrator….

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it. If asked to download Avast's database please do so.

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.
Post #3
Hello Tom, thanks for helping me out.
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_33
Run by [removed] at 22:47:06 on 2012-07-09
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3839.2460 [GMT -7:00]
.
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\AVAST Software\Avast\afwServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Secunia\PSI\PSIA.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\WUDFHost.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Secunia\PSI\sua.exe
c:\Windows\System32\oem\SetEvent.exe
C:\Program Files (x86)\HostsMan\hostssrv.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe
C:\Windows\System32\StikyNot.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_257_ActiveX.exe
C:\Windows\SysWOW64\ctfmon.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://msn.com/
uSearch Page =
uDefault_Search_URL = hxxp://www.google.com/ie
uWindow Title = Internet Explorer, optimized for Bing and MSN
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mCustomizeSearch = hxxp://toolbar.inbox.com/help/sa_customize.aspx?tbid=80681
mSearchAssistant =
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
mURLSearchHooks: Gospel Internet Radio Toolbar: {a8a9d26a-734f-467a-8907-176f9c5bdf56} - C:\Program Files (x86)\Gospel_Internet_Radio\prxtbGosp.dll
BHO: AutorunsDisabled - No File
BHO: Gospel Internet Radio - No File
BHO: WeCareReminder - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Fast Search: {5ab7104a-b71f-49ad-9154-f7f8806ae848} - C:\Program Files (x86)\Surf Canyon\surfcanyon.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - C:\Program Files (x86)\WOT\WOT.dll
{ccb69577-088b-4004-9ed8-ff5bcc83a039}
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - C:\Program Files (x86)\WOT\WOT.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: Gospel Internet Radio Toolbar: {a8a9d26a-734f-467a-8907-176f9c5bdf56} - C:\Program Files (x86)\Gospel_Internet_Radio\prxtbGosp.dll
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [HostsServer] "C:\Program Files (x86)\HostsMan\hostssrv.exe" –start
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [OpenDNS Updater] "C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe" /autostart
uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
uRun: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: []
StartupFolder: C:\Users\Bryan\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Bryan\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SECUNI~1.LNK - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
mPolicies-explorer: EnableShellExecuteHooks = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
IE: {1A93C934-025B-4c3a-B38E-9654A7003239} - {6F282B65-56BF-4BD1-A8B2-A4449A05863D}
LSP: %SYSTEMROOT%\system32\nvLsp.dll
Trusted Zone: bleacherreport.com
Trusted Zone: google.com\mail
Trusted Zone: google.com\www
Trusted Zone: hoptoadapp.com
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://oas.support.microsoft.com/ActiveX/MSDcode.cab
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB
DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files%20(x86)/Slingo%20Deluxe/Images/stg_drm.ocx
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} - hxxp://gamesville.worldwinner.com/games/v47/shared/FunGamesLoader.cab
DPF: {1D082E71-DF20-4AAF-863B-596428C49874} - hxxp://www.worldwinner.com/games/v50/tpir/tpir.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.53.0.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} - hxxp://www.worldwinner.com/games/launcher/ie/v2.23.01.0/iewwload.cab
DPF: {95A311CD-EC8E-452A-BCEC-B844EB616D03} - hxxp://www.worldwinner.com/games/v51/bejeweledtwist/bejeweledtwist.cab
DPF: {97438FE9-D361-4279-BA82-98CC0877A717} - hxxp://www.worldwinner.com/games/v57/cubis/cubis.cab
DPF: {A021A215-6CDC-44B4-8C16-90491CED9605} - hxxp://www.worldwinner.com/games/v68/clue/clue.cab
DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39} - hxxp://www.worldwinner.com/games/v46/monopoly/monopoly.cab
DPF: {BA94245D-2AA0-4953-9D9F-B0EE4CC02C43} - hxxp://www.worldwinner.com/games/v42/tilecity/tilecity.cab
DPF: {C82BB209-F528-46F9-96D5-69DEF7260916} - hxxp://www.worldwinner.com/games/v45/mysterypi/mysterypi.cab
DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} - hxxp://www.worldwinner.com/games/v43/paint/paint.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files%20(x86)/Slingo%20Deluxe/Images/armhelper.ocx
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
DPF: {FC4CAF5F-91BD-4DD9-ADC1-F3C737E37BC4} - hxxp://zone.msn.com/bingame/swet/default/Sweetopia.1.0.0.46.cab
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{473F86ED-FB55-42E5-8A1F-9FC700C929D6} : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{473F86ED-FB55-42E5-8A1F-9FC700C929D6} : DhcpNameServer = 75.75.75.75 75.75.76.76
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll
AppInit_DLLs: C:\PROGRA~2\Google\GOOGLE~3\GoogleDesktopNetwork3.dll
BHO-X64: AutorunsDisabled - No File
BHO-X64: Gospel Internet Radio - No File
BHO-X64: WeCareReminder - No File
BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-X64: 0x1 - No File
BHO-X64: Fast Search: {5AB7104A-B71F-49AD-9154-F7F8806AE848} - C:\Program Files (x86)\Surf Canyon\surfcanyon.dll
BHO-X64: IE BHO Utility - No File
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO-X64: WOT Helper: {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files (x86)\WOT\WOT.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: WOT: {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB-X64: Gospel Internet Radio Toolbar: {A8A9D26A-734F-467A-8907-176F9C5BDF56} - C:\Program Files (x86)\Gospel_Internet_Radio\prxtbGosp.dll
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun-x64: [(Default)]
IE-X64: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
IE-X64: {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Users\Bryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
IE-X64: {b4838b4d-a75d-4396-b388-8a6724d11ba9} - https://mummysgold.gameassists.co.uk/MUMMYS…ab-c78b728fb875
IE-X64: {e4e8c758-34b4-44bb-8ef9-1f0786e81d2d} - C:\Users\Bryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CarbonPoker\CarbonPoker.lnk
AppInit_DLLs-X64: C:\PROGRA~2\Google\GOOGLE~3\GoogleDesktopNetwork3.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Bryan\AppData\Roaming\Mozilla\Firefox\Profiles\sc8h00j6.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=SGD2&o=2421&locale=en_US&apn_uid=99fa60fe-b06e-45a5-a5f5-dd647dbe1ff8&apn_ptnrs=%5EAEC&apn_sauid=2EEA134B-3551-4840-9456-0F484A5B109E&apn_dtid=%5EYYYYYY%5EYY%5EUS&&q=
FF - plugin: C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
FF - plugin: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll
.
============= SERVICES / DRIVERS ===============
.
R0 aswNdis;avast! Firewall NDIS Filter Service;C:\Windows\system32\DRIVERS\aswNdis.sys –> C:\Windows\system32\DRIVERS\aswNdis.sys [?]
R0 aswNdis2;avast! Firewall Core Firewall Service;C:\Windows\system32\drivers\aswNdis2.sys –> C:\Windows\system32\drivers\aswNdis2.sys [?]
R0 hotcore3;hc3ServiceName;C:\Windows\system32\DRIVERS\hotcore3.sys –> C:\Windows\system32\DRIVERS\hotcore3.sys [?]
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys –> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R1 aswFW;avast! TDI Firewall driver;C:\Windows\system32\drivers\aswFW.sys –> C:\Windows\system32\drivers\aswFW.sys [?]
R1 aswKbd;aswKbd;C:\Windows\system32\drivers\aswKbd.sys –> C:\Windows\system32\drivers\aswKbd.sys [?]
R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys –> C:\Windows\system32\drivers\aswSnx.sys [?]
R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys –> C:\Windows\system32\drivers\aswSP.sys [?]
R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys –> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?]
R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys –> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?]
R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys –> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-7-18 140672]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys –> C:\Windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys –> C:\Windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-6-23 44808]
R2 avast! Firewall;avast! Firewall;C:\Program Files\AVAST Software\Avast\afwServ.exe [2012-6-23 133912]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-6-30 2214504]
R2 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\psia.exe [2011-10-13 994360]
R2 Secunia Update Agent;Secunia Update Agent;C:\Program Files (x86)\Secunia\PSI\sua.exe [2011-10-13 399416]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\Windows\system32\Drivers\ssadadb.sys –> C:\Windows\system32\Drivers\ssadadb.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys –> C:\Windows\system32\drivers\nvhda64v.sys [?]
R3 pneteth;PdaNet Broadband;C:\Windows\system32\DRIVERS\pneteth.sys –> C:\Windows\system32\DRIVERS\pneteth.sys [?]
