What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Had Smart Check Virus now something else [Solved]

28 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I had the smart check virus a few days ago which I thought I got rid off. However now my browser is very slow and I start to hear music and commercials when the browser is closed. No idea where it is coming from.

Here is the OTL

OTL logfile created on: 7/14/2012 11:50:53 PM - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\David\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.86 Gb Total Physical Memory | 1.49 Gb Available Physical Memory | 51.99% Memory free
5.73 Gb Paging File | 3.71 Gb Available in Paging File | 64.78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.33 Gb Total Space | 216.31 Gb Free Space | 76.35% Space Free | Partition Type: NTFS

Computer Name: | User Name: | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\David\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\SysWOW64\rpcnet.exe (Absolute Software Corp.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
PRC - C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe (iolo technologies, LLC)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe (SoftThinks - Dell)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe ()
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe (SoftThinks - Dell)
PRC - C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe ()
PRC - C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe ()
PRC - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\JSDialogPack150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (EvtEng) Intel® – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) – C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) Intel® – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV:64bit: - (AERTFilters) – C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (rpcnet) Remote Procedure Call (RPC) – C:\WINDOWS\SysWOW64\rpcnet.exe (Absolute Software Corp.)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdvancedSystemCareService5) – C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
SRV - (AntiVirSchedulerService) – C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) – C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) – C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (ioloSystemService) – C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe (iolo technologies, LLC)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (IntuitUpdateServiceV4) – C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit Inc.)
SRV - (SftService) – C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
SRV - (GoToAssist) – C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (AbsoluteNotifier) – C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe (Absolute Software)
SRV - (FlipShare Service) – C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe ()
SRV - (FlipShareServer) – C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe ()
SRV - (RoxWatch12) – C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe (Sonic Solutions)
SRV - (RoxMediaDB12OEM) – C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe (Sonic Solutions)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (AdobeActiveFileMonitor9.0) – C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (UNS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (PSI_SVC_2) – c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (EPSON_EB_RPCV4_01) EPSON V5 Service4(01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (SEIKO EPSON CORPORATION)
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (SEIKO EPSON CORPORATION)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\WINDOWS\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (avkmgr) – C:\WINDOWS\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) – C:\WINDOWS\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (USBAAPL64) – C:\WINDOWS\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (avgntflt) – C:\WINDOWS\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (ElRawDisk) – C:\WINDOWS\SysNative\drivers\ElRawDsk.sys (EldoS Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\WINDOWS\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\WINDOWS\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\WINDOWS\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\WINDOWS\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (CtClsFlt) – C:\WINDOWS\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV:64bit: - (igfx) – C:\WINDOWS\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) Intel® – C:\WINDOWS\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (wdkmd) – C:\WINDOWS\SysNative\drivers\WDKMD.sys (Intel Corporation)
DRV:64bit: - (RSUSBSTOR) – C:\WINDOWS\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (SynTP) – C:\WINDOWS\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (btusbflt) – C:\WINDOWS\SysNative\drivers\btusbflt.sys (Broadcom Corporation.)
DRV:64bit: - (PxHlpa64) – C:\WINDOWS\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (NETw5s64) Intel® – C:\WINDOWS\SysNative\drivers\NETw5s64.sys (Intel Corporation)
DRV:64bit: - (iaStor) – C:\WINDOWS\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (Impcd) – C:\WINDOWS\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (L1C) – C:\WINDOWS\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (HECIx64) Intel® – C:\WINDOWS\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (amdsbs) – C:\WINDOWS\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\WINDOWS\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\WINDOWS\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) – C:\WINDOWS\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\WINDOWS\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\WINDOWS\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\WINDOWS\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\WINDOWS\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (WimFltr) – C:\WINDOWS\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\WINDOWS\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {7E7C7386-4E94-47F9-A757-881391D34CB4}
IE:64bit: - HKLM\..\SearchScopes\{7E7C7386-4E94-47F9-A757-881391D34CB4}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {D15882F2-E045-4A22-B962-09C85DBA4B92}
IE - HKLM\..\SearchScopes\{D15882F2-E045-4A22-B962-09C85DBA4B92}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {A7D575AF-12FD-4817-840D-2526CA54AA42}
IE - HKCU\..\SearchScopes\{33D1C477-1901-490E-9473-89E2DB0F0721}: "URL" = http://websearch.ask.com/redirect?client=i…EA-B8742B99280D
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searccasktoolbar.dll
IE - HKCU\..\SearchScopes\{A7D575AF-12FD-4817-840D-2526CA54AA42}: "URL" = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.startup.homepage: "http://search.avira.com/?l=dis&o;=APN10400&gct;=hp&dc;=US&locale;=en_US"
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src;=kw&tb;=AVR-3&o;=APN10400&locale;=en_US&apn;_uid=c5429061-fddd-4a86-b530-467cfd274930&apn;_ptnrs=^ABY&apn;_sauid=78E696F2-06E4-4081-9CEA-B8742B99280D&apn;_dtid=^YYYYYY^YY^US&&q;="
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\David\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\David\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/05/18 19:23:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/05/24 23:45:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/05/24 23:46:23 | 000,000,000 | —D | M] (No name found) – C:\Users\David\AppData\Roaming\Mozilla\Extensions
[2012/07/12 02:22:13 | 000,000,000 | —D | M] (No name found) – C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\j7yrdded.default\Extensions
[2012/07/14 15:42:03 | 000,000,000 | —D | M] ("Avira SearchFree Toolbar plus Web Protection") – C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\j7yrdded.default\Extensions\[removed]
[2012/07/14 15:42:04 | 000,002,585 | —- | M] () – C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\j7yrdded.default\searchplugins\askcom.xml
[2012/05/24 23:45:28 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/04/20 21:19:34 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/20 21:18:25 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/04/20 21:18:25 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\David\AppData\Local\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\David\AppData\Local\Google\Chrome\Application\20.0.1132.57\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\David\AppData\Local\Google\Chrome\Application\20.0.1132.57\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.40.135.2_0\McChPlg.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll
CHR - plugin: registryAccess (Enabled) = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaangaohdajkgeopjhpbnlpkehbhmbj\7.15.4.0_0\background/registryAccess.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: ShipRush FedEx (Enabled) = C:\Users\David\AppData\Roaming\Mozilla\plugins\NPShipRush_FedEx.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
CHR - plugin: Java™ Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Google Update (Enabled) = C:\Users\David\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: Avira Toolbar = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaangaohdajkgeopjhpbnlpkehbhmbj\7.15.4.0_0\
CHR - Extension: SiteAdvisor = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.40.135.2_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\