R3 PSI;PSI;C:\Windows\system32\DRIVERS\psi_mf.sys –> C:\Windows\system32\DRIVERS\psi_mf.sys [?]
R3 SbieDrv;SbieDrv;C:\Program Files\Sandboxie\SbieDrv.sys [2012-2-7 161432]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\system32\DRIVERS\ssadbus.sys –> C:\Windows\system32\DRIVERS\ssadbus.sys [?]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\system32\DRIVERS\ssadmdfl.sys –> C:\Windows\system32\DRIVERS\ssadmdfl.sys [?]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\system32\DRIVERS\ssadmdm.sys –> C:\Windows\system32\DRIVERS\ssadmdm.sys [?]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);C:\Windows\system32\DRIVERS\ssadserd.sys –> C:\Windows\system32\DRIVERS\ssadserd.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-5-3 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-3-30 250056]
S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys –> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-5-3 136176]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys –> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696]
S3 PCGenFam;PCGenFam;C:\Windows\system32\DRIVERS\PCGenFAM.sys –> C:\Windows\system32\DRIVERS\PCGenFAM.sys [?]
S3 pwdrvio;pwdrvio;\??\C:\Windows\system32\pwdrvio.sys –> C:\Windows\system32\pwdrvio.sys [?]
S3 pwdspio;pwdspio;\??\C:\Windows\system32\pwdspio.sys –> C:\Windows\system32\pwdspio.sys [?]
S3 SaiKF622;SaiKF622;C:\Windows\system32\DRIVERS\SaiKF622.sys –> C:\Windows\system32\DRIVERS\SaiKF622.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 VaneFltr;Lachesis Mouse Driver;C:\Windows\system32\drivers\Lachesis.sys –> C:\Windows\system32\drivers\Lachesis.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 Greg_Service;GRegService;C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [2009-8-28 1150496]
S4 IDriveE Service;IDriveE Service;C:\IDrive\IDriveE Service.exe [2011-4-5 153032]
S4 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-5-4 503080]
S4 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-8-12 62208]
S4 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2009-10-27 240160]
.
=============== Created Last 30 ================
.
2012-07-09 05:31:28 9013136 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{511A5D80-7822-4783-BF2C-3398A85276D3}\mpengine.dll
2012-07-08 04:18:55 9013136 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-07-05 06:52:11 ——– d—–w- C:\Users\Bryan\AppData\Roaming\Songbird2
2012-07-05 06:52:11 ——– d—–w- C:\Users\Bryan\AppData\Local\Songbird2
2012-07-05 06:52:03 15664 —-a-w- C:\Windows\SysWow64\drivers\GEARAspiWDM.sys
2012-07-05 06:52:03 109360 —-a-w- C:\Windows\SysWow64\GEARAspi.dll
2012-07-05 06:51:39 ——– d—–w- C:\Program Files (x86)\Songbird
2012-07-04 20:31:17 927800 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-07-04 20:19:17 927800 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7221C501-2F51-4FC9-A1CD-D70723FFD391}\gapaengine.dll
2012-06-26 13:50:05 2622464 —-a-w- C:\Windows\System32\wucltux.dll
2012-06-26 13:49:54 99840 —-a-w- C:\Windows\System32\wudriver.dll
2012-06-26 13:49:39 36864 —-a-w- C:\Windows\System32\wuapp.exe
2012-06-26 13:49:39 186752 —-a-w- C:\Windows\System32\wuwebv.dll
2012-06-24 04:07:08 142128 —-a-w- C:\Windows\System32\drivers\aswFW.sys
2012-06-24 04:06:54 266776 —-a-w- C:\Windows\System32\drivers\aswNdis2.sys
2012-06-24 04:06:53 19600 —-a-w- C:\Windows\System32\drivers\aswKbd.sys
2012-06-24 04:06:53 12368 —-a-w- C:\Windows\System32\drivers\aswNdis.sys
2012-06-24 03:57:22 54072 —-a-w- C:\Windows\System32\drivers\aswRdr2.sys
2012-06-24 03:57:18 955304 —-a-w- C:\Windows\System32\drivers\aswSnx.sys
2012-06-24 03:57:17 71064 —-a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2012-06-24 03:56:44 41224 —-a-w- C:\Windows\avastSS.scr
2012-06-24 03:56:30 ——– d—–w- C:\ProgramData\AVAST Software
2012-06-24 03:56:30 ——– d—–w- C:\Program Files\AVAST Software
2012-06-23 13:28:16 ——– d—–w- C:\Program Files (x86)\AntiTwin
2012-06-22 19:08:29 185 —-a-w- C:\Windows\SysWow64\msblcd32.dll
2012-06-22 19:08:23 67376 —-a-w- C:\Windows\SysWow64\SYSINFO.OCX
2012-06-22 19:08:23 212240 —-a-w- C:\Windows\SysWow64\RICHTX32.OCX
2012-06-22 19:08:01 ——– d—–w- C:\Program Files (x86)\AF Uninstalls
2012-06-19 19:59:21 ——– d—–w- C:\Users\Bryan\AppData\Local\CTrox
2012-06-18 18:25:15 476936 —-a-w- C:\Windows\SysWow64\npdeployJava1.dll
2012-06-18 18:12:17 ——– d—–w- C:\Program Files (x86)\Microsoft Security Client
2012-06-18 18:12:14 ——– d—–w- C:\Program Files\Microsoft Security Client
2012-06-18 06:21:44 ——– d–h–w- C:\ProgramData\Common Files
2012-06-15 14:02:59 304640 —-a-w- C:\Program Files\Internet Explorer\IEShims.dll
2012-06-15 14:01:46 514560 —-a-w- C:\Windows\SysWow64\qdvd.dll
2012-06-15 14:01:46 366592 —-a-w- C:\Windows\System32\qdvd.dll
2012-06-15 14:01:43 5559664 —-a-w- C:\Windows\System32\ntoskrnl.exe
2012-06-15 14:01:39 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-06-15 14:01:37 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-06-15 14:01:23 9216 —-a-w- C:\Windows\System32\rdrmemptylst.exe
2012-06-15 14:01:23 77312 —-a-w- C:\Windows\System32\rdpwsx.dll
2012-06-15 14:01:23 149504 —-a-w- C:\Windows\System32\rdpcorekmts.dll
2012-06-15 14:01:22 3216384 —-a-w- C:\Windows\System32\msi.dll
2012-06-15 14:01:21 2342400 —-a-w- C:\Windows\SysWow64\msi.dll
2012-06-15 14:01:19 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-06-15 14:01:16 3146752 —-a-w- C:\Windows\System32\win32k.sys
2012-06-15 14:01:13 209920 —-a-w- C:\Windows\System32\profsvc.dll
2012-06-15 14:00:00 1462272 —-a-w- C:\Windows\System32\crypt32.dll
2012-06-15 13:59:59 184320 —-a-w- C:\Windows\System32\cryptsvc.dll
2012-06-15 13:59:59 140288 —-a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-06-15 13:59:59 140288 —-a-w- C:\Windows\System32\cryptnet.dll
2012-06-15 13:59:59 1158656 —-a-w- C:\Windows\SysWow64\crypt32.dll
2012-06-15 13:59:59 103936 —-a-w- C:\Windows\SysWow64\cryptnet.dll
.
==================== Find3M ====================
.
2012-06-23 00:29:35 70344 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-23 00:29:35 426184 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-06-22 19:08:23 662288 —-a-w- C:\Windows\SysWow64\MSCOMCT2.OCX
2012-06-22 19:08:23 152848 —-a-w- C:\Windows\SysWow64\COMDLG32.OCX
2012-06-18 18:25:05 472840 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2012-06-18 18:20:56 955840 —-a-w- C:\Windows\System32\npdeployJava1.dll
2012-06-18 18:20:56 839096 —-a-w- C:\Windows\System32\deployJava1.dll
2012-05-18 02:06:48 2311680 —-a-w- C:\Windows\System32\jscript9.dll
2012-05-18 01:59:14 1392128 —-a-w- C:\Windows\System32\wininet.dll
2012-05-18 01:58:39 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl
2012-05-18 01:55:22 173056 —-a-w- C:\Windows\System32\ieUnatt.exe
2012-05-18 01:51:30 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2012-05-17 22:45:37 1800192 —-a-w- C:\Windows\SysWow64\jscript9.dll
2012-05-17 22:35:47 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll
2012-05-17 22:35:39 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-05-17 22:29:45 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-05-17 22:24:45 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2012-04-19 03:56:30 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2012-04-19 03:56:30 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts
.
============= FINISH: 22:47:54.30 ===============
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-07-09 22:50:16
—————————–
22:50:16.714 OS Version: Windows x64 6.1.7601 Service Pack 1
22:50:16.714 Number of processors: 2 586 0x602
22:50:16.715 ComputerName: FAMILY UserName: Bryan
22:50:19.247 Initialize success
22:50:19.294 AVAST engine defs: 12070901
22:50:37.656 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000070
22:50:37.658 Disk 0 Vendor: ST375052 CC44 Size: 715404MB BusType: 3
22:50:37.678 Disk 0 MBR read successfully
22:50:37.680 Disk 0 MBR scan
22:50:37.683 Disk 0 unknown MBR code
22:50:37.710 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 14000 MB offset 2048
22:50:37.725 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 28674048
22:50:37.729 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 701302 MB offset 28878848
22:50:37.736 Disk 0 scanning C:\Windows\system32\drivers
22:50:46.681 Service scanning
22:51:02.537 Modules scanning
22:51:02.543 Disk 0 trace - called modules:
22:51:02.567 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor64.sys
22:51:02.575 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004825060]
22:51:02.582 3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> [0xfffffa80046bce40]
22:51:02.588 5 ACPI.sys[fffff88000e767a1] -> nt!IofCallDriver -> \Device\00000070[0xfffffa80046b1530]
22:51:05.690 AVAST engine scan C:\Windows
22:51:08.229 AVAST engine scan C:\Windows\system32
22:53:22.428 AVAST engine scan C:\Windows\system32\drivers
22:53:35.998 AVAST engine scan C:\Users\Bryan
22:57:13.748 Disk 0 MBR has been saved successfully to "C:\Users\Bryan\Desktop\MBR.dat"
22:57:13.757 The log file has been saved successfully to "C:\Users\Bryan\Desktop\aswMBR.txt"