O1 HOSTS File: ([2012/07/12 01:30:57 | 000,000,027 | —- | M]) - C:\WINDOWS\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKLM\..\Toolbar: (no name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\WINDOWS\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\WINDOWS\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Absolute Notifier] C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe (Absolute Software)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Advanced SystemCare 5] C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
O4 - HKCU..\Run: [EPSON NX100 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEDA.EXE /FU "C:\Users\David\AppData\Local\Temp\E_SFB5B.tmp" /EF "HKCU" File not found
O4 - HKCU..\Run: [EPSON NX100 Series (Downstairs)] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEDA.EXE /FU "C:\Users\David\AppData\Local\Temp\E_SE78.tmp" /EF "HKCU" File not found
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Epson all-in-one Registration.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Open with Nuance PDF Converter 7.0 - C:\Program Files (x86)\Nuance\PDF Converter 7\cnvres_eng.dll (Nuance Communications, Inc.)
O8:64bit: - Extra context menu item: Send image to &Bluetooth; Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm File not found
O8:64bit: - Extra context menu item: Send page to &Bluetooth; Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Open with Nuance PDF Converter 7.0 - C:\Program Files (x86)\Nuance\PDF Converter 7\cnvres_eng.dll (Nuance Communications, Inc.)
O8 - Extra context menu item: Send image to &Bluetooth; Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm File not found
O8 - Extra context menu item: Send page to &Bluetooth; Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O9:64bit: - Extra Button: @c:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O9:64bit: - Extra 'Tools' menuitem : @c:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O9 - Extra 'Tools' menuitem : Send to &Bluetooth; Device… - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000020 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O16:64bit: - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{420EFB18-F474-410B-9B79-10B6600E7AFA}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DF54E6FA-92F1-42BF-86BB-D3383CE30E7F}: DhcpNameServer = 10.0.0.1
O18:64bit: - Protocol\Handler\cozi - No CLSID value found
O18:64bit: - Protocol\Handler\dssrequest - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\sacore - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\cozi {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - C:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll (Cozi Group, Inc.)
O18 - Protocol\Handler\dssrequest - No CLSID value found
O18 - Protocol\Handler\sacore - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (sdnclean64.exe)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\WINDOWS\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/07/14 23:49:08 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Users\David\Desktop\OTL.exe
[2012/07/14 22:51:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/14 22:51:44 | 000,024,904 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/07/14 22:51:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/07/14 17:36:56 | 000,000,000 | —D | C] – C:\Users\David\Documents\ProcAlyzer Dumps
[2012/07/14 12:18:45 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2012/07/14 12:18:40 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2012/07/14 12:18:35 | 000,017,272 | —- | C] (Safer Networking Limited) – C:\Windows\SysNative\sdnclean64.exe
[2012/07/14 12:18:31 | 000,000,000 | —D | C] – C:\Program Files (x86)\Spybot - Search & Destroy 2
[2012/07/12 02:46:26 | 000,024,448 | —- | C] (IObit) – C:\Windows\SysNative\RegistryDefragBootTime.exe
[2012/07/12 02:36:10 | 000,366,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\qdvd.dll
[2012/07/12 02:36:09 | 000,514,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\qdvd.dll
[2012/07/12 02:35:39 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2012/07/12 02:29:38 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\Avira
[2012/07/12 02:23:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012/07/12 02:22:25 | 000,000,000 | —D | C] – C:\Users\David\AppData\Local\AskToolbar
[2012/07/12 02:22:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\Ask.com
[2012/07/12 02:21:57 | 000,000,000 | —D | C] – C:\Users\David\AppData\Local\APN
[2012/07/12 02:21:42 | 000,132,832 | —- | C] (Avira GmbH) – C:\Windows\SysNative\drivers\avipbb.sys
[2012/07/12 02:21:42 | 000,098,848 | —- | C] (Avira GmbH) – C:\Windows\SysNative\drivers\avgntflt.sys
[2012/07/12 02:21:42 | 000,027,760 | —- | C] (Avira GmbH) – C:\Windows\SysNative\drivers\avkmgr.sys
[2012/07/12 02:21:30 | 000,000,000 | —D | C] – C:\ProgramData\Avira
[2012/07/12 02:16:31 | 000,000,000 | —D | C] – C:\ProgramData\IObit
[2012/07/12 02:16:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 5
[2012/07/12 02:16:05 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\IObit
[2012/07/12 02:15:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\IObit
[2012/07/12 02:10:52 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/07/12 02:10:52 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/07/12 02:10:51 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/07/12 02:10:51 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/07/12 02:10:49 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/07/12 02:10:49 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/07/12 02:10:49 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/07/12 02:10:49 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/07/12 02:10:48 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/07/12 02:10:47 | 002,311,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/07/12 02:10:47 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/07/12 02:10:47 | 000,818,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/07/12 02:10:47 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/07/12 02:10:37 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\Malwarebytes
[2012/07/12 02:10:18 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/07/12 02:04:30 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/07/12 02:01:58 | 000,000,000 | —D | C] – C:\Windows\pss
[2012/07/12 01:13:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2012/07/12 00:50:55 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/07/12 00:50:55 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/07/12 00:50:55 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/07/12 00:49:39 | 000,000,000 | —D | C] – C:\ComboFix
[2012/07/12 00:39:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012/07/12 00:25:46 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Avira UnErase Personal
[2012/07/12 00:25:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\Avira
[2012/07/12 00:22:13 | 000,000,000 | —D | C] – C:\Qoobox
[2012/07/12 00:21:15 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/07/11 18:34:40 | 000,000,000 | —D | C] – C:\Users\David\Desktop\RK_Quarantine
[2012/07/11 18:34:34 | 004,576,462 | R— | C] (Swearware) – C:\Users\David\Desktop\ComboFix.exe
[2012/07/11 01:17:40 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data Recovery
[2012/07/11 01:05:46 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml3r.dll
[2012/07/11 01:05:46 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msxml3r.dll
[2012/07/11 01:05:33 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2012/07/11 01:05:21 | 000,805,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\cdosys.dll
[2012/07/11 01:05:17 | 001,133,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cdosys.dll
[2012/07/07 04:10:23 | 000,000,000 | —D | C] – C:\Users\David\Documents\Any Video Converter
[2012/07/07 04:10:20 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\AnvSoft
[2012/07/07 04:01:32 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnvSoft
[2012/07/07 04:00:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\AnvSoft
[2012/07/07 02:37:34 | 000,000,000 | —D | C] – C:\ProgramData\NCH Software
[2012/07/07 02:37:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\NCH Software
[2012/07/07 02:36:58 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\NCH Software
[2012/07/07 02:31:55 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\HandBrake
[2012/07/07 02:31:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Handbrake
[2012/07/07 02:24:19 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\AVS4YOU
[2012/07/07 02:15:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVS4YOU
[2012/07/07 02:14:45 | 011,137,024 | —- | C] (Intel Corporation) – C:\Windows\SysWow64\libmfxsw32.dll
[2012/07/07 02:14:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\AVSMedia
[2012/07/07 02:14:20 | 000,000,000 | —D | C] – C:\ProgramData\AVS4YOU
[2012/07/07 02:14:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\AVS4YOU
[2012/07/04 01:09:25 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CD - DVD Publishing Service
[2012/06/29 17:17:32 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\Sony Creative Software Inc
[2012/06/29 16:56:57 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\Publish Providers
[2012/06/29 01:47:58 | 000,000,000 | —D | C] – C:\Users\David\Documents\Vegas Movie Studio HD Platinum 10.0 Projects
[2012/06/29 01:47:58 | 000,000,000 | —D | C] – C:\Users\David\AppData\Local\Sony
[2012/06/29 01:44:08 | 000,000,000 | —D | C] – C:\Program Files (x86)\iZotope
[2012/06/29 01:36:40 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2012/06/29 01:36:37 | 000,000,000 | —D | C] – C:\ProgramData\Sony
[2012/06/29 01:36:35 | 000,000,000 | —D | C] – C:\Program Files (x86)\Sony
[2012/06/29 01:17:59 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\Sony
[2012/06/29 00:56:06 | 000,000,000 | —D | C] – C:\Users\David\My Backup Files
[2012/06/28 23:21:20 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\Flip Video
[2012/06/28 23:20:14 | 000,000,000 | —D | C] – C:\ProgramData\Flip Video