Tom, I hope this is what and how you wanted things to be run and posted.

Attachments:

Post #4
MBRCheck
Please download MBRCheck.exe to your desktop.

  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
Post #5
MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows 7 Home Premium Edition Windows Information: Service Pack 1 (build 7601), 64-bit Base Board Manufacturer: Acer BIOS Manufacturer: Phoenix Technologies, LTD System Manufacturer: Acer System Product Name: Aspire X1301 Logical Drives Mask: 0x0000007c Kernel Drivers (total 219): 0x0301E000 \SystemRoot\system32\ntoskrnl.exe 0x03606000 \SystemRoot\system32\hal.dll 0x00BCA000 \SystemRoot\system32\kdcom.dll 0x00CCB000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll 0x00CD8000 \SystemRoot\system32\PSHED.dll 0x00CEC000 \SystemRoot\system32\CLFS.SYS 0x00C00000 \SystemRoot\system32\CI.dll 0x00D4A000 \SystemRoot\system32\drivers\Wdf01000.sys 0x00DEE000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x00EB6000 \SystemRoot\system32\drivers\ACPI.sys 0x00F0D000 \SystemRoot\system32\drivers\WMILIB.SYS 0x00F16000 \SystemRoot\system32\drivers\msisadrv.sys 0x00F20000 \SystemRoot\system32\drivers\pci.sys 0x00F53000 \SystemRoot\system32\drivers\vdrvroot.sys 0x00F60000 \SystemRoot\System32\drivers\partmgr.sys 0x00F75000 \SystemRoot\system32\drivers\volmgr.sys 0x00F8A000 \SystemRoot\System32\drivers\volmgrx.sys 0x00FE6000 \SystemRoot\system32\drivers\pciide.sys 0x00FED000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x00E00000 \SystemRoot\System32\drivers\mountmgr.sys 0x00E1A000 \SystemRoot\system32\drivers\atapi.sys 0x00E23000 \SystemRoot\system32\drivers\ataport.SYS 0x00E4D000 \SystemRoot\system32\DRIVERS\nvstor64.sys 0x0105C000 \SystemRoot\system32\DRIVERS\storport.sys 0x010BF000 \SystemRoot\system32\drivers\amdxata.sys 0x010CA000 \SystemRoot\system32\drivers\fltmgr.sys 0x01116000 \SystemRoot\system32\drivers\fileinfo.sys 0x0112A000 \SystemRoot\system32\DRIVERS\MpFilter.sys 0x01250000 \SystemRoot\System32\Drivers\Ntfs.sys 0x0115F000 \SystemRoot\System32\Drivers\msrpc.sys 0x01200000 \SystemRoot\System32\Drivers\ksecdd.sys 0x014C3000 \SystemRoot\System32\Drivers\cng.sys 0x01535000 \SystemRoot\System32\drivers\pcw.sys 0x01546000 \SystemRoot\System32\Drivers\Fs_Rec.sys 0x016A5000 \SystemRoot\system32\drivers\ndis.sys 0x01798000 \SystemRoot\system32\drivers\NETIO.SYS 0x01600000 \SystemRoot\System32\Drivers\aswNdis2.sys 0x01644000 \SystemRoot\System32\Drivers\ksecpkg.sys 0x018D1000 \SystemRoot\System32\drivers\tcpip.sys 0x01AD4000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x01B1E000 \SystemRoot\system32\DRIVERS\aswNdis.sys 0x01B25000 \SystemRoot\system32\drivers\volsnap.sys 0x01B71000 \SystemRoot\System32\Drivers\spldr.sys 0x01B79000 \SystemRoot\System32\drivers\rdyboost.sys 0x01BB3000 \SystemRoot\System32\Drivers\mup.sys 0x01BC5000 \SystemRoot\System32\drivers\hwpolicy.sys 0x01BCE000 \SystemRoot\system32\DRIVERS\hotcore3.sys 0x01800000 \SystemRoot\System32\DRIVERS\fvevol.sys 0x0183A000 \SystemRoot\system32\DRIVERS\disk.sys 0x01850000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS 0x0166F000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x02E48000 \SystemRoot\System32\Drivers\aswSnx.SYS 0x02F35000 \SystemRoot\system32\DRIVERS\mwlPSDFilter.sys 0x02F3E000 \SystemRoot\System32\Drivers\Null.SYS 0x02F47000 \SystemRoot\System32\Drivers\Beep.SYS 0x02F4E000 \SystemRoot\System32\Drivers\aswKbd.SYS 0x02F57000 \SystemRoot\System32\drivers\vga.sys 0x02F65000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x02F8A000 \SystemRoot\System32\drivers\watchdog.sys 0x02F9A000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x02FA3000 \SystemRoot\system32\drivers\rdpencdd.sys 0x02FAC000 \SystemRoot\system32\drivers\rdprefmp.sys 0x02FB5000 \SystemRoot\System32\Drivers\Msfs.SYS 0x02FC0000 \SystemRoot\System32\Drivers\Npfs.SYS 0x02FD1000 \SystemRoot\system32\DRIVERS\tdx.sys 0x02FF3000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x02E00000 \SystemRoot\System32\Drivers\aswFW.SYS 0x02E25000 \SystemRoot\System32\Drivers\aswTdi.SYS 0x01400000 \SystemRoot\system32\drivers\afd.sys 0x02E37000 \SystemRoot\System32\Drivers\aswrdr2.sys 0x0158F000 \SystemRoot\System32\DRIVERS\netbt.sys 0x018AB000 \SystemRoot\system32\DRIVERS\wfplwf.sys 0x01BDA000 \SystemRoot\system32\DRIVERS\pacer.sys 0x018B4000 \SystemRoot\system32\DRIVERS\netbios.sys 0x015D4000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x03C4F000 \SystemRoot\System32\Drivers\Uim_IMx64.sys 0x03CD3000 \SystemRoot\System32\Drivers\UimFIO.SYS 0x03D3A000 \SystemRoot\system32\DRIVERS\uimx64.sys 0x03D49000 \SystemRoot\system32\drivers\termdd.sys 0x03D5D000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS 0x03D67000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS 0x03D71000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x03DC2000 \SystemRoot\system32\drivers\nsiproxy.sys 0x03DCE000 \SystemRoot\system32\DRIVERS\mwlPSDVDisk.sys 0x03DE1000 \SystemRoot\system32\DRIVERS\mwlPSDNServ.sys 0x03DE9000 \SystemRoot\system32\drivers\mssmbios.sys 0x03C00000 \SystemRoot\System32\drivers\discache.sys 0x03C0F000 \SystemRoot\System32\Drivers\dfsc.sys 0x03C2D000 \SystemRoot\system32\DRIVERS\blbdrive.sys 0x01000000 \SystemRoot\System32\Drivers\aswSP.SYS 0x01489000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x0121B000 \SystemRoot\system32\DRIVERS\amdppm.sys 0x03C3E000 \SystemRoot\system32\drivers\wmiacpi.sys 0x03DF4000 \SystemRoot\system32\DRIVERS\nvsmu.sys 0x018C3000 \SystemRoot\system32\DRIVERS\usbohci.sys 0x04209000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x0425F000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x04270000 \SystemRoot\system32\drivers\HDAudBus.sys 0x04294000 \??\C:\Windows\system32\drivers\UBHelper.sys 0x0429C000 \??\C:\Windows\system32\drivers\NTIDrvr.sys 0x042A4000 \SystemRoot\system32\DRIVERS\nvmf6264.sys 0x0F254000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys 0x0FF72000 \SystemRoot\System32\Drivers\nvBridge.kmd 0x042F9000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x0FF77000 \SystemRoot\System32\drivers\dxgmms1.sys 0x0FFBD000 \SystemRoot\system32\drivers\1394ohci.sys 0x0F200000 \SystemRoot\system32\drivers\CompositeBus.sys 0x0F210000 \SystemRoot\system32\DRIVERS\AgileVpn.sys 0x0F226000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x043ED000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x011BD000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x01230000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x00E8C000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x04AFC000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x04B16000 \SystemRoot\system32\DRIVERS\pneteth.sys 0x04B1F000 \SystemRoot\system32\drivers\kbdclass.sys 0x04B2E000 \SystemRoot\system32\drivers\mouclass.sys 0x04B3D000 \SystemRoot\system32\drivers\swenum.sys 0x04B3F000 \SystemRoot\system32\drivers\ks.sys 0x04B82000 \SystemRoot\system32\drivers\umbus.sys 0x04B94000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x04A00000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x04E18000 \SystemRoot\system32\drivers\RTKVHD64.sys 0x05052000 \SystemRoot\system32\drivers\portcls.sys 0x0508F000 \SystemRoot\system32\drivers\drmk.sys 0x050B1000 \SystemRoot\system32\drivers\ksthunk.sys 0x050B7000 \SystemRoot\system32\drivers\nvhda64v.sys 0x050CF000 \SystemRoot\System32\Drivers\crashdmp.sys 0x050DD000 \SystemRoot\System32\Drivers\dump_diskdump.sys 0x050E7000 \SystemRoot\System32\Drivers\dump_nvstor64.sys 0x05126000 \SystemRoot\System32\Drivers\dump_dumpfve.sys 0x00070000 \SystemRoot\System32\win32k.sys 0x05139000 \SystemRoot\System32\drivers\Dxapi.sys 0x05145000 \SystemRoot\system32\DRIVERS\hidusb.sys 0x05153000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x0516C000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x05175000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x05177000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x05184000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x051A1000 \SystemRoot\system32\drivers\kbdhid.sys 0x051AF000 \SystemRoot\system32\DRIVERS\ssadbus.sys 0x051D9000 \SystemRoot\system32\DRIVERS\ssadwh.sys 0x04A15000 \SystemRoot\system32\DRIVERS\ssadmdm.sys 0x051E2000 \SystemRoot\system32\DRIVERS\ssadcm.sys 0x051EA000 \SystemRoot\system32\drivers\modem.sys 0x04E00000 \SystemRoot\system32\DRIVERS\ssadmdfl.sys 0x04A43000 \SystemRoot\system32\DRIVERS\ssadserd.sys 0x04A6B000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0x04E08000 \SystemRoot\System32\Drivers\ssadadb.sys 0x04A86000 \SystemRoot\system32\DRIVERS\usbscan.sys 0x04A97000 \SystemRoot\system32\DRIVERS\usbprint.sys 0x04AA3000 \SystemRoot\system32\DRIVERS\monitor.sys 0x00490000 \SystemRoot\System32\TSDDD.dll 0x00650000 \SystemRoot\System32\cdd.dll 0x00980000 \SystemRoot\System32\ATMFD.DLL 0x04AB1000 \SystemRoot\system32\drivers\luafv.sys 0x01550000 \??\C:\Windows\system32\drivers\aswMonFlt.sys 0x04AD4000 \SystemRoot\System32\Drivers\aswFsBlk.SYS 0x01880000 \SystemRoot\system32\drivers\WudfPf.sys 0x098B8000 \??\C:\Program Files\Sandboxie\SbieDrv.sys 0x098E3000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x098F8000 \SystemRoot\system32\DRIVERS\nwifi.sys 0x0994B000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0x0995E000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x09E5E000 \SystemRoot\system32\drivers\HTTP.sys 0x09F27000 \SystemRoot\system32\DRIVERS\bowser.sys 0x09F45000 \SystemRoot\System32\drivers\mpsdrv.sys 0x09F5D000 \SystemRoot\system32\drivers\mrxdav.sys 0x09F85000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0x09FB2000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0x09E00000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0x09800000 \SystemRoot\system32\drivers\peauth.sys 0x09E24000 \SystemRoot\System32\Drivers\secdrv.SYS 0x09976000 \SystemRoot\System32\DRIVERS\srvnet.sys 0x09E2F000 \SystemRoot\System32\drivers\tcpipreg.sys 0x0AA3B000 \SystemRoot\System32\DRIVERS\srv2.sys 0x0AAA4000 \SystemRoot\System32\DRIVERS\srv.sys 0x0AB3C000 \SystemRoot\system32\DRIVERS\WUDFRd.sys 0x0AB6D000 \SystemRoot\system32\DRIVERS\psi_mf.sys 0x76F20000 \Windows\System32\ntdll.dll 0x48150000 \Windows\System32\smss.exe 0xFF240000 \Windows\System32\apisetschema.dll 0xFF940000 \Windows\System32\autochk.exe 0xFF150000 \Windows\System32\advapi32.dll 0x76D10000 \Windows\System32\iertutil.dll 0xFF070000 \Windows\System32\oleaut32.dll 0x770F0000 \Windows\System32\normaliz.dll 0xFEF40000 \Windows\System32\rpcrt4.dll 0xFEF30000 \Windows\System32\lpk.dll 0x770E0000 \Windows\System32\psapi.dll 0xFEED0000 \Windows\System32\Wldap32.dll 0xFEE30000 \Windows\System32\msvcrt.dll 0xFE0A0000 \Windows\System32\shell32.dll 0x76BF0000 \Windows\System32\kernel32.dll 0x76A90000 \Windows\System32\wininet.dll 0x76940000 \Windows\System32\urlmon.dll 0xFE070000 \Windows\System32\imm32.dll 0xFE050000 \Windows\System32\sechost.dll 0xFDE70000 \Windows\System32\setupapi.dll 0xFDD60000 \Windows\System32\msctf.dll 0x76840000 \Windows\System32\user32.dll 0xFDD50000 \Windows\System32\nsi.dll 0xFDCB0000 \Windows\System32\clbcatq.dll 0xFDC30000 \Windows\System32\difxapi.dll 0xFDA20000 \Windows\System32\ole32.dll 0xFDA00000 \Windows\System32\imagehlp.dll 0xFD930000 \Windows\System32\usp10.dll 0xFD8B0000 \Windows\System32\shlwapi.dll 0xFD840000 \Windows\System32\gdi32.dll 0xFD7A0000 \Windows\System32\comdlg32.dll 0xFD750000 \Windows\System32\ws2_32.dll 0xFD5E0000 \Windows\System32\crypt32.dll 0xFD5A0000 \Windows\System32\wintrust.dll 0xFD580000 \Windows\System32\devobj.dll 0xFD540000 \Windows\System32\cfgmgr32.dll 0xFD4D0000 \Windows\System32\KernelBase.dll 0xFD430000 \Windows\System32\comctl32.dll 0xFD420000 \Windows\System32\msasn1.dll 0x74A90000 \Windows\SysWOW64\normaliz.dll Processes (total 70): 0 System Idle Process 4 System 344 C:\Windows\System32\smss.exe 492 csrss.exe 544 C:\Windows\System32\wininit.exe 576 csrss.exe 608 C:\Windows\System32\services.exe 620 C:\Windows\System32\lsass.exe 628 C:\Windows\System32\lsm.exe 684 C:\Windows\System32\winlogon.exe 776 C:\Windows\System32\svchost.exe 856 C:\Windows\System32\nvvsvc.exe 896 C:\Windows\System32\svchost.exe 944 C:\Program Files\Microsoft Security Client\MsMpEng.exe 372 C:\Windows\System32\svchost.exe 420 C:\Windows\System32\svchost.exe 740 C:\Windows\System32\svchost.exe 1204 C:\Windows\System32\svchost.exe 1248 C:\Program Files\Sandboxie\SbieSvc.exe 1360 C:\Windows\System32\svchost.exe 1524 C:\Program Files\AVAST Software\Avast\AvastSvc.exe 1572 C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe 1588 C:\Windows\System32\nvvsvc.exe 1708 C:\Program Files\AVAST Software\Avast\afwServ.exe 1812 C:\Windows\System32\spoolsv.exe 1844 C:\Windows\System32\svchost.exe 1992 C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE 2012 C:\Program Files (x86)\Bonjour\mDNSResponder.exe 2044 C:\Windows\System32\svchost.exe 1124 C:\Windows\SysWOW64\svchost.exe 1504 C:\Program Files (x86)\Secunia\PSI\psia.exe 2564 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 2732 C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe 2808 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe 2904 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE 3024 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe 3096 C:\Windows\System32\svchost.exe 3252 WUDFHost.exe 3660 C:\Program Files (x86)\Secunia\PSI\sua.exe 3400 C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe 3652 C:\Program Files\Windows Media Player\wmpnetwk.exe 864 C:\Windows\System32\SearchIndexer.exe 1184 C:\Windows\System32\taskhost.exe 1000 C:\Windows\System32\dwm.exe 3312 C:\Windows\explorer.exe 3372 C:\Windows\System32\svchost.exe 3324 C:\Program Files\NVIDIA Corporation\Display\nvtray.exe 1372 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe 4136 C:\Program Files\Microsoft IntelliPoint\ipoint.exe 4172 C:\Program Files\Microsoft Security Client\msseces.exe 4184 C:\Program Files\Windows Sidebar\sidebar.exe 4712 C:\Program Files (x86)\Internet Explorer\iexplore.exe 4804 C:\Program Files (x86)\Internet Explorer\iexplore.exe 4984 C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe 4368 C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 4420 C:\Program Files (x86)\HostsMan\hostssrv.exe 2080 C:\Windows\System32\OEM\setEvent.exe 5108 C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe 5124 C:\Windows\System32\StikyNot.exe 5196 C:\Program Files\Sandboxie\SbieCtrl.exe 5300 C:\Program Files (x86)\Secunia\PSI\psi_tray.exe 5448 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 5456 C:\Program Files\AVAST Software\Avast\AvastUI.exe 5556 C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_257_ActiveX.exe 888 C:\Windows\System32\audiodg.exe 4000 C:\Windows\System32\taskeng.exe 4060 C:\Windows\SysWOW64\ctfmon.exe 1192 C:\Users\Bryan\Desktop\MBRCheck.exe 2312 C:\Windows\System32\conhost.exe 3008 C:\Windows\System32\dllhost.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000003`71500000 (NTFS) PhysicalDrive0 Model Number: ST3750528AS, Rev: CC44 Size Device Name MBR Status ——————————————– 698 GB \\.\PhysicalDrive0 RE: Acer MBR code detected SHA1: 3183CBF02DD9B39C5FF84F50BA2419D633E30179 Done!
Post #6
Aha… your MBR has been modificed by Acer - not malware. That's good news. :thumbup:

Download ComboFix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #7
I disabled the Avast antivirus, firewall, and all other security programs. A window popped up saying that my system was unprotectred I even went to windows firewall menu and it reported that the system was unprotected but ComboFix still reported the Avast tools as running. I don't understand why this is, however here is the log file you need from ComboFix. If you need me to rerun it because of the Avast problem please tell me how to completely disable the service from running. ComboFix 12-07-10.01 - Bryan 07/11/2012 0:02.6.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3839.2660 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6} SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\SysWow64\msblcd32.dll . . ((((((((((((((((((((((((( Files Created from 2012-06-11 to 2012-07-11 ))))))))))))))))))))))))))))))) . . 2012-07-10 22:50 . 2012-05-31 04:04 9013136 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7E87EFA8-8125-400B-90E1-3DC1B9E69F76}\mpengine.dll 2012-07-09 05:49 . 2012-07-09 05:49 ——– d—–w- c:\users\Zanthia.Family\AppData\Local\Innovative Solutions 2012-07-09 05:31 . 2012-05-31 04:04 9013136 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-07-05 06:52 . 2012-07-06 03:15 ——– d—–w- c:\users\Bryan\AppData\Local\Songbird2 2012-07-05 06:52 . 2012-07-05 06:52 ——– d—–w- c:\users\Bryan\AppData\Roaming\Songbird2 2012-07-05 06:52 . 2012-06-08 07:28 15664 —-a-w- c:\windows\SysWow64\drivers\GEARAspiWDM.sys 2012-07-05 06:52 . 2012-06-08 07:28 109360 —-a-w- c:\windows\SysWow64\GEARAspi.dll 2012-07-05 06:51 . 2012-07-09 05:57 ——– d—–w- c:\program files (x86)\Songbird 2012-07-04 20:31 . 2012-06-18 18:13 927800 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll 2012-07-04 20:19 . 2012-06-18 18:13 927800 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7221C501-2F51-4FC9-A1CD-D70723FFD391}\gapaengine.dll 2012-06-26 13:50 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-26 13:50 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-26 13:50 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-26 13:50 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-26 13:49 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-26 13:49 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-26 13:49 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-26 13:49 . 2012-06-02 22:19 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-26 13:49 . 2012-06-02 22:15 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-24 04:07 . 2012-06-18 15:33 142128 —-a-w- c:\windows\system32\drivers\aswFW.sys 2012-06-24 04:06 . 2012-06-18 15:33 266776 —-a-w- c:\windows\system32\drivers\aswNdis2.sys 2012-06-24 04:06 . 2012-06-18 15:33 19600 —-a-w- c:\windows\system32\drivers\aswKbd.sys 2012-06-24 04:06 . 2012-06-18 11:12 12368 —-a-w- c:\windows\system32\drivers\aswNdis.sys 2012-06-24 03:57 . 2012-06-18 15:33 25232 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys 2012-06-24 03:57 . 2012-06-18 15:33 355320 —-a-w- c:\windows\system32\drivers\aswSP.sys 2012-06-24 03:57 . 2012-06-18 15:33 54072 —-a-w- c:\windows\system32\drivers\aswRdr2.sys 2012-06-24 03:57 . 2012-06-18 15:33 59728 —-a-w- c:\windows\system32\drivers\aswTdi.sys 2012-06-24 03:57 . 2012-06-18 15:33 955304 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2012-06-24 03:57 . 2012-06-18 15:33 71064 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2012-06-24 03:57 . 2012-06-18 15:33 285328 —-a-w- c:\windows\system32\aswBoot.exe 2012-06-24 03:56 . 2012-06-18 15:33 41224 —-a-w- c:\windows\avastSS.scr 2012-06-24 03:56 . 2012-06-18 15:33 227648 —-a-w- c:\windows\SysWow64\aswBoot.exe 2012-06-24 03:56 . 2012-06-24 03:56 ——– d—–w- c:\programdata\AVAST Software 2012-06-24 03:56 . 2012-06-24 03:56 ——– d—–w- c:\program files\AVAST Software 2012-06-23 13:28 . 2012-06-23 13:28 ——– d—–w- c:\program files (x86)\AntiTwin 2012-06-22 19:08 . 2012-06-22 19:08 67376 —-a-w- c:\windows\SysWow64\SYSINFO.OCX 2012-06-22 19:08 . 2012-06-22 19:08 212240 —-a-w- c:\windows\SysWow64\RICHTX32.OCX 2012-06-22 19:08 . 2012-06-22 19:08 ——– d—–w- c:\program files (x86)\AF Uninstalls 2012-06-19 19:59 . 2012-06-19 19:59 ——– d—–w- c:\users\Bryan\AppData\Local\CTrox 2012-06-18 18:25 . 2012-06-18 18:25 476936 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2012-06-18 18:12 . 2012-06-18 18:12 ——– d—–w- c:\program files (x86)\Microsoft Security Client 2012-06-18 18:12 . 2012-06-18 18:12 ——– d—–w- c:\program files\Microsoft Security Client 2012-06-18 06:21 . 2012-06-18 06:21 ——– d–h–w- c:\programdata\Common Files 2012-06-15 14:02 . 2012-05-18 01:56 304640 —-a-w- c:\program files\Internet Explorer\IEShims.dll 2012-06-15 14:01 . 2012-05-04 11:00 366592 —-a-w- c:\windows\system32\qdvd.dll 2012-06-15 14:01 . 2012-05-04 09:59 514560 —-a-w- c:\windows\SysWow64\qdvd.dll 2012-06-15 14:01 . 2012-05-04 11:06 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-06-15 14:01 . 2012-05-04 10:03 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-06-15 14:01 . 2012-05-04 10:03 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-06-15 14:01 . 2012-04-26 05:41 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-06-15 14:01 . 2012-04-26 05:41 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-15 14:01 . 2012-04-26 05:34 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-15 14:01 . 2012-04-07 12:31 3216384 —-a-w- c:\windows\system32\msi.dll 2012-06-15 14:01 . 2012-04-07 11:26 2342400 —-a-w- c:\windows\SysWow64\msi.dll 2012-06-15 14:01 . 2012-04-28 03:55 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-15 14:01 . 2012-05-15 01:32 3146752 —-a-w- c:\windows\system32\win32k.sys 2012-06-15 14:01 . 2012-05-01 05:40 209920 —-a-w- c:\windows\system32\profsvc.dll 2012-06-15 14:00 . 2012-04-24 05:37 1462272 —-a-w- c:\windows\system32\crypt32.dll 2012-06-15 13:59 . 2012-04-24 05:37 184320 —-a-w- c:\windows\system32\cryptsvc.dll 2012-06-15 13:59 . 2012-04-24 05:37 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-06-15 13:59 . 2012-04-24 04:36 140288 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-06-15 13:59 . 2012-04-24 04:36 1158656 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-06-15 13:59 . 2012-04-24 04:36 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-23 00:29 . 2012-04-13 22:07 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-23 00:29 . 2011-11-07 17:34 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-06-22 19:08 . 2011-04-05 16:39 152848 —-a-w- c:\windows\SysWow64\COMDLG32.OCX 2012-06-22 19:08 . 2011-04-05 16:39 662288 —-a-w- c:\windows\SysWow64\MSCOMCT2.OCX 2012-06-18 18:25 . 2011-11-09 09:03 472840 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-06-18 18:20 . 2011-12-22 23:57 955840 —-a-w- c:\windows\system32\npdeployJava1.dll 2012-06-18 18:20 . 2010-07-26 21:02 839096 —-a-w- c:\windows\system32\deployJava1.dll 2012-04-19 03:56 . 2012-04-19 03:56 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-04-19 03:56 . 2012-04-19 03:56 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{a8a9d26a-734f-467a-8907-176f9c5bdf56}"= "c:\program files (x86)\Gospel_Internet_Radio\prxtbGosp.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{a8a9d26a-734f-467a-8907-176f9c5bdf56}] . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584] "HostsServer"="c:\program files (x86)\HostsMan\hostssrv.exe" [2010-02-06 1930240] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-08-06 39408] "OpenDNS Updater"="c:\program files (x86)\OpenDNS Updater\OpenDNSUpdater.exe" [2010-06-16 839680] "RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2010-05-07 0] "SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-02-07 666384] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-06-18 4271416] . c:\users\Bryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Bryan\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2011-10-13 291896] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "EnableShellExecuteHooks"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-03 136176] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056] R3 ALSysIO;ALSysIO;c:\users\Bryan\AppData\Local\Temp\ALSysIO64.sys [x] R3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-03 136176] R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\7114.tmp [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-21 98688] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-27 291696] R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 40464] R3 PCGenFam;PCGenFam;c:\windows\system32\DRIVERS\PCGenFAM.sys [2010-11-02 198088] R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2011-05-06 19936] R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2011-05-06 13280] R3 SaiKF622;SaiKF622;c:\windows\system32\DRIVERS\SaiKF622.sys [2009-06-02 140800] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 VaneFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2007-08-17 30336] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-03 1255736] R4 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496] R4 IDriveE Service;IDriveE Service;c:\idrive\IDriveE Service.exe [2011-03-31 153032] R4 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080] R4 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-12 62208] R4 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160] S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2012-06-18 12368] S0 aswNdis2;avast! Firewall Core Firewall Service; [x] S0 hotcore3;hc3ServiceName;c:\windows\system32\DRIVERS\hotcore3.sys [2011-01-21 37456] S1 aswFW;avast! TDI Firewall driver; [x] S1 aswKbd;aswKbd; [x] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576] S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016] S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-18 140672] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-06-18 71064] S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2012-06-18 133912] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-21 2214504] S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2011-10-14 994360] S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2011-10-14 399416] S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-05-13 36328] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2009-06-26 83488] S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [2011-11-25 15360] S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976] S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 157672] S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 16872] S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 177640] S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-05-13 146920] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2012-07-11 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 00:29] . 2012-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-03 10:28] . 2012-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-03 10:28] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2012-06-18 15:33 133400 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 97792 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 97792 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 97792 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 97792 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-07 10144288] "PLD_FrameworkRun"="c:\windows\system32\oem\_NowIntoDT.vbs" [2009-10-11 490] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-22 2327952] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-27 1271168] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x1 . ——- Supplementary Scan ——- . uStart Page = hxxp://msn.com/ uLocal Page = c:\windows\system32\blank.htm uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = about:blank mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 LSP: %SYSTEMROOT%\system32\nvLsp.dll Trusted Zone: bleacherreport.com Trusted Zone: google.com\mail Trusted Zone: google.com\www Trusted Zone: hoptoadapp.com TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 TCP: Interfaces\{473F86ED-FB55-42E5-8A1F-9FC700C929D6}: NameServer = 208.67.222.222,208.67.220.220 DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab FF - ProfilePath - c:\users\Bryan\AppData\Roaming\Mozilla\Firefox\Profiles\sc8h00j6.default\ FF - prefs.js: browser.search.selectedEngine - Ask.com FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=SGD2&o=2421&locale=en_US&apn_uid=99fa60fe-b06e-45a5-a5f5-dd647dbe1ff8&apn_ptnrs=%5EAEC&apn_sauid=2EEA134B-3551-4840-9456-0F484A5B109E&apn_dtid=%5EYYYYYY%5EYY%5EUS&&q= . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - (no file) BHO-{CCB69577-088B-4004-9ED8-FF5BCC83A039} - (no file) Toolbar-10 - (no file) SafeBoot-BsScanner Toolbar-10 - (no file) WebBrowser-{A8A9D26A-734F-467A-8907-176F9C5BDF56} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) ShellIconOverlayIdentifiers-{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} - (no file) AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_heroes.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MEMSWEEP2] "ImagePath"="\??\c:\windows\system32\7114.tmp" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,85,60,b7,6e,ff,df,50,47,be,ce,3c,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,85,60,b7,6e,ff,df,50,47,be,ce,3c,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*] "value"="?\03\04\16\176\1e?" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-07-11 00:19:47 ComboFix-quarantined-files.txt 2012-07-11 07:19 ComboFix2.txt 2011-04-16 18:59 . Pre-Run: 595,591,331,840 bytes free Post-Run: 597,165,502,464 bytes free . - - End Of File - - C0EF5563DBFD6D5BB0C61C1BF0FF3491
Post #8
Bryan A,

Part of your problem is that you are running two Anti-Virus programs. Microsoft Security Essentials and AVAST!. That's not good. They will cause conflicts with each other. You need to completely uninstall one of them. It's your choice as to which one you keep. They are both good programs - but only keep one of them.