[2012/06/28 23:20:08 | 000,000,000 | —D | C] – C:\Program Files (x86)\Flip Video
[2012/06/28 22:48:20 | 000,000,000 | —D | C] – C:\Users\David\AppData\Local\Apple Computer
[2012/06/28 22:48:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/06/28 22:48:14 | 000,126,312 | —- | C] (GEAR Software Inc.) – C:\Windows\SysNative\GEARAspi64.dll
[2012/06/28 22:48:14 | 000,107,368 | —- | C] (GEAR Software Inc.) – C:\Windows\SysWow64\GEARAspi.dll
[2012/06/28 22:48:14 | 000,034,152 | —- | C] (GEAR Software Inc.) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys
[2012/06/28 22:48:14 | 000,000,000 | —D | C] – C:\Windows\SysNative\DRVSTORE
[2012/06/28 22:47:52 | 000,000,000 | —D | C] – C:\Users\David\Desktop\Monicas Stuff
[2012/06/28 22:46:50 | 000,000,000 | -H-D | C] – C:\Program Files\iPod
[2012/06/28 22:46:49 | 000,000,000 | -H-D | C] – C:\Program Files\iTunes
[2012/06/28 22:46:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2012/06/28 22:46:49 | 000,000,000 | —D | C] – C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/06/28 22:45:20 | 000,000,000 | -H-D | C] – C:\Program Files\Common Files\Apple
[2012/06/28 22:44:51 | 000,000,000 | -H-D | C] – C:\Program Files\Bonjour
[2012/06/28 22:44:51 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bonjour
[2012/06/28 00:34:27 | 000,000,000 | —D | C] – C:\Users\David\Documents\Free Speaking Course
[2012/06/27 23:21:57 | 000,000,000 | —D | C] – C:\Users\David\Documents\Mail Hold
[2012/06/27 22:22:54 | 000,000,000 | —D | C] – C:\Users\David\Documents\Laurie Ludjine grades 2012
[2012/06/27 08:40:07 | 000,000,000 | —D | C] – C:\Users\David\Documents\Bluetooth Exchange Folder
[2012/06/26 22:08:21 | 000,000,000 | —D | C] – C:\Users\David\AppData\Local\Macromedia
[2012/06/24 20:54:45 | 000,000,000 | —D | C] – C:\Users\David\Desktop\Public Speaking
[2012/06/22 17:49:58 | 002,622,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/06/22 17:49:58 | 000,057,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/06/22 17:49:58 | 000,044,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2012/06/22 17:49:38 | 000,701,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2012/06/22 17:49:38 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2012/06/22 17:49:38 | 000,038,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2012/06/22 17:49:28 | 000,186,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2012/06/22 17:49:28 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2012/06/20 13:59:56 | 000,000,000 | —D | C] – C:\Users\David\AppData\Local\Evernote
[2012/06/20 13:59:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
[2012/06/20 13:59:31 | 000,000,000 | —D | C] – C:\Program Files (x86)\Evernote
[2012/06/18 23:10:51 | 000,000,000 | —D | C] – C:\Users\David\Desktop\Dandrea Pix
[2012/06/18 22:52:07 | 000,000,000 | —D | C] – C:\Users\David\AppData\Roaming\RealNetworks
[2012/03/23 17:49:09 | 005,944,600 | —- | C] (Absolute Software Corp. ) – C:\Users\David\AppData\Roaming\LoJackSetup.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/14 23:48:55 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\David\Desktop\OTL.exe
[2012/07/14 23:39:01 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1443603178-1069732724-762211521-1001UA.job
[2012/07/14 23:31:00 | 000,007,597 | —- | M] () – C:\Users\David\AppData\Local\Resmon.ResmonCfg
[2012/07/14 23:08:04 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/14 22:51:45 | 000,001,111 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/14 22:42:47 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/14 22:42:47 | 000,014,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/14 22:42:17 | 000,743,860 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/07/14 22:42:17 | 000,636,084 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/07/14 22:42:17 | 000,111,626 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/07/14 22:35:01 | 000,017,920 | —- | M] () – C:\Windows\SysNative\rpcnetp.exe
[2012/07/14 22:34:58 | 000,058,288 | —- | M] (Absolute Software Corp.) – C:\Windows\SysWow64\rpcnet.dll
[2012/07/14 22:34:43 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/07/14 22:34:39 | 2306,211,840 | -HS- | M] () – C:\hiberfil.sys
[2012/07/14 18:22:57 | 000,017,920 | —- | M] () – C:\Windows\SysWow64\rpcnetp.dll
[2012/07/14 18:22:46 | 000,000,506 | —- | M] () – C:\Windows\tasks\SystemToolsDailyTest.job
[2012/07/14 18:21:35 | 000,017,920 | —- | M] () – C:\Windows\SysWow64\rpcnetp.exe
[2012/07/14 18:21:00 | 000,003,224 | —- | M] () – C:\bootsqm.dat
[2012/07/14 12:18:41 | 000,002,175 | —- | M] () – C:\Users\Public\Desktop\Spybot-S&D; Start Center.lnk
[2012/07/14 10:11:05 | 000,175,511 | —- | M] () – C:\Users\David\Desktop\Deryl_Loar_Invitation_Coleman.pdf
[2012/07/14 10:10:58 | 000,064,440 | —- | M] () – C:\Users\David\Desktop\Deryl_Loar_Invitation_Conway_&_Northey.pdf
[2012/07/12 21:39:01 | 000,000,856 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1443603178-1069732724-762211521-1001Core.job
[2012/07/12 21:22:19 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/07/12 21:22:19 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/07/12 21:21:49 | 009,822,920 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerInstaller.exe
[2012/07/12 19:41:03 | 000,002,401 | —- | M] () – C:\Users\David\Desktop\Google Chrome.lnk
[2012/07/12 19:30:58 | 000,013,160 | —- | M] (Absolute Software Corp.) – C:\Windows\SysWow64\Upgrd.exe
[2012/07/12 19:30:54 | 000,058,288 | —- | M] (Absolute Software Corp.) – C:\Windows\SysWow64\rpcnet.exe
[2012/07/12 19:18:11 | 000,001,445 | —- | M] () – C:\Users\David\Desktop\Internet Explorer.lnk
[2012/07/12 02:57:33 | 000,775,448 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/07/12 02:36:10 | 000,366,592 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\qdvd.dll
[2012/07/12 02:36:09 | 000,514,560 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\qdvd.dll
[2012/07/12 02:23:10 | 000,002,068 | —- | M] () – C:\Users\Public\Desktop\Avira Control Center.lnk
[2012/07/12 02:16:11 | 000,001,274 | —- | M] () – C:\Users\Public\Desktop\Uninstaller.lnk
[2012/07/12 02:16:11 | 000,001,223 | —- | M] () – C:\Users\Public\Desktop\Advanced SystemCare 5.lnk
[2012/07/12 01:30:57 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.20120714-154133.backup
[2012/07/12 01:30:57 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2012/07/12 00:25:42 | 000,000,000 | —- | M] () – C:\Users\David\Desktop\1.ini
[2012/07/11 18:25:24 | 004,576,462 | R— | M] (Swearware) – C:\Users\David\Desktop\ComboFix.exe
[2012/07/11 18:23:20 | 000,412,384 | —- | M] () – C:\Users\David\Desktop\unerase_en_h.exe
[2012/07/11 18:15:32 | 001,558,016 | —- | M] () – C:\Users\David\Desktop\RogueKiller.exe
[2012/07/11 01:17:43 | 000,000,000 | —- | M] () – C:\ProgramData\-BeVi9NH2LNp2un
[2012/07/08 20:30:22 | 000,199,793 | —- | M] () – C:\Users\David\Desktop\PreMarital.Conversation.pdf
[2012/07/08 20:19:32 | 000,093,527 | —- | M] () – C:\Users\David\Desktop\strengthening_marriage.pdf
[2012/07/08 20:03:51 | 000,107,342 | —- | M] () – C:\Users\David\Desktop\4 stages of marriage.pdf
[2012/07/08 19:57:08 | 000,263,168 | —- | M] () – C:\Users\David\Desktop\services_marriage article.pdf
[2012/07/08 19:17:03 | 000,179,575 | —- | M] () – C:\Users\David\Desktop\LYW-VP-welcome-letter-and-application.pdf
[2012/07/07 04:01:33 | 000,001,238 | —- | M] () – C:\Users\David\Desktop\Any Video Converter.lnk
[2012/07/07 03:51:52 | 000,227,694 | —- | M] () – C:\Users\David\Desktop\webinar-register-thankyou.pdf
[2012/07/03 13:46:44 | 000,024,904 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/06/29 01:43:05 | 000,002,049 | —- | M] () – C:\Users\Public\Desktop\DVD Architect Studio 5.0.lnk
[2012/06/29 01:36:44 | 000,002,118 | —- | M] () – C:\Users\Public\Desktop\Vegas Movie Studio HD Platinum 10.0.lnk
[2012/06/28 23:21:54 | 000,003,584 | -H– | M] () – C:\Users\David\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/06/28 23:21:27 | 000,001,015 | R— | M] () – C:\logFile.xsl
[2012/06/28 23:20:20 | 000,001,096 | —- | M] () – C:\Users\Public\Desktop\FlipShare.lnk
[2012/06/28 22:48:17 | 000,001,785 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/06/27 22:18:14 | 000,121,792 | —- | M] () – C:\Users\David\Documents\classes_parent laurie 6-26-12.pdf
[2012/06/26 21:21:12 | 000,635,087 | —- | M] () – C:\Users\David\Desktop\Small Claims Rules.pdf
[2012/06/26 19:45:35 | 000,034,180 | —- | M] () – C:\Users\David\Documents\cc_20120626_194526.reg
[2012/06/26 19:44:09 | 000,000,824 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2012/06/20 13:59:22 | 000,000,932 | —- | M] () – C:\Users\David\Desktop\Evernote.lnk
[2012/06/18 22:32:53 | 000,000,564 | —- | M] () – C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/14 23:31:00 | 000,007,597 | —- | C] () – C:\Users\David\AppData\Local\Resmon.ResmonCfg
[2012/07/14 22:51:45 | 000,001,111 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/14 18:21:00 | 000,003,224 | —- | C] () – C:\bootsqm.dat
[2012/07/14 12:18:41 | 000,002,187 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D; Start Center.lnk
[2012/07/14 12:18:41 | 000,002,175 | —- | C] () – C:\Users\Public\Desktop\Spybot-S&D; Start Center.lnk
[2012/07/14 10:11:05 | 000,175,511 | —- | C] () – C:\Users\David\Desktop\Deryl_Loar_Invitation_Coleman.pdf
[2012/07/14 10:10:58 | 000,064,440 | —- | C] () – C:\Users\David\Desktop\Deryl_Loar_Invitation_Conway_&_Northey.pdf
[2012/07/12 19:18:11 | 000,001,445 | —- | C] () – C:\Users\David\Desktop\Internet Explorer.lnk
[2012/07/12 02:23:10 | 000,002,068 | —- | C] () – C:\Users\Public\Desktop\Avira Control Center.lnk
[2012/07/12 02:16:11 | 000,001,274 | —- | C] () – C:\Users\Public\Desktop\Uninstaller.lnk
[2012/07/12 02:16:11 | 000,001,223 | —- | C] () – C:\Users\Public\Desktop\Advanced SystemCare 5.lnk
[2012/07/12 00:50:55 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/07/12 00:50:55 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/07/12 00:50:55 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/07/12 00:50:55 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/07/12 00:50:55 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/07/12 00:25:42 | 000,000,000 | —- | C] () – C:\Users\David\Desktop\1.ini
[2012/07/11 18:40:07 | 000,002,822 | —- | C] () – C:\Users\Public\Desktop\WildTangent Games App - dell.lnk
[2012/07/11 18:40:07 | 000,002,581 | —- | C] () – C:\Users\Public\Desktop\WrapCandy.lnk
[2012/07/11 18:40:07 | 000,002,515 | —- | C] () – C:\Users\Public\Desktop\TurboTax 2011.lnk
[2012/07/11 18:40:07 | 000,002,164 | —- | C] () – C:\Users\Public\Desktop\Roxio Creator Starter.lnk
[2012/07/11 18:40:07 | 000,002,118 | —- | C] () – C:\Users\Public\Desktop\Vegas Movie Studio HD Platinum 10.0.lnk
[2012/07/11 18:40:07 | 000,002,104 | —- | C] () – C:\Users\Public\Desktop\Serif WebPlus X5.lnk
[2012/07/11 18:40:07 | 000,001,980 | —- | C] () – C:\Users\Public\Desktop\ShipRush for FedEx.lnk
[2012/07/11 18:40:07 | 000,001,847 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/07/11 18:40:07 | 000,001,266 | —- | C] () – C:\Users\Public\Desktop\RealPlayer.lnk
[2012/07/11 18:40:07 | 000,001,108 | —- | C] () – C:\Users\Public\Desktop\Picasa 3.lnk
[2012/07/11 18:40:06 | 000,002,169 | —- | C] () – C:\Users\Public\Desktop\Epson Easy Photo Print.lnk
[2012/07/11 18:40:06 | 000,002,049 | —- | C] () – C:\Users\Public\Desktop\DVD Architect Studio 5.0.lnk
[2012/07/11 18:40:06 | 000,002,047 | —- | C] () – C:\Users\Public\Desktop\eBay Turbo Lister 2.lnk
[2012/07/11 18:40:06 | 000,002,002 | —- | C] () – C:\Users\Public\Desktop\FileZilla Client.lnk
[2012/07/11 18:40:06 | 000,001,997 | —- | C] () – C:\Users\Public\Desktop\eBay.lnk
[2012/07/11 18:40:06 | 000,001,848 | —- | C] () – C:\Users\Public\Desktop\Cozi Family Calendar.lnk
[2012/07/11 18:40:06 | 000,001,785 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/07/11 18:40:06 | 000,001,178 | —- | C] () – C:\Users\Public\Desktop\NX100 Series Information Center.lnk
[2012/07/11 18:40:06 | 000,001,132 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/07/11 18:40:06 | 000,001,108 | —- | C] () – C:\Users\Public\Desktop\PDF Converter Assistant.lnk
[2012/07/11 18:40:06 | 000,001,096 | —- | C] () – C:\Users\Public\Desktop\FlipShare.lnk
[2012/07/11 18:40:06 | 000,000,990 | —- | C] () – C:\Users\Public\Desktop\MagicCute Data Recovery.lnk
[2012/07/11 18:40:06 | 000,000,970 | —- | C] () – C:\Users\Public\Desktop\FXCM Trading Station.lnk
[2012/07/11 18:40:06 | 000,000,932 | —- | C] () – C:\Users\Public\Desktop\EPSON Scan.lnk
[2012/07/11 18:40:06 | 000,000,204 | —- | C] () – C:\Users\Public\Desktop\My Identity Protection.url
[2012/07/11 18:40:05 | 000,002,593 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WrapCandy.lnk
[2012/07/11 18:40:05 | 000,002,488 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012/07/11 18:40:05 | 000,002,021 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012/07/11 18:40:05 | 000,001,880 | —- | C] () – C:\Users\Public\Desktop\Adobe Photoshop Elements 9.lnk
[2012/07/11 18:40:05 | 000,001,547 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012/07/11 18:40:05 | 000,001,460 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2012/07/11 18:40:05 | 000,001,376 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
[2012/07/11 18:40:05 | 000,001,307 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk
[2012/07/11 18:40:05 | 000,001,246 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012/07/11 18:40:05 | 000,000,883 | —- | C] () – C:\Users\Public\Desktop\Caller ID.lnk
[2012/07/11 18:40:05 | 000,000,824 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2012/07/11 18:40:04 | 000,001,352 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012/07/11 18:40:04 | 000,001,326 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012/07/11 18:40:04 | 000,001,210 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012/07/11 18:40:02 | 000,002,463 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Serif WebPlus X5.lnk
[2012/07/11 18:40:02 | 000,002,463 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Serif WebPlus 10.lnk
[2012/07/11 18:40:02 | 000,001,330 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012/07/11 18:40:01 | 000,001,794 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Serif 100k Deluxe Graphics Pack.lnk
[2012/07/11 18:39:59 | 000,001,144 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/07/11 18:39:58 | 000,001,345 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/07/11 18:39:57 | 000,002,114 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel® Wireless Display.lnk
[2012/07/11 18:39:56 | 000,001,108 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlipShare.lnk
[2012/07/11 18:39:55 | 000,001,991 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Help Documentation.lnk
[2012/07/11 18:39:54 | 000,001,860 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cozi Family Calendar.lnk
[2012/07/11 18:39:54 | 000,000,895 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Caller ID.lnk
[2012/07/11 18:39:53 | 000,002,519 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012/07/11 18:39:53 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012/07/11 18:39:53 | 000,001,892 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Elements 9.lnk
[2012/07/11 18:39:53 | 000,001,521 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2012/07/11 18:39:53 | 000,000,999 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2012/07/11 18:34:37 | 000,412,384 | —- | C] () – C:\Users\David\Desktop\unerase_en_h.exe
[2012/07/11 18:34:32 | 001,558,016 | —- | C] () – C:\Users\David\Desktop\RogueKiller.exe
[2012/07/11 01:17:42 | 000,000,000 | —- | C] () – C:\ProgramData\-BeVi9NH2LNp2un
[2012/07/08 20:30:22 | 000,199,793 | —- | C] () – C:\Users\David\Desktop\PreMarital.Conversation.pdf
[2012/07/08 20:19:32 | 000,093,527 | —- | C] () – C:\Users\David\Desktop\strengthening_marriage.pdf
[2012/07/08 20:04:06 | 000,107,342 | —- | C] () – C:\Users\David\Desktop\4 stages of marriage.pdf
[2012/07/08 19:57:30 | 000,263,168 | —- | C] () – C:\Users\David\Desktop\services_marriage article.pdf
[2012/07/08 19:17:03 | 000,179,575 | —- | C] () – C:\Users\David\Desktop\LYW-VP-welcome-letter-and-application.pdf
[2012/07/07 04:01:33 | 000,001,238 | —- | C] () – C:\Users\David\Desktop\Any Video Converter.lnk
[2012/07/07 03:52:01 | 000,227,694 | —- | C] () – C:\Users\David\Desktop\webinar-register-thankyou.pdf
[2012/07/07 03:01:29 | 000,178,688 | —- | C] () – C:\Windows\SysWow64\unrar.dll
[2012/06/28 23:21:54 | 000,003,584 | -H– | C] () – C:\Users\David\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/06/28 23:21:27 | 000,001,015 | R— | C] () – C:\logFile.xsl
[2012/06/27 22:23:38 | 000,121,792 | —- | C] () – C:\Users\David\Documents\classes_parent laurie 6-26-12.pdf
[2012/06/26 21:21:12 | 000,635,087 | —- | C] () – C:\Users\David\Desktop\Small Claims Rules.pdf
[2012/06/26 19:45:31 | 000,034,180 | —- | C] () – C:\Users\David\Documents\cc_20120626_194526.reg
[2012/06/20 13:59:22 | 000,000,932 | —- | C] () – C:\Users\David\Desktop\Evernote.lnk
[2012/04/29 22:34:47 | 000,000,017 | —- | C] () – C:\Users\David\AppData\Local\19720201.dat
[2012/04/29 22:34:47 | 000,000,016 | —- | C] () – C:\Users\David\AppData\Local\art.udk
[2012/04/12 21:19:21 | 000,000,469 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
[2012/04/07 21:46:13 | 000,073,220 | —- | C] () – C:\Windows\SysWow64\EPPICPrinterDB.dat
[2012/04/07 21:46:13 | 000,031,053 | —- | C] () – C:\Windows\SysWow64\EPPICPattern131.dat
[2012/04/07 21:46:13 | 000,029,114 | —- | C] () – C:\Windows\SysWow64\EPPICPattern1.dat
[2012/04/07 21:46:13 | 000,027,417 | —- | C] () – C:\Windows\SysWow64\EPPICPattern121.dat
[2012/04/07 21:46:13 | 000,021,021 | —- | C] () – C:\Windows\SysWow64\EPPICPattern3.dat
[2012/04/07 21:46:13 | 000,015,670 | —- | C] () – C:\Windows\SysWow64\EPPICPattern5.dat
[2012/04/07 21:46:13 | 000,013,280 | —- | C] () – C:\Windows\SysWow64\EPPICPattern2.dat
[2012/04/07 21:46:13 | 000,010,673 | —- | C] () – C:\Windows\SysWow64\EPPICPattern4.dat
[2012/04/07 21:46:13 | 000,004,943 | —- | C] () – C:\Windows\SysWow64\EPPICPattern6.dat
[2012/04/07 21:46:13 | 000,001,140 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_PT.dat
[2012/04/07 21:46:13 | 000,001,140 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_BP.dat
[2012/04/07 21:46:13 | 000,001,137 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_ES.dat
[2012/04/07 21:46:13 | 000,001,130 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_FR.dat
[2012/04/07 21:46:13 | 000,001,130 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_CF.dat
[2012/04/07 21:46:13 | 000,001,104 | —- | C] () – C:\Windows\SysWow64\EPPICPresetData_EN.dat
[2012/04/07 21:46:13 | 000,000,097 | -H– | C] () – C:\Windows\SysWow64\PICSDK.ini
[2012/04/07 21:45:01 | 000,000,044 | -H– | C] () – C:\Windows\EPNX100.ini
[2012/04/06 23:49:48 | 000,074,703 | —- | C] () – C:\Windows\SysWow64\mfc45.dll
[2012/03/29 21:29:12 | 008,007,680 | —- | C] ( ) – C:\Windows\SysWow64\Microsoft.mshtml.dll
[2012/03/29 21:28:57 | 000,012,288 | —- | C] () – C:\Windows\SysWow64\CSVRes.dll
[2012/03/29 21:26:21 | 000,221,184 | —- | C] () – C:\Windows\SysWow64\nktwab.dll
[2012/03/29 21:26:18 | 000,544,842 | —- | C] () – C:\Windows\SysWow64\LLHttpsUpload4.dll
[2012/03/29 21:26:17 | 000,163,840 | —- | C] () – C:\Windows\SysWow64\HTTPUploadDownload.dll
[2012/03/29 21:22:48 | 000,760,090 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/03/29 21:21:56 | 000,151,552 | —- | C] () – C:\Windows\SysWow64\LWLLHttpsUpload2.dll
[2012/03/19 02:42:37 | 000,017,920 | —- | C] () – C:\Windows\SysWow64\rpcnetp.dll
[2012/03/19 02:40:49 | 000,017,920 | —- | C] () – C:\Windows\SysWow64\rpcnetp.exe
[2012/03/19 02:01:47 | 000,000,506 | —- | C] () – C:\Users\David\AppData\Roaming\AbsoluteReminder.xml
[2011/05/24 01:14:10 | 000,870,560 | —- | C] () – C:\Windows\SysWow64\igkrng575.bin
[2011/05/24 01:14:10 | 000,208,896 | —- | C] () – C:\Windows\SysWow64\iglhsip32.dll
[2011/05/24 01:14:10 | 000,143,360 | —- | C] () – C:\Windows\SysWow64\iglhcp32.dll
[2011/05/24 01:14:09 | 000,104,796 | —- | C] () – C:\Windows\SysWow64\igfcg575m.bin
[2011/05/24 01:14:08 | 000,127,868 | —- | C] () – C:\Windows\SysWow64\igcompkrng575.bin