After you do that, let's get an online scan:

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Also, please let me know how things seem to be running now.
Post #9 last edited
GTom I'm sorry to say that I did the ESET scan and it detected 17 violations but when it came time to make the copy of the log file somehow I screwed up and cannot recover it. I've done several scans with ESET in the past and that data is still also in the computer but todays is not there. One of the results I remember is: android/plankton.H trojan this came up 2 or 3 times. Nearly all of the results realted to the android system in some way. Anyway I'll have to rerun the scan late tonight (it takes 3 hours) and try and get the correct results to you tomorrow, once again I apologize for messing this up. Just a quick note: Once the scan is finished it doesn't specify that it will make the log or give that option. Do I just close out the program without erasing the downloaded virus database descriptions? Will this automatically create the proper log where you said to look for it?
Post #10
OK Tom, I ran another full scan with ESET and finally have the log file report for you. I went through hell finding the log file it wasn't in the ESET folder just all the past logs, but here it is. C:\backup\sdcard\Verbous_GenoCYde.version.666.zip Android/Plankton.H trojan C:\Users\Bryan\.frostwire5\updates\frostwire-5.3.3.windows.exe Win32/OpenCandy application C:\Users\Bryan\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\chrome\pptextlinks.jar Win32/Adware.Gamevance.Gen application C:\Users\Bryan\Desktop\sd card bu\appmonster2\backup\great.app.luck\rev\19.apk a variant of Android/Adware.AirPush.A application C:\Users\Bryan\Desktop\sd card bu\App_Manager\App_Backups\user_apps\great.app.luck.apk a variant of Android/Adware.AirPush.A application C:\Users\Bryan\Desktop\sd card bu\TitaniumBackup\great.app.luck-73d83b0622200494240f8460c0a9cfa7.apk.gz a variant of Android/Adware.AirPush.A application C:\Users\Bryan\Downloads\Avengers_Reborn_Verbous.zip a variant of Android/Adware.AirPush.B application C:\Users\Bryan\Downloads\Black_Ice.zip Android/HackTool.FaceNiff.A application C:\Users\Bryan\Downloads\Eternal_Ecstasy.zip a variant of Android/Plankton.H trojan C:\Users\Bryan\Downloads\SlotsofVegasInstaller.exe a variant of Win32/CasOnline.B application C:\Users\Bryan\Downloads\Titanium_Vip-A-Rom.zip Android/HackTool.FaceNiff.A application C:\Users\Bryan\Downloads\Verbous_GenoCYde.version.666.2.zip Android/HackTool.FaceNiff.A application C:\Users\Bryan\Downloads\Verbous_GenoCYde.version.666.zip Android/Plankton.H trojan C:\Users\Zanthia.Family\AppData\Local\Google\Chrome\User Data\Default\Extensions\maopdgeieiiiifooolcjjfmjdlkmhfdh\nplptl.dll a variant of Win32/Adware.Gamevance.BR application C:\Users\Zanthia.Family\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\lptlf.dll a variant of Win32/Adware.Gamevance.BR application C:\Users\Zanthia.Family\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\lptlf4.dll a variant of Win32/Adware.Gamevance.BR application C:\Users\Zanthia.Family\AppData\Roaming\Mozilla\Firefox\Profiles\pn1zgulf.default\extensions\[removed]\components\lptlf.dll a variant of Win32/Adware.Gamevance.BR application I hope this helps to get things cleaned up, Thanks.
Post #11
Bryan A,

Most of what was found is not currently "live" on your system. However, many of them will also infect your android phone. This is a new area to me and some of the advice I find says that if your phone is infected… you'll have to reinstall the operating system on it. :pullhair: I don't know that this is necessarily true but if your phone starts acting weird also… or your system becomes re-infected with this same things… then I'd worry about the phone.


COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
C:\backup\sdcard\Verbous_GenoCYde.version.666.zip
C:\Users\Bryan\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\chrome\pptextlinks.jar 
C:\Users\Bryan\Desktop\sd card bu\appmonster2\backup\great.app.luck\rev\19.apk
C:\Users\Bryan\Desktop\sd card bu\App_Manager\App_Backups\user_apps\great.app.luck.apk
C:\Users\Bryan\Desktop\sd card bu\TitaniumBackup\great.app.luck-73d83b0622200494240f8460c0a9cfa7.apk.gz
C:\Users\Bryan\Downloads\Avengers_Reborn_Verbous.zip
C:\Users\Bryan\Downloads\Black_Ice.zip
C:\Users\Bryan\Downloads\Eternal_Ecstasy.zip
C:\Users\Bryan\Downloads\SlotsofVegasInstaller.exe
C:\Users\Bryan\Downloads\Titanium_Vip-A-Rom.zip
C:\Users\Bryan\Downloads\Verbous_GenoCYde.version.666.2.zip
C:\Users\Bryan\Downloads\Verbous_GenoCYde.version.666.zip
C:\Users\Zanthia.Family\AppData\Local\Google\Chrome\User Data\Default\Extensions\maopdgeieiiiifooolcjjfmjdlkmhfdh\nplptl.dll
C:\Users\Zanthia.Family\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\lptlf.dll
C:\Users\Zanthia.Family\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\lptlf4.dll
C:\Users\Zanthia.Family\AppData\Roaming\Mozilla\Firefox\Profiles\pn1zgulf.default\extensions\[removed]\components\lptlf.dll