========== LOP Check ==========

[2012/03/23 17:54:33 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Absolute
[2012/03/23 17:55:03 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Absolute Software
[2012/06/05 20:46:30 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\ActiveState
[2012/07/07 04:10:20 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\AnvSoft
[2012/05/05 03:28:19 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/04/28 10:07:59 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\com.comcast.callerid.13A1FA90F0FC9DC009FB0956ADD0F13F8608561B.1
[2012/05/20 18:23:49 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Dextronet
[2012/04/30 23:01:31 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Downloaded Installations
[2012/06/12 22:21:35 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\EPSON
[2012/06/03 16:12:57 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\FileZilla
[2012/03/19 01:57:12 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Fingertapps
[2012/06/28 23:21:20 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Flip Video
[2012/06/13 17:52:37 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\FXTS2
[2012/07/07 02:31:59 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\HandBrake
[2012/03/29 21:22:18 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\High Impact eMail 5
[2012/07/14 20:00:55 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\IObit
[2012/04/06 23:54:54 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\iolo
[2012/04/07 21:51:52 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Leadertech
[2012/03/29 21:22:09 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\LiveMetrics
[2012/03/29 21:21:07 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\LiveWare
[2012/04/25 21:56:11 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Nuance
[2012/03/26 11:05:54 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\PCDr
[2012/04/30 23:02:42 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\public policies
[2012/06/29 16:56:57 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Publish Providers
[2012/03/20 19:02:04 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Serif
[2012/07/07 03:15:53 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Sony
[2012/06/29 17:17:32 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\Sony Creative Software Inc
[2012/04/29 22:34:58 | 000,000,000 | —D | M] – C:\Users\David\AppData\Roaming\www.EasyGiftSoftware.com
[2012/06/18 22:32:53 | 000,000,564 | —- | M] () – C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2012/06/10 19:04:04 | 000,032,624 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2012/07/14 18:22:46 | 000,000,506 | —- | M] () – C:\Windows\Tasks\SystemToolsDailyTest.job

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2012/07/14 18:21:00 | 000,003,224 | —- | M] () – C:\bootsqm.dat
[2012/07/12 01:51:44 | 000,023,897 | —- | M] () – C:\ComboFix.txt
[2011/05/24 00:57:50 | 000,004,088 | —- | M] () – C:\dell.sdr
[2012/07/14 22:34:39 | 2306,211,840 | -HS- | M] () – C:\hiberfil.sys
[2012/04/30 23:11:50 | 000,000,303 | —- | M] () – C:\InstallHelper.log
[2012/04/06 23:50:20 | 000,004,345 | —- | M] () – C:\ioloUpdate.log
[2012/06/28 23:21:27 | 000,001,015 | R— | M] () – C:\logFile.xsl
[2006/12/01 23:37:14 | 000,904,704 | —- | M] (Microsoft Corporation) – C:\msdia80.dll
[2012/07/14 23:40:47 | 3074,953,216 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/14 01:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 01:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 01:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 01:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:49:50 | 000,000,065 | -H– | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/11/10 03:28:46 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/03/19 22:33:51 | 000,000,221 | -HS- | M] () – C:\Users\David\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/07/11 18:25:24 | 004,576,462 | R— | M] (Swearware) – C:\Users\David\Desktop\ComboFix.exe
[2012/07/14 23:48:55 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\David\Desktop\OTL.exe
[2012/07/11 18:15:32 | 001,558,016 | —- | M] () – C:\Users\David\Desktop\RogueKiller.exe
[2012/07/11 18:23:20 | 000,412,384 | —- | M] () – C:\Users\David\Desktop\unerase_en_h.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 226 bytes -> C:\ProgramData\Temp:D95ACC7D

< End of report >


OTL Extras logfile created on: 7/14/2012 11:50:53 PM - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\David\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.86 Gb Total Physical Memory | 1.49 Gb Available Physical Memory | 51.99% Memory free
5.73 Gb Paging File | 3.71 Gb Available in Paging File | 64.78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.33 Gb Total Space | 216.31 Gb Free Space | 76.35% Space Free | Partition Type: NTFS