Folder::
C:\Users\Bryan\.frostwire5
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Give the system a little test drive and let me know how things are running.
Post #12
So far I haven't noticed anything bad which is a very good thing. I've got to look into the phone problem, I have the AVG Pro android antivirus set up on my phone but it looks like things still need to be devoloped for that device. Anyhow here is the log from the last CFScript ComboFix 12-07-12.02 - Bryan 07/12/2012 18:06:35.7.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3839.2845 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Bryan\Desktop\CFScript.txt AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\backup\sdcard\Verbous_GenoCYde.version.666.zip" "c:\users\Bryan\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\chrome\pptextlinks.jar" "c:\users\Bryan\Desktop\sd card bu\App_Manager\App_Backups\user_apps\great.app.luck.apk" "c:\users\Bryan\Desktop\sd card bu\appmonster2\backup\great.app.luck\rev\19.apk" "c:\users\Bryan\Desktop\sd card bu\TitaniumBackup\great.app.luck-73d83b0622200494240f8460c0a9cfa7.apk.gz" "c:\users\Bryan\Downloads\Avengers_Reborn_Verbous.zip" "c:\users\Bryan\Downloads\Black_Ice.zip" "c:\users\Bryan\Downloads\Eternal_Ecstasy.zip" "c:\users\Bryan\Downloads\SlotsofVegasInstaller.exe" "c:\users\Bryan\Downloads\Titanium_Vip-A-Rom.zip" "c:\users\Bryan\Downloads\Verbous_GenoCYde.version.666.2.zip" "c:\users\Bryan\Downloads\Verbous_GenoCYde.version.666.zip" "c:\users\Zanthia.Family\AppData\Local\Google\Chrome\User Data\Default\Extensions\maopdgeieiiiifooolcjjfmjdlkmhfdh\nplptl.dll" "c:\users\Zanthia.Family\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\lptlf.dll" "c:\users\Zanthia.Family\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\lptlf4.dll" "c:\users\Zanthia.Family\AppData\Roaming\Mozilla\Firefox\Profiles\pn1zgulf.default\extensions\[removed]\components\lptlf.dll" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Bryan\.frostwire5 c:\users\Bryan\.frostwire5\appwork\cfg\org.jdownloader.controlling.filter.LinkFilterSettings.filterlist.json c:\users\Bryan\.frostwire5\appwork\cfg\org.jdownloader.settings.AccountSettings.accounts.ejs c:\users\Bryan\.frostwire5\appwork\cfg\subconf_AccountController.ejs c:\users\Bryan\.frostwire5\appwork\cfg\subconf_LOCALE.ejs c:\users\Bryan\.frostwire5\appwork\cfg\subconf_youtube.com.ejs c:\users\Bryan\.frostwire5\appwork\logs\2012-6-24.log c:\users\Bryan\.frostwire5\appwork\tmp\crawler.ejs c:\users\Bryan\.frostwire5\appwork\tmp\hosts.json c:\users\Bryan\.frostwire5\azureus.lock c:\users\Bryan\.frostwire5\azureus\.certs c:\users\Bryan\.frostwire5\azureus\.keystore c:\users\Bryan\.frostwire5\azureus\.lock c:\users\Bryan\.frostwire5\azureus\active\14D3FAE05AD5EC2C4DD2F20132B1FD284BE3B5CF.dat c:\users\Bryan\.frostwire5\azureus\active\14D3FAE05AD5EC2C4DD2F20132B1FD284BE3B5CF.dat.bak c:\users\Bryan\.frostwire5\azureus\active\68BAC09578A12556AC1C922E3A50F440C8075683.dat c:\users\Bryan\.frostwire5\azureus\active\68BAC09578A12556AC1C922E3A50F440C8075683.dat.bak c:\users\Bryan\.frostwire5\azureus\active\68BAC09578A12556AC1C922E3A50F440C8075683\fmfile1.dat c:\users\Bryan\.frostwire5\azureus\active\68BAC09578A12556AC1C922E3A50F440C8075683\fmfile3.dat c:\users\Bryan\.frostwire5\azureus\active\844A0887767D07216286E636BF0AE617DBC09DA2.dat c:\users\Bryan\.frostwire5\azureus\active\844A0887767D07216286E636BF0AE617DBC09DA2.dat.bak c:\users\Bryan\.frostwire5\azureus\active\cache.dat c:\users\Bryan\.frostwire5\azureus\azureus.config c:\users\Bryan\.frostwire5\azureus\azureus.config.bak c:\users\Bryan\.frostwire5\azureus\azureus.statistics c:\users\Bryan\.frostwire5\azureus\azureus.statistics.bak c:\users\Bryan\.frostwire5\azureus\dht\addresses.dat c:\users\Bryan\.frostwire5\azureus\dht\contacts.dat c:\users\Bryan\.frostwire5\azureus\dht\diverse.dat c:\users\Bryan\.frostwire5\azureus\dht\general.dat c:\users\Bryan\.frostwire5\azureus\dht\version.dat c:\users\Bryan\.frostwire5\azureus\downloads.config c:\users\Bryan\.frostwire5\azureus\downloads.config.bak c:\users\Bryan\.frostwire5\azureus\ipfilter.cache c:\users\Bryan\.frostwire5\azureus\logs\debug_1.log c:\users\Bryan\.frostwire5\azureus\logs\save\1340744371646_debug_1.log c:\users\Bryan\.frostwire5\azureus\net\pm_33651.dat c:\users\Bryan\.frostwire5\azureus\net\pm_default.dat c:\users\Bryan\.frostwire5\azureus\tmp\AZU3547971143695920674.tmp c:\users\Bryan\.frostwire5\azureus\tmp\AZU4234436557150242622.tmp c:\users\Bryan\.frostwire5\azureus\tmp\AZU4550158836791974482.tmp c:\users\Bryan\.frostwire5\frostwire.props c:\users\Bryan\.frostwire5\image_cache\farm2.static.flickr.com\1207\5116139349_32b78675b1_z.jpg c:\users\Bryan\.frostwire5\image_cache\farm2.static.flickr.com\1218\5133551335_9cea91e0e8_z.jpg c:\users\Bryan\.frostwire5\image_cache\farm5.static.flickr.com\4028\4696910954_458c153860_z.jpg c:\users\Bryan\.frostwire5\image_cache\farm5.static.flickr.com\4047\4696909332_2772430943_z.jpg c:\users\Bryan\.frostwire5\image_cache\farm5.static.flickr.com\4055\4696282651_991eb1e423_z.jpg c:\users\Bryan\.frostwire5\image_cache\farm5.static.flickr.com\4084\5021412308_d532cf8deb_z.jpg c:\users\Bryan\.frostwire5\image_cache\farm5.static.flickr.com\4089\5034231193_82001b8672_z.jpg c:\users\Bryan\.frostwire5\image_cache\farm5.static.flickr.com\4089\5046277458_f6fb7039c6_z.jpg c:\users\Bryan\.frostwire5\image_cache\farm5.static.flickr.com\4147\5181022282_e43f1bddbd_b.jpg c:\users\Bryan\.frostwire5\image_cache\farm6.static.flickr.com\5047\5247205874_076027c648_z.jpg c:\users\Bryan\.frostwire5\image_cache\farm6.static.flickr.com\5128\5248199684_21598eeecc_z.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\android_market_overlay3.png c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\baiyu_fanfair_overlay.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\baiyu_overlay.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\carsie_blanton_overlay_new.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\cinema_sleep_overlay2.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\default_fueled.png c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\farkus_overlay_new.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\frostclick_default_overlay_fueled.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\garmisch_overlay_2.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\hi-rez_overlay.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\Illfigga_overlay_new.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\jermaine_riley_bw_overlay_new.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\manter__overlay.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\masternever_overlay2.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\no_way_josie_overlay_new.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\pioneer_one_s01e06.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\rogue_valley_overlay_new.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\sweetheart_overlay.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\the_ugly_club_overlay.jpg c:\users\Bryan\.frostwire5\image_cache\static.frostwire.com\images\overlays\vanatei_overlay.jpg c:\users\Bryan\.frostwire5\installation.props c:\users\Bryan\.frostwire5\installer.dat c:\users\Bryan\.frostwire5\intent.props c:\users\Bryan\.frostwire5\itunes.props c:\users\Bryan\.frostwire5\jd_home\JDownloader.log c:\users\Bryan\.frostwire5\library_db\library_db.h2.db c:\users\Bryan\.frostwire5\library_db\library_db\_0.fdt c:\users\Bryan\.frostwire5\library_db\library_db\_0.fdx c:\users\Bryan\.frostwire5\library_db\library_db\_0.fnm c:\users\Bryan\.frostwire5\library_db\library_db\_0.frq c:\users\Bryan\.frostwire5\library_db\library_db\_0.nrm c:\users\Bryan\.frostwire5\library_db\library_db\_0.prx c:\users\Bryan\.frostwire5\library_db\library_db\_0.tii c:\users\Bryan\.frostwire5\library_db\library_db\_0.tis c:\users\Bryan\.frostwire5\library_db\library_db\_2.cfs c:\users\Bryan\.frostwire5\library_db\library_db\_4.cfs c:\users\Bryan\.frostwire5\library_db\library_db\segments.gen c:\users\Bryan\.frostwire5\library_db\library_db\segments_6 c:\users\Bryan\.frostwire5\questions.props c:\users\Bryan\.frostwire5\search_db\search_db.h2.db c:\users\Bryan\.frostwire5\search_db\search_db.lock.db c:\users\Bryan\.frostwire5\search_db\search_db\_0.fdt c:\users\Bryan\.frostwire5\search_db\search_db\_0.fdx c:\users\Bryan\.frostwire5\search_db\search_db\_0.fnm c:\users\Bryan\.frostwire5\search_db\search_db\_0.frq c:\users\Bryan\.frostwire5\search_db\search_db\_0.nrm c:\users\Bryan\.frostwire5\search_db\search_db\_0.prx c:\users\Bryan\.frostwire5\search_db\search_db\_0.tii c:\users\Bryan\.frostwire5\search_db\search_db\_0.tis c:\users\Bryan\.frostwire5\search_db\search_db\_1.fdt c:\users\Bryan\.frostwire5\search_db\search_db\_1.fdx c:\users\Bryan\.frostwire5\search_db\search_db\_1.fnm c:\users\Bryan\.frostwire5\search_db\search_db\_1.frq c:\users\Bryan\.frostwire5\search_db\search_db\_1.nrm c:\users\Bryan\.frostwire5\search_db\search_db\_1.prx c:\users\Bryan\.frostwire5\search_db\search_db\_1.tii c:\users\Bryan\.frostwire5\search_db\search_db\_1.tis c:\users\Bryan\.frostwire5\search_db\search_db\_2.fdt c:\users\Bryan\.frostwire5\search_db\search_db\_2.fdx c:\users\Bryan\.frostwire5\search_db\search_db\_2.fnm c:\users\Bryan\.frostwire5\search_db\search_db\_2.frq c:\users\Bryan\.frostwire5\search_db\search_db\_2.nrm c:\users\Bryan\.frostwire5\search_db\search_db\_2.prx c:\users\Bryan\.frostwire5\search_db\search_db\_2.tii c:\users\Bryan\.frostwire5\search_db\search_db\_2.tis c:\users\Bryan\.frostwire5\search_db\search_db\_3.fdt c:\users\Bryan\.frostwire5\search_db\search_db\_3.fdx c:\users\Bryan\.frostwire5\search_db\search_db\_3.fnm c:\users\Bryan\.frostwire5\search_db\search_db\_3.frq c:\users\Bryan\.frostwire5\search_db\search_db\_3.nrm c:\users\Bryan\.frostwire5\search_db\search_db\_3.prx c:\users\Bryan\.frostwire5\search_db\search_db\_3.tii c:\users\Bryan\.frostwire5\search_db\search_db\_3.tis c:\users\Bryan\.frostwire5\search_db\search_db\_4.fdt c:\users\Bryan\.frostwire5\search_db\search_db\_4.fdx c:\users\Bryan\.frostwire5\search_db\search_db\_4.fnm c:\users\Bryan\.frostwire5\search_db\search_db\_4.frq c:\users\Bryan\.frostwire5\search_db\search_db\_4.nrm c:\users\Bryan\.frostwire5\search_db\search_db\_4.prx c:\users\Bryan\.frostwire5\search_db\search_db\_4.tii c:\users\Bryan\.frostwire5\search_db\search_db\_4.tis c:\users\Bryan\.frostwire5\search_db\search_db\_5.fdt c:\users\Bryan\.frostwire5\search_db\search_db\_5.fdx c:\users\Bryan\.frostwire5\search_db\search_db\_5.fnm c:\users\Bryan\.frostwire5\search_db\search_db\_5.frq c:\users\Bryan\.frostwire5\search_db\search_db\_5.nrm c:\users\Bryan\.frostwire5\search_db\search_db\_5.prx c:\users\Bryan\.frostwire5\search_db\search_db\_5.tii c:\users\Bryan\.frostwire5\search_db\search_db\_5.tis c:\users\Bryan\.frostwire5\search_db\search_db\_6.fdt c:\users\Bryan\.frostwire5\search_db\search_db\_6.fdx c:\users\Bryan\.frostwire5\search_db\search_db\_6.fnm c:\users\Bryan\.frostwire5\search_db\search_db\_6.frq c:\users\Bryan\.frostwire5\search_db\search_db\_6.nrm c:\users\Bryan\.frostwire5\search_db\search_db\_6.prx c:\users\Bryan\.frostwire5\search_db\search_db\_6.tii c:\users\Bryan\.frostwire5\search_db\search_db\_6.tis c:\users\Bryan\.frostwire5\search_db\search_db\_7.cfs c:\users\Bryan\.frostwire5\search_db\search_db\_8.cfs c:\users\Bryan\.frostwire5\search_db\search_db\_9.cfs c:\users\Bryan\.frostwire5\search_db\search_db\_a.fdt c:\users\Bryan\.frostwire5\search_db\search_db\_a.fdx c:\users\Bryan\.frostwire5\search_db\search_db\_a.fnm c:\users\Bryan\.frostwire5\search_db\search_db\_a.frq c:\users\Bryan\.frostwire5\search_db\search_db\_a.nrm c:\users\Bryan\.frostwire5\search_db\search_db\_a.prx c:\users\Bryan\.frostwire5\search_db\search_db\_a.tii c:\users\Bryan\.frostwire5\search_db\search_db\_a.tis c:\users\Bryan\.frostwire5\search_db\search_db\segments.gen c:\users\Bryan\.frostwire5\search_db\search_db\segments_b c:\users\Bryan\.frostwire5\search_db\search_db\write.lock c:\users\Bryan\.frostwire5\seenMessages.dat c:\users\Bryan\.frostwire5\skins.dat c:\users\Bryan\.frostwire5\tables.props c:\users\Bryan\.frostwire5\updates\frostwire-5.3.3.windows.exe c:\users\Bryan\.frostwire5\updates\frostwire-5.3.3.windows.exe.torrent . . ((((((((((((((((((((((((( Files Created from 2012-06-13 to 2012-07-13 ))))))))))))))))))))))))))))))) . . 2012-07-12 20:59 . 2012-06-18 10:12 9013136 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CE76C294-1549-431E-BB71-22787E759890}\mpengine.dll 2012-07-12 17:14 . 