Computer Name: DAVID-PC | User Name: David | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D; 2 Tray Icon – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D; 2 Scanner Service – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D; 2 Updater – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D; 2 Background update service – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D; 2 Tray Icon – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D; 2 Scanner Service – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D; 2 Updater – (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D; 2 Background update service – (Safer-Networking Ltd.)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1070CC3D-89AB-416E-80CA-6387030EF41F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{1081C343-16AA-4903-BC24-9EBF2B26A8EE}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{183271AC-CBE2-47FC-9258-3D6C5BAF45CF}" = lport=445 | protocol=6 | dir=in | app=system |
"{297D23AF-31EA-4361-88E6-77F9CCB0FBC9}" = lport=10243 | protocol=6 | dir=in | app=system |
"{3152ED87-1FDF-4A0E-A5DF-2F78C4F3A14C}" = lport=137 | protocol=17 | dir=in | app=system |
"{45F4077B-5488-400D-AFAE-069B9CDD9DE9}" = lport=2869 | protocol=6 | dir=in | app=system |
"{490EA83C-CB13-43B9-91D8-9655C01A87CB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4B3C30C9-312F-432D-9144-C7890D2C4CE9}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{4CBC314F-42A1-4C39-9D3A-C243617DD490}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
"{4E9A8FA9-058A-4FCA-9EE2-BED951C6F802}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service v4\intuitupdateservice.exe |
"{4FCF7B43-36E1-4C1A-80FF-BE351D71C9D6}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{59BA90DC-20FA-4E28-9495-D82B2F16EFA8}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{5C6D76DB-65F4-4F00-96ED-75CC4E841E18}" = rport=10243 | protocol=6 | dir=out | app=system |
"{65A7D34F-27AF-4886-A59F-D338F9C17AD9}" = lport=138 | protocol=17 | dir=in | app=system |
"{6968268A-1554-47E6-9372-C2A806784551}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8AE183FC-D114-4B8A-B0D0-B873916BB160}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8EF54841-870E-4949-B3FF-8CE09EA83761}" = rport=138 | protocol=17 | dir=out | app=system |
"{938C4AD3-C878-4C32-AB23-AA447940DBDB}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{9971BB82-86C6-48A3-89FD-E4BA50EA2F4C}" = lport=24726 | protocol=6 | dir=in | name=flipshareserver |
"{A1718DFF-5904-4D27-B8AA-7B7C2040B43B}" = rport=139 | protocol=6 | dir=out | app=system |
"{AAEA1F09-65C7-49ED-839A-D1A649CD4C38}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BFC013D8-AB9C-4499-B3C7-97B6A7CA9320}" = lport=139 | protocol=6 | dir=in | app=system |
"{C2588BB8-1F5E-4F32-B85B-C2048AC6324A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C966CB31-DCAA-445B-8AC0-A947E083D3EF}" = lport=24727 | protocol=6 | dir=in | name=flipshareserver |
"{D7D75EFC-9BEA-4D4F-9913-9B8B17E027E0}" = rport=445 | protocol=6 | dir=out | app=system |
"{E4DD3861-06D2-4F30-A40A-A183C5562591}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E8509D71-AFB6-49A2-AB77-EA7286327469}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EE9126E5-15BE-43A1-B92F-A654DE2A59FD}" = rport=137 | protocol=17 | dir=out | app=system |
"{F075D551-89F4-46D2-B281-644FD0079334}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service v4\intuitupdater.exe |
"{F1504740-A549-4C55-BECF-BD1219165BCD}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{026D4220-05FA-43D3-8568-6A0E33F92B2C}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{0FA4D2BE-4247-4327-90DC-925DFAAC9141}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1C473D73-0A6A-42C6-A313-6F47B6FF8EB8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1CD6231E-6CD8-4B91-96E3-CA6E1184213B}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{1EDD73F3-E2A6-4F8F-8878-9F40B2A762B9}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{2504355B-DC50-48DC-A940-A159F54821F8}" = dir=in | app=c:\program files (x86)\dell\videostage\videostage.exe |
"{2C1A2A38-4012-4326-895C-1E7159AEA4EB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{36A2B619-7ADA-4F6D-9542-587C1A3D5704}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{36C2D61A-F1AC-4F37-8AEC-CB01883FD439}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe |
"{5161682F-A6C9-4915-A8F5-AF80B793B05D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{5824240F-D269-40FB-A10A-08EBC42743D6}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5D445376-BDFC-478B-9992-D91128965DDD}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{5F4A4A6E-8E4F-44B7-B082-857C0380451F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62BD94E9-5CDD-45ED-AAD7-128E71162ABA}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{648618DA-3C87-464C-B6C0-61F01DF1D71F}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{6A3561BA-8DB7-468B-B0C5-D03E6C3C4D8B}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{6D85FF49-3223-4FF6-BF1C-927DF5A498C7}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{6F2303F2-FC5C-489C-8F4F-C1D9BF64488F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{844C0EAC-63AD-48B4-9295-5CAD7873A357}" = protocol=6 | dir=out | app=system |
"{85260BF8-1E6F-473C-93F4-004F7AA404D2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8B7F0285-3E36-45A2-AF5B-E6653F68789D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8C2A2136-707A-43AE-AAB1-3580A6017F26}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{94F34756-7BE6-48C0-B9DC-F604CA5043D0}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{AA4D4F2F-55E2-49E8-AD47-39786F5FE566}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B7F319F5-C011-43BB-B2B0-235CE08B006B}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{BA1EA85A-34E4-4EEC-8F5A-FFBCD035BCC7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C2009F9D-B1FC-4F16-AC27-34AF4DD07879}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{CFF46FDD-4549-4BA4-AF11-58ACD08678A3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D2CAD7E9-D350-4C22-B837-40AD7A8FF209}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DA88EAEF-A359-4E67-9DFD-7DFBDD34DD3E}" = dir=in | app=c:\program files (x86)\intel corporation\intel wireless display\widiapp.exe |
"{DC73818D-26C0-432C-8377-D8837344D27E}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E157BE65-C41A-4350-B9AC-17D0C6512729}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F0B45B5E-90E4-49CC-8B8B-8E99833B37A0}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{FA25F338-A034-4915-A813-E88B1B925BBF}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{FCB40D10-9506-4CDE-83F3-C96AD3670C3A}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{FDD5847B-00E0-44D1-8A16-75841FB57568}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1A8BA6CE-822D-4888-89E2-ACBF4308F271}" = Intel® PROSet/Wireless WiFi Software
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86416024FF}" = Java™ 6 Update 24 (64-bit)
"{51DDB4F9-7FFF-4970-AED4-DB3C22A5C522}" = Corel Graphics - Windows Shell Extension 64 Bit
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{60B2315F-680F-4EB3-B8DD-CCDC86A7CCAB}" = Roxio File Backup
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D6DFAD6-09E5-445E-A4B5-A388FEEBD90D}" = RBVirtualFolder64Inst
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = WIDCOMM Bluetooth Software
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{C298FF86-AB23-4B58-AC53-A23383C07B3A}" = Intel® Wireless Display
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"CutePDF Writer Installation" = CutePDF Writer 2.8
"Dell Support Center" = Dell Support Center
"EPSON NX100 Series" = EPSON NX100 Series Printer Uninstall
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{06CD45E6-FF5E-4D8E-BC01-B276A90DADF2}" = Ghostscript GPL 8.64 (Msi Setup)
"_{B6BFCD02-BA0E-41A9-9C9C-6624C4BB475F}" = Corel Graphics - Windows Shell Extension
"_{CE54DCE1-E00A-4D91-ACB9-A2D916C24051}" = CorelDRAW® Graphics Suite X5
"_{D0291D38-D7AE-47B6-AD64-4FAB908FDB9F}" = CorelDRAW Graphics Suite X5 - Extra Content
"{007F778D-F15C-4EAB-AE92-071D21FAF632}" = Adobe Photoshop Elements 9
"{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}" = Scansoft PDF Converter
"{06CD45E6-FF5E-4D8E-BC01-B276A90DADF2}" = Ghostscript GPL 8.64 (Msi Setup)
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0BE73D3C-B5AF-11E1-933A-984BE15F174E}" = Evernote v. 4.5.7
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{182D9A20-F5AE-4E6C-A4FC-651351DD083E}" = Serif WebPlus: Business Template - Real Estate 1
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20812458-9B6E-777F-EFA4-0C12D582FDF3}" = XFINITY Caller ID
"{24D9A3E0-D086-4B62-AF93-63CF6B05CB48}" = CorelDRAW Graphics Suite X5 - Custom Data
"{260ED378-2B8C-4831-ADAE-D0712D119AC5}" = CorelDRAW Graphics Suite X5 - VSTA
"{26945917-E053-45F6-AF98-309730CFC318}" = Visual Basic for Applications ® Core
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{299C0434-4F4E-341F-A916-4E07AEB35E79}" = Microsoft Visual Studio Tools for Applications 2.0 Runtime
"{2DA5F129-11AC-4F11-8188-B2F07EAAC20A}" = Cozi
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{3250260C-7A95-4632-893B-89657EB5545B}" = PhotoShowExpress
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{3472C84E-2FD0-439F-B27F-C290C1E4CD8B}" = CorelDRAW Graphics Suite X5 - Filters
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{368FCA18-C510-4F87-B60E-192B9BDBAE3D}" = CorelDRAW Graphics Suite X5
"{378C743F-06B8-430F-91A0-0EDD06EDD253}" = Nuance PDF Converter 7
"{40AE01BE-A290-4FFB-8DAB-C624C17DC87E}" = Vegas Movie Studio HD Platinum 10.0
"{433EACD8-4747-4A6A-826A-FFA9F39B0D40}" = Elements 9 Organizer
"{465C892E-BEE0-422F-A992-EA627D1943A3}" = Serif WebPlus: Interest Template - Photography 2
"{494367EC-82A9-4C0D-A788-74A967998E8C}" = FXCM Trading Station
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54B8F4A1-02B0-4D32-8F37-925526C0EEC6}" = CorelDRAW Graphics Suite X5 - Connect
"{55FD1D5A-7AEF-4DA3-8FAF-A71B2A52FFC7}_is1" = iolo technologies' System Mechanic
"{57400C1E-BC51-4ECE-AD2A-A6096204DDEC}" = CorelDRAW Graphics Suite X5 - VBA
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{59123CCF-FED2-46FF-9293-D1DC80042219}" = CorelDRAW Graphics Suite X5 - Redist
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{62978C1C-FE2E-4A4E-851D-3EB406C9EBC2}" = CorelDRAW Graphics Suite X5 - Draw
"{6473C0E9-9763-4D94-808A-B250540AA750}" = Sound Forge Audio Studio 10.0
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68EE5C41-2F79-4F36-BE85-22A814F55AF7}" = CorelDRAW Graphics Suite X5 - ES
"{6B581BFA-7FF1-4C6D-8CB5-137D7DDEA9ED}" = WrapCandyUpdate
"{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}" = Roxio Creator Starter
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-dell" = WildTangent Games App (Dell Games)
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7746BFAA-2B5D-4FFD-A0E8-4558F4668105}" = Roxio Burn
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7D427BD1-1C88-4007-BBFB-C2DD2ED48C63}" = Serif WebPlus X5
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{8292F88E-2DB7-456B-A8F1-9079B7432A1E}" = DVD Architect Studio 5.0
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83C97249-FB38-4FF0-8480-1D8E367767D8}" = Serif WebPlus: Interest Template - Music 1
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{8C0DF485-DB3E-453C-BFB3-4C47E636ECF9}" = Serif WebPlus 10
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F18CFF8-8259-4148-AD00-2EE572754E92}" = CorelDRAW Graphics Suite X5 - FR
"{8F881647-AC08-4E13-9782-D347FBA634AD}" = ShipRush for FedEx
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0116-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9244E956-5939-4B88-930C-0699D4AB2B95}" = CorelDRAW Graphics Suite X5 - WT
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{97C658D2-61FB-027F-0D76-E9CDC84AFEC7}" = FlipShare
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{983F7145-CABF-4EDD-9F3D-E06B2F024BD3}" = CorelDRAW Graphics Suite X5 - FontNav
"{9A00EC4E-27E1-42C4-98DD-662F32AC8870}" = Sonic CinePlayer Decoder Pack
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A40C41B-D7CF-41A8-BD66-5D701D317C23}" = TurboTax 2011 wfliper
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A121EEDE-C68F-461D-91AA-D48BA226AF1C}" = Roxio Activation Module
"{A1B04B6B-25BB-48AD-8BD9-D31A86E89F3E}" = CorelDRAW Graphics Suite X5 - PHOTO-PAINT
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A8B88634-7F90-402F-B66A-86429755F6A5}" = eBay
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{A9E21D37-B157-4245-9C33-179628C47847}" = CorelDRAW Graphics Suite X5 - Premium Fonts
"{AA31EA7B-7917-4000-949B-38E91F848A25}" = Internet Explorer
"{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}" = Microsoft Visual Studio Tools for Applications 2.0 - ENU
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB2FDE4F-6BED-4E9E-B676-3DCCEBB1FBFE}" = Dell Home Systems Service Agreement
"{ABB47A07-3209-42CE-9260-7BAC030CC6CA}" = FontMSI
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
"{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}" = DirectX 9 Runtime
"{B047846C-77F8-415E-B02F-AB28C29386C2}" = Serif 100k Deluxe Graphics Pack
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy
"{B6BFCD02-BA0E-41A9-9C9C-6624C4BB475F}" = Corel Graphics - Windows Shell Extension
"{C16A92EF-017B-4839-9C75-FBADB5A1FA27}" = TrustedID
"{C62984DC-456A-4D12-8D47-F4910DF866D3}" = High Impact eMail 5
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CA3861BA-1D96-4D66-B577-318E1602C4F3}" = CorelDRAW Graphics Suite X5 - Common
"{CAF5B770-082F-40C4-853D-3973BB81BDAA}" = TurboTax 2011 WinPerTaxSupport
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE54DCE1-E00A-4D91-ACB9-A2D916C24051}" = CorelDRAW Graphics Suite X5 - Setup Files
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF67ED0C-F85D-4791-AED3-3FE882EDB45D}" = Dell Perks Webslice IE8
"{D0291D38-D7AE-47B6-AD64-4FAB908FDB9F}" = CorelDRAW Graphics Suite X5 - Extra Content
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D596EEA2-C6C8-45D3-89DF-FA2DBE99F829}" = Visual Basic for Applications ® Core - English
"{D642FF8D-438D-4545-A1D5-2EDB4BCAE3BA}" = CorelDRAW Graphics Suite X5 - Photozoom Plugin
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE6CBC04-8673-4DBA-BA81-07F1639CEB5F}" = CorelDRAW Graphics Suite X5 - IPM
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEDB47A3-C988-4A43-A645-E2CEA571E680}" = Epson Easy Photo Print 2
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2AE009D-37E5-4724-A6B8-0ED6A6BA4F68}" = Elements STI Installer
"{E34C6AA4-AE8E-4677-912A-92FC2E039DD9}" = CorelDRAW Graphics Suite X5 - EN
"{E4335E82-17B3-460F-9E70-39D9BC269DB3}" = Dell PhotoStage
"{E463E171-4082-4744-A466-F7CBE8502789}" = TurboTax 2011 WinPerReleaseEngine
"{E7B0A44B-AA6F-4052-9171-E5E674BD475E}}_is1" = MagicCute Data Recovery 2012.1
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EBE939ED-4612-45FD-A39E-77AC199C4273}" = Absolute Notifier
"{EC8282AB-48DD-91D2-7387-01CD6E100A5D}" = Adobe Photoshop.com Inspiration Browser
"{EDB98D5A-A6FB-425C-BFB7-51A0924B762D}" = CorelDRAW Graphics Suite X5 - Capture
"{EE556A3E-EB37-4392-9637-BAA8EC2F47FA}" = TurboTax 2011 wrapper
"{EF56258E-0326-48C5-A86C-3BAC26FC15DF}" = Roxio Creator Starter
"{F06B5C4C-8D2E-4B24-9D43-7A45EEC6C878}" = Roxio Creator Starter
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F302F4F0-588D-6501-1ACF-BE3FDCC9135D}" = Adobe Community Help
"{F336F89D-8C5A-432C-8EA9-DA19377AD591}" = Dell MusicStage
"{F9EE5132-8BDC-4E3F-B355-BFC51496D00C}" = HIEOutlookPluginSetup
"{FAD3D68B-2F9C-459B-AA79-C04B9090FD72}" = TurboTax 2011 WinPerFedFormset
"{FD8AE9E2-B61E-4826-9CE7-937E1E9A9EEC}" = CorelDRAW Graphics Suite X5 - BR
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE182796-F6BA-486A-8590-89B7E8D1D60F}" = Dell Stage
"{FE4B83DE-85CF-4DE5-90CE-A2735A0E1F21}" = CorelDRAW Graphics Suite X5 - VideoBrowser
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 9" = Adobe Photoshop Elements 9
"Advanced SystemCare 5_is1" = Advanced SystemCare 5
"Any Video Converter_is1" = Any Video Converter 3.4.0
"Avira AntiVir Desktop" = Avira Free Antivirus
"Avira UnErase Personal" = Avira UnErase Personal
"Baby Names" = Baby Names
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.comcast.callerid.13A1FA90F0FC9DC009FB0956ADD0F13F8608561B.1" = XFINITY Caller ID
"Dell Webcam Central" = Dell Webcam Central
"EPSON Scanner" = EPSON Scan
"FileZilla Client" = FileZilla Client 3.5.3
"FXCM Trading Station" = FXCM Trading Station
"GoToAssist" = GoToAssist 8.0.0.514
"InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Mozilla Firefox 12.0 (x86 en-US)" = Mozilla Firefox 12.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"PhotoshopdotcomInspirationBrowser.4C35C4D325D350FE0114230CBADCA2DDD0AC8D25.
1" = Adobe Photoshop.com Inspiration Browser
"Picasa 3" = Picasa 3
"RealPlayer 15.0" = RealPlayer
"Sony Vocal Eraser_is1" = Sony Vocal Eraser
"TurboTax 2011" = TurboTax 2011
"WildTangent dell Master Uninstall" = WildTangent Games
"WinLiveSuite" = Windows Live Essentials
"Wisdom-soft ScreenHunter 6.0 Free" = Wisdom-soft ScreenHunter 6.0 Free
"WrapCandy 7.1 Professional_is1" = WrapCandy 7.1 Professional
"WT089409" = Bejeweled 2 Deluxe
"WT089410" = Blackhawk Striker 2
"WT089411" = Build-a-lot 2
"WT089412" = Cake Mania
"WT089413" = Chuzzle Deluxe
"WT089414" = Diner Dash 2 Restaurant Rescue
"WT089415" = Dora's World Adventure
"WT089418" = FATE
"WT089420" = Jewel Quest
"WT089422" = Jewel Quest Solitaire 2
"WT089426" = Poker Superstars III
"WT089430" = Virtual Villagers 4 - The Tree of Life
"WT089433" = Polar Golfer
"WT089434" = Escape Whisper Valley ™
"WT089440" = Namco All-Stars PAC-MAN
"WT089443" = Bounce Symphony
"WT089444" = Final Drive Nitro
"WT089445" = Penguins!
"WT089446" = Wedding Dash - Ready, Aim, Love!
"WT089448" = Zuma Deluxe
"WT089450" = Farm Frenzy
"WT089452" = Plants vs. Zombies - Game of the Year
"WT089499" = Final Drive Fury
"WT089503" = Samantha Swift
"WT089507" = Luxor
"WT089508" = Polar Bowler