2011-09-30 16:28 3405744 —-a-w- c:\users\Bryan\OnlineScanner.ocx 2012-07-12 04:38 . 2012-07-12 04:38 ——– d—–w- c:\users\Bryan\AppData\Local\Wondershare 2012-07-12 04:38 . 2012-07-12 04:38 ——– d—–w- c:\program files (x86)\Common Files\Wondershare 2012-07-12 04:38 . 2012-07-12 04:40 ——– d—–w- c:\users\Bryan\AppData\Roaming\Wondershare 2012-07-12 04:38 . 2012-07-12 04:38 ——– d—–w- c:\program files (x86)\Wondershare 2012-07-11 07:53 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-11 07:46 . 2012-06-06 06:06 2004480 —-a-w- c:\windows\system32\msxml6.dll 2012-07-09 05:49 . 2012-07-09 05:49 ——– d—–w- c:\users\Zanthia.Family\AppData\Local\Innovative Solutions 2012-07-05 06:52 . 2012-07-06 03:15 ——– d—–w- c:\users\Bryan\AppData\Local\Songbird2 2012-07-05 06:52 . 2012-07-05 06:52 ——– d—–w- c:\users\Bryan\AppData\Roaming\Songbird2 2012-07-05 06:52 . 2012-06-08 07:28 15664 —-a-w- c:\windows\SysWow64\drivers\GEARAspiWDM.sys 2012-07-05 06:52 . 2012-06-08 07:28 109360 —-a-w- c:\windows\SysWow64\GEARAspi.dll 2012-07-05 06:51 . 2012-07-09 05:57 ——– d—–w- c:\program files (x86)\Songbird 2012-06-26 13:50 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-26 13:50 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-26 13:50 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-26 13:50 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-26 13:49 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-26 13:49 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-26 13:49 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-26 13:49 . 2012-06-02 22:19 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-26 13:49 . 2012-06-02 22:15 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-24 04:07 . 2012-06-18 15:33 142128 —-a-w- c:\windows\system32\drivers\aswFW.sys 2012-06-24 04:06 . 2012-06-18 15:33 266776 —-a-w- c:\windows\system32\drivers\aswNdis2.sys 2012-06-24 04:06 . 2012-06-18 15:33 19600 —-a-w- c:\windows\system32\drivers\aswKbd.sys 2012-06-24 04:06 . 2012-06-18 11:12 12368 —-a-w- c:\windows\system32\drivers\aswNdis.sys 2012-06-24 03:57 . 2012-06-18 15:33 25232 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys 2012-06-24 03:57 . 2012-06-18 15:33 355320 —-a-w- c:\windows\system32\drivers\aswSP.sys 2012-06-24 03:57 . 2012-06-18 15:33 54072 —-a-w- c:\windows\system32\drivers\aswRdr2.sys 2012-06-24 03:57 . 2012-06-18 15:33 59728 —-a-w- c:\windows\system32\drivers\aswTdi.sys 2012-06-24 03:57 . 2012-06-18 15:33 955304 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2012-06-24 03:57 . 2012-06-18 15:33 71064 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2012-06-24 03:57 . 2012-06-18 15:33 285328 —-a-w- c:\windows\system32\aswBoot.exe 2012-06-24 03:56 . 2012-06-18 15:33 41224 —-a-w- c:\windows\avastSS.scr 2012-06-24 03:56 . 2012-06-18 15:33 227648 —-a-w- c:\windows\SysWow64\aswBoot.exe 2012-06-24 03:56 . 2012-06-24 03:56 ——– d—–w- c:\programdata\AVAST Software 2012-06-24 03:56 . 2012-06-24 03:56 ——– d—–w- c:\program files\AVAST Software 2012-06-23 13:28 . 2012-06-23 13:28 ——– d—–w- c:\program files (x86)\AntiTwin 2012-06-22 19:08 . 2012-06-22 19:08 67376 —-a-w- c:\windows\SysWow64\SYSINFO.OCX 2012-06-22 19:08 . 2012-06-22 19:08 212240 —-a-w- c:\windows\SysWow64\RICHTX32.OCX 2012-06-22 19:08 . 2012-06-22 19:08 ——– d—–w- c:\program files (x86)\AF Uninstalls 2012-06-19 19:59 . 2012-06-19 19:59 ——– d—–w- c:\users\Bryan\AppData\Local\CTrox 2012-06-18 18:25 . 2012-06-18 18:25 476936 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2012-06-18 06:21 . 2012-06-18 06:21 ——– d–h–w- c:\programdata\Common Files 2012-06-15 14:01 . 2012-05-04 11:00 366592 —-a-w- c:\windows\system32\qdvd.dll 2012-06-15 14:01 . 2012-05-04 09:59 514560 —-a-w- c:\windows\SysWow64\qdvd.dll 2012-06-15 14:01 . 2012-05-04 11:06 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-06-15 14:01 . 2012-05-04 10:03 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-06-15 14:01 . 2012-05-04 10:03 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-06-15 14:01 . 2012-04-26 05:41 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-06-15 14:01 . 2012-04-26 05:41 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-15 14:01 . 2012-04-26 05:34 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-15 14:01 . 2012-04-07 12:31 3216384 —-a-w- c:\windows\system32\msi.dll 2012-06-15 14:01 . 2012-04-07 11:26 2342400 —-a-w- c:\windows\SysWow64\msi.dll 2012-06-15 14:01 . 2012-04-28 03:55 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-15 14:01 . 2012-05-01 05:40 209920 —-a-w- c:\windows\system32\profsvc.dll 2012-06-15 14:00 . 2012-04-24 05:37 1462272 —-a-w- c:\windows\system32\crypt32.dll 2012-06-15 13:59 . 2012-04-24 05:37 184320 —-a-w- c:\windows\system32\cryptsvc.dll 2012-06-15 13:59 . 2012-04-24 05:37 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-06-15 13:59 . 2012-04-24 04:36 140288 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-06-15 13:59 . 2012-04-24 04:36 1158656 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-06-15 13:59 . 2012-04-24 04:36 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-12 03:30 . 2012-04-13 22:07 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-12 03:30 . 2011-11-07 17:34 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-03 20:46 . 2010-05-09 20:26 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-06-22 19:08 . 2011-04-05 16:39 152848 —-a-w- c:\windows\SysWow64\COMDLG32.OCX 2012-06-22 19:08 . 2011-04-05 16:39 662288 —-a-w- c:\windows\SysWow64\MSCOMCT2.OCX 2012-06-18 18:25 . 2011-11-09 09:03 472840 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-06-18 18:20 . 2011-12-22 23:57 955840 —-a-w- c:\windows\system32\npdeployJava1.dll 2012-06-18 18:20 . 2010-07-26 21:02 839096 —-a-w- c:\windows\system32\deployJava1.dll 2012-05-31 19:25 . 2010-05-02 21:55 279656 ——w- c:\windows\system32\MpSigStub.exe 2012-04-19 03:56 . 2012-04-19 03:56 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-04-19 03:56 . 2012-04-19 03:56 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts . . ((((((((((((((((((((((((((((( SnapShot@2012-07-11_07.17.35 ))))))))))))))))))))))))))))))))))))))))) . + 2012-07-11 07:46 . 2012-06-02 04:34 96768 c:\windows\SysWOW64\sspicli.dll- 2012-01-10 18:29 . 2011-11-17 05:28 96768 c:\windows\SysWOW64\sspicli.dll + 2012-07-11 07:46 . 2012-06-02 04:40 22016 c:\windows\SysWOW64\secur32.dll - 2012-01-10 18:29 . 2011-11-17 05:34 22016 c:\windows\SysWOW64\secur32.dll + 2012-07-11 07:47 . 2012-06-02 08:17 73216 c:\windows\SysWOW64\mshtmled.dll - 2012-06-15 14:03 . 2012-05-17 22:25 73216 c:\windows\SysWOW64\mshtmled.dll + 2012-07-11 07:47 . 2012-06-02 08:22 66048 c:\windows\SysWOW64\migration\WininetPlugin.dll - 2012-06-15 14:02 . 2012-05-17 22:31 66048 c:\windows\SysWOW64\migration\WininetPlugin.dll + 2012-07-11 07:47 . 2012-06-02 08:21 65024 c:\windows\SysWOW64\jsproxy.dll - 2012-06-15 14:02 . 2012-05-17 22:31 65024 c:\windows\SysWOW64\jsproxy.dll + 2009-07-14 04:54 . 2012-07-12 22:30 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2012-07-11 06:31 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-07-12 22:30 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-07-11 06:31 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-07-12 22:30 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-07-11 06:31 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 05:10 . 2012-07-12 22:30 63864 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2010-05-02 05:52 . 2012-07-12 22:30 32410 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3488347447-2488368954-518346416-1000_UserData.bin - 2012-06-15 14:03 . 2012-05-18 01:51 96768 c:\windows\system32\mshtmled.dll + 2012-07-11 07:47 . 2012-06-02 11:57 96768 c:\windows\system32\mshtmled.dll + 2012-07-11 07:47 . 2012-06-02 12:03 86528 c:\windows\system32\migration\WininetPlugin.dll - 2012-06-15 14:02 . 2012-05-18 01:56 86528 c:\windows\system32\migration\WininetPlugin.dll - 2012-06-15 14:02 . 2012-05-18 01:56 85504 c:\windows\system32\jsproxy.dll + 2012-07-11 07:47 . 2012-06-02 12:03 85504 c:\windows\system32\jsproxy.dll + 2012-07-11 07:46 . 2012-06-02 05:48 95600 c:\windows\system32\drivers\ksecdd.sys - 2012-01-10 18:29 . 2011-11-17 06:49 95600 c:\windows\system32\drivers\ksecdd.sys + 2006-10-11 03:00 . 2012-07-12 03:29 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2006-10-11 03:00 . 2012-07-10 23:00 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2010-11-10 23:56 . 2012-07-10 23:00 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2010-11-10 23:56 . 2012-07-12 03:29 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-07-12 03:29 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-07-10 23:00 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:46 . 2012-07-11 16:56 84184 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat + 2010-05-02 05:34 . 2012-07-12 22:28 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2010-05-02 05:34 . 2012-07-10 22:39 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 00:19 . 2009-07-14 01:07 2048 c:\windows\SysWOW64\msxml3r.dll + 2012-07-11 07:46 . 2010-06-26 03:24 2048 c:\windows\SysWOW64\msxml3r.dll - 2009-07-14 00:41 . 2009-07-14 01:30 2048 c:\windows\system32\msxml3r.dll + 2012-07-11 07:46 . 2010-06-26 03:55 2048 c:\windows\system32\msxml3r.dll + 2012-07-12 22:28 . 2012-07-12 22:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-07-10 22:39 . 2012-07-10 22:39 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-07-12 22:28 . 2012-07-12 22:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-07-10 22:39 . 2012-07-10 22:39 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-06-15 14:03 . 2012-05-17 22:33 231936 c:\windows\SysWOW64\url.dll + 2012-07-11 07:47 . 2012-06-02 08:23 231936 c:\windows\SysWOW64\url.dll + 2012-07-11 07:46 . 2012-06-02 04:40 225280 c:\windows\SysWOW64\schannel.dll + 2012-07-11 07:46 . 2012-06-02 04:39 219136 c:\windows\SysWOW64\ncrypt.dll - 2009-07-13 23:33 . 2009-07-14 01:16 219136 c:\windows\SysWOW64\ncrypt.dll + 2012-07-12 03:30 . 2012-07-12 03:30 686280 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_265_Plugin.exe + 2012-07-12 02:33 . 2012-07-12 02:33 686280 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.exe + 2012-07-12 02:33 . 2012-07-12 02:33 465096 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.dll - 2012-03-30 21:07 . 2012-06-23 00:29 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + 2012-03-30 21:07 . 2012-07-12 03:30 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + 2012-07-11 07:47 . 2012-06-02 08:19 716800 c:\windows\SysWOW64\jscript.dll - 2012-06-15 14:02 . 2012-05-17 22:29 716800 c:\windows\SysWOW64\jscript.dll + 2012-07-11 07:47 . 2012-06-02 08:20 142848 c:\windows\SysWOW64\ieUnatt.exe - 2012-06-15 14:02 . 2012-05-17 22:29 142848 c:\windows\SysWOW64\ieUnatt.exe + 2012-07-11 07:47 . 2012-06-02 08:14 176640 c:\windows\SysWOW64\ieui.dll - 2012-06-15 14:02 . 2012-05-17 22:20 176640 c:\windows\SysWOW64\ieui.dll + 2012-07-11 07:46 . 2012-06-06 05:03 805376 c:\windows\SysWOW64\cdosys.dll - 2011-11-07 03:04 . 2010-11-20 12:18 805376 c:\windows\SysWOW64\cdosys.dll + 2010-05-02 18:13 . 2012-07-13 00:55 469426 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin + 2009-10-28 05:40 . 2012-07-12 22:30 100780 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin - 2012-06-15 14:03 . 2012-05-18 01:58 237056 c:\windows\system32\url.dll + 2012-07-11 07:47 . 2012-06-02 12:04 237056 c:\windows\system32\url.dll - 2012-01-10 18:29 . 2011-11-17 06:35 340992 c:\windows\system32\schannel.dll + 2012-07-11 07:46 . 2012-06-02 05:45 340992 c:\windows\system32\schannel.dll + 2009-07-14 02:36 . 2012-07-12 22:47 660296 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-07-12 22:47 121224 c:\windows\system32\perfc009.dat - 2009-07-13 23:49 . 2009-07-14 01:41 307200 c:\windows\system32\ncrypt.dll + 2012-07-11 07:46 . 2012-06-02 05:44 307200 c:\windows\system32\ncrypt.dll + 2012-07-12 03:29 . 2012-07-12 03:29 417992 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_265_Plugin.exe + 2012-07-12 02:33 . 2012-07-12 02:33 417992 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_265_ActiveX.exe + 2012-07-12 02:33 . 2012-07-12 02:33 512200 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_265_ActiveX.dll + 2012-07-11 07:47 . 2012-06-02 12:00 818688 c:\windows\system32\jscript.dll - 2012-06-15 14:02 . 2012-05-18 01:55 818688 c:\windows\system32\jscript.dll - 2012-06-15 14:02 . 2012-05-18 01:55 173056 c:\windows\system32\ieUnatt.exe + 2012-07-11 07:47 . 2012-06-02 12:01 173056 c:\windows\system32\ieUnatt.exe + 2012-07-11 07:47 . 2012-06-02 11:54 248320 c:\windows\system32\ieui.dll - 2012-06-15 14:02 . 