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 7/12/2012 12:25:46 AM | Computer Name = David-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Cozi
Express\CoziExpress.exe".Error in manifest or policy file "" on line . A component
version required by the application conflicts with another component version already
active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error - 7/12/2012 12:25:46 AM | Computer Name = David-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Cozi
Express\CoziExpress.exe".Error in manifest or policy file "" on line . A component
version required by the application conflicts with another component version already
active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error - 7/12/2012 12:33:00 AM | Computer Name = David-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Cozi
Express\CoziExpress.exe".Error in manifest or policy file "" on line . A component
version required by the application conflicts with another component version already
active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error - 7/12/2012 12:42:51 AM | Computer Name = David-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Cozi
Express\CoziExpress.exe".Error in manifest or policy file "" on line . A component
version required by the application conflicts with another component version already
active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error - 7/12/2012 12:47:02 AM | Computer Name = David-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Cozi
Express\CoziExpress.exe".Error in manifest or policy file "" on line . A component
version required by the application conflicts with another component version already
active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error - 7/12/2012 12:51:29 AM | Computer Name = David-PC | Source = VSS | ID = 18
Description =

Error - 7/12/2012 12:51:29 AM | Computer Name = David-PC | Source = VSS | ID = 8193
Description =

Error - 7/12/2012 12:51:29 AM | Computer Name = David-PC | Source = System Restore | ID = 8193
Description =

Error - 7/12/2012 2:04:58 AM | Computer Name = David-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Cozi
Express\CoziExpress.exe".Error in manifest or policy file "" on line . A component
version required by the application conflicts with another component version already
active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error - 7/12/2012 2:05:32 AM | Computer Name = David-PC | Source = Application Error | ID = 1000
Description = Faulting application name: svchost.exe_Dnscache, version: 6.1.7600.16385,
time stamp: 0x4a5bc3c1 Faulting module name: ntdll.dll, version: 6.1.7601.17725,
time stamp: 0x4ec4aa8e Exception code: 0xc0000005 Fault offset: 0x000000000008ac12
Faulting
process id: 0x1b0 Faulting application start time: 0x01cd5ff42465b4ba Faulting application
path: C:\Windows\system32\svchost.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 95f50c25-cbe7-11e1-a895-14feb5ae0559

Error - 7/12/2012 2:05:34 AM | Computer Name = David-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Program Files (x86)\Cozi
Express\CoziExpress.exe".Error in manifest or policy file "" on line . A component
version required by the application conflicts with another component version already
active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

[ System Events ]