2012-05-18 01:47 248320 c:\windows\system32\ieui.dll - 2009-07-14 04:45 . 2012-06-22 19:35 332608 c:\windows\system32\FNTCACHE.DAT + 2009-07-14 04:45 . 2012-07-11 07:56 332608 c:\windows\system32\FNTCACHE.DAT + 2012-07-11 07:46 . 2012-06-02 05:48 151920 c:\windows\system32\drivers\ksecpkg.sys + 2012-07-11 07:46 . 2012-06-02 05:50 458704 c:\windows\system32\drivers\cng.sys + 2009-07-14 05:01 . 2012-07-12 22:09 308428 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-07-10 06:43 308428 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-07-12 04:38 . 2012-07-12 04:38 352256 c:\windows\assembly\NativeImages_v2.0.50727_32\WUL.Diagrams\f0e2603699514681cda01b75d34ed79c\WUL.Diagrams.ni.dll - 2012-06-15 14:02 . 2012-05-17 22:35 1129472 c:\windows\SysWOW64\wininet.dll + 2012-07-11 07:47 . 2012-06-02 08:25 1129472 c:\windows\SysWOW64\wininet.dll - 2012-06-15 14:03 . 2012-05-17 22:36 1103872 c:\windows\SysWOW64\urlmon.dll + 2012-07-11 07:47 . 2012-06-02 08:26 1103872 c:\windows\SysWOW64\urlmon.dll + 2012-07-11 07:46 . 2012-06-06 05:05 1390080 c:\windows\SysWOW64\msxml6.dll - 2011-11-07 03:05 . 2010-11-20 12:19 1390080 c:\windows\SysWOW64\msxml6.dll + 2012-07-11 07:46 . 2012-06-06 05:05 1236992 c:\windows\SysWOW64\msxml3.dll - 2011-11-07 03:05 . 2010-11-20 12:19 1236992 c:\windows\SysWOW64\msxml3.dll + 2012-07-12 03:29 . 2012-07-12 03:30 9465032 c:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll + 2012-07-12 03:30 . 2012-07-12 03:30 1536712 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe + 2012-07-11 07:47 . 2012-06-02 08:33 1800192 c:\windows\SysWOW64\jscript9.dll - 2012-06-15 14:02 . 2012-05-17 22:45 1800192 c:\windows\SysWOW64\jscript9.dll - 2012-06-15 14:02 . 2012-05-17 22:27 1793024 c:\windows\SysWOW64\iertutil.dll + 2012-07-11 07:47 . 2012-06-02 08:19 1793024 c:\windows\SysWOW64\iertutil.dll - 2012-06-15 14:02 . 2012-05-17 22:48 9737728 c:\windows\SysWOW64\ieframe.dll + 2012-07-11 07:47 . 2012-06-02 08:43 9737728 c:\windows\SysWOW64\ieframe.dll + 2012-07-11 07:47 . 2012-06-02 12:05 1392128 c:\windows\system32\wininet.dll - 2012-06-15 14:02 . 2012-05-18 01:59 1392128 c:\windows\system32\wininet.dll - 2012-06-15 14:03 . 2012-05-18 01:59 1346048 c:\windows\system32\urlmon.dll + 2012-07-11 07:47 . 2012-06-02 12:05 1346048 c:\windows\system32\urlmon.dll + 2012-07-11 07:46 . 2012-06-06 06:06 1881600 c:\windows\system32\msxml3.dll - 2012-06-15 14:02 . 2012-05-18 02:06 2311680 c:\windows\system32\jscript9.dll + 2012-07-11 07:47 . 2012-06-02 12:12 2311680 c:\windows\system32\jscript9.dll - 2012-06-15 14:03 . 2012-05-18 01:54 2144768 c:\windows\system32\iertutil.dll + 2012-07-11 07:47 . 2012-06-02 11:59 2144768 c:\windows\system32\iertutil.dll - 2011-11-07 03:04 . 2010-11-20 13:25 1133568 c:\windows\system32\cdosys.dll + 2012-07-11 07:46 . 2012-06-06 06:02 1133568 c:\windows\system32\cdosys.dll + 2009-07-14 04:45 . 2012-07-11 07:58 6923677 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat - 2009-07-14 04:45 . 2012-06-28 14:18 6923677 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat + 2012-07-12 04:38 . 2012-07-12 04:38 4168704 c:\windows\assembly\NativeImages_v2.0.50727_32\WUL.Ctrls\afbd2325d7ffe74d31be045adb347e96\WUL.Ctrls.ni.dll + 2012-07-12 04:38 . 2012-07-12 04:38 1855488 c:\windows\assembly\NativeImages_v2.0.50727_32\WUL.Core\5fe921d0727b4448b35103158c9729d2\WUL.Core.ni.dll + 2012-07-11 07:46 . 2012-06-09 04:41 12873728 c:\windows\SysWOW64\shell32.dll - 2012-06-15 14:02 . 2012-05-17 23:11 12314624 c:\windows\SysWOW64\mshtml.dll + 2012-07-11 07:47 . 2012-06-02 09:07 12314624 c:\windows\SysWOW64\mshtml.dll + 2009-07-14 02:34 . 2012-07-11 07:54 11272192 c:\windows\system32\SMI\Store\Machine\schema.dat + 2012-07-11 07:46 . 2012-06-09 05:43 14172672 c:\windows\system32\shell32.dll - 2012-02-15 17:07 . 2012-01-04 10:44 14172672 c:\windows\system32\shell32.dll - 2012-06-15 14:02 . 2012-05-18 02:47 17807360 c:\windows\system32\mshtml.dll + 2012-07-11 07:47 . 2012-06-02 12:49 17807360 c:\windows\system32\mshtml.dll + 2010-05-03 07:57 . 2012-07-11 07:48 59701280 c:\windows\system32\MRT.exe + 2012-07-12 03:29 . 2012-07-12 03:29 12314312 c:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll + 2012-07-11 07:47 . 2012-06-02 12:17 10924032 c:\windows\system32\ieframe.dll - 2012-06-15 14:02 . 2012-05-18 02:16 10924032 c:\windows\system32\ieframe.dll - 2010-05-03 10:38 . 2012-07-10 06:43 45645148 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3488347447-2488368954-518346416-1000-8192.dat + 2010-05-03 10:38 . 2012-07-11 08:44 45645148 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3488347447-2488368954-518346416-1000-8192.dat - 2010-09-28 22:59 . 2012-07-09 06:50 64145620 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3488347447-2488368954-518346416-1000-4096.dat + 2010-09-28 22:59 . 2012-07-11 08:44 64145620 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3488347447-2488368954-518346416-1000-4096.dat - 2010-05-03 10:38 . 2012-07-09 06:50 29336552 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3488347447-2488368954-518346416-1000-12288.dat + 2010-05-03 10:38 . 2012-07-12 22:09 29336552 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3488347447-2488368954-518346416-1000-12288.dat . – Snapshot reset to current date – . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{a8a9d26a-734f-467a-8907-176f9c5bdf56}"= "c:\program files (x86)\Gospel_Internet_Radio\prxtbGosp.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{a8a9d26a-734f-467a-8907-176f9c5bdf56}] . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 94208 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584] "HostsServer"="c:\program files (x86)\HostsMan\hostssrv.exe" [2010-02-06 1930240] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-08-06 39408] "OpenDNS Updater"="c:\program files (x86)\OpenDNS Updater\OpenDNSUpdater.exe" [2010-06-16 839680] "RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2010-05-07 0] "SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-02-07 666384] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-06-18 4271416] "Wondershare Helper Compact"="c:\program files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" [2012-03-27 1686528] . c:\users\Bryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Bryan\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ MobileGo Service.lnk - c:\program files (x86)\Wondershare\MobileGo for Android\MobileGoService.exe [2012-7-11 96144] Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2011-10-13 291896] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 0 (0x0) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "EnableShellExecuteHooks"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-03 136176] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 250056] R3 ALSysIO;ALSysIO;c:\users\Bryan\AppData\Local\Temp\ALSysIO64.sys [x] R3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-03 136176] R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\7114.tmp [x] R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 40464] R3 PCGenFam;PCGenFam;c:\windows\system32\DRIVERS\PCGenFAM.sys [2010-11-02 198088] R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2011-05-06 19936] R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2011-05-06 13280] R3 SaiKF622;SaiKF622;c:\windows\system32\DRIVERS\SaiKF622.sys [2009-06-02 140800] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 VaneFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2007-08-17 30336] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-03 1255736] R4 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496] R4 IDriveE Service;IDriveE Service;c:\idrive\IDriveE Service.exe [2011-03-31 153032] R4 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080] R4 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-12 62208] R4 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160] S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2012-06-18 12368] S0 aswNdis2;avast! Firewall Core Firewall Service; [x] S0 hotcore3;hc3ServiceName;c:\windows\system32\DRIVERS\hotcore3.sys [2011-01-21 37456] S1 aswFW;avast! TDI Firewall driver; [x] S1 aswKbd;aswKbd; [x] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576] S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016] S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-18 140672] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-06-18 71064] S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2012-06-18 133912] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-21 2214504] S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2011-10-14 994360] S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2011-10-14 399416] S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-05-13 36328] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2009-06-26 83488] S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [2011-11-25 15360] S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976] S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 157672] S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 16872] S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 177640] S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-05-13 146920] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2012-07-13 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 03:30] . 2012-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-03 10:28] . 2012-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-03 10:28] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2012-06-18 15:33 133400 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 97792 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 97792 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 97792 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-12-05 19:17 97792 —-a-w- c:\users\Bryan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-07 10144288] "PLD_FrameworkRun"="c:\windows\system32\oem\_NowIntoDT.vbs" [2009-10-11 490] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-22 2327952] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = about:blank mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000LSP: %SYSTEMROOT%\system32\nvLsp.dll Trusted Zone: bleacherreport.com Trusted Zone: google.com\mail Trusted Zone: google.com\www Trusted Zone: hoptoadapp.com TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 TCP: Interfaces\{473F86ED-FB55-42E5-8A1F-9FC700C929D6}: NameServer = 208.67.222.222,208.67.220.220 DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab FF - ProfilePath - c:\users\Bryan\AppData\Roaming\Mozilla\Firefox\Profiles\sc8h00j6.default\ FF - prefs.js: browser.search.selectedEngine - Ask.com FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=SGD2&o=2421&locale=en_US&apn_uid=99fa60fe-b06e-45a5-a5f5-dd647dbe1ff8&apn_ptnrs=%5EAEC&apn_sauid=2EEA134B-3551-4840-9456-0F484A5B109E&apn_dtid=%5EYYYYYY%5EYY%5EUS&&q= . - - - - ORPHANS REMOVED - - - - . BHO-{CCB69577-088B-4004-9ED8-FF5BCC83A039} - (no file) Toolbar-10 - (no file) WebBrowser-{A8A9D26A-734F-467A-8907-176F9C5BDF56} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) ShellIconOverlayIdentifiers-{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} - (no file) . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MEMSWEEP2] "ImagePath"="\??\c:\windows\system32\7114.tmp" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,85,60,b7,6e,ff,df,50,47,be,ce,3c,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,85,60,b7,6e,ff,df,50,47,be,ce,3c,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*] "value"="?\03\04\16\176\1e?" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-07-12 18:18:58 ComboFix-quarantined-files.txt 2012-07-13 01:18 ComboFix2.txt 2012-07-11 07:19 ComboFix3.txt 2011-04-16 18:59 . Pre-Run: 591,452,561,408 bytes free Post-Run: 591,448,096,768 bytes free . - - End Of File - - F16DA11695F1B98304725C64CB5ED8D4
Post #14
Yes I can. I won't know until I use the computer for a full day if there are any other problems ,but at the mment things seem to be okay. THanks for all you did to help. I still have to figure out what to do with the phone and malware problems, unfortunately I use the pc and phone together quite often, I'll have to start using a sandbox when I'm hooked up with the phone.
Post #15
Sounds good.

Let's cleanup.

Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type ComboFix /Uninstall in the runbox and click OK.
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Now to remove most of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.

Please re-enable any security that was disabled.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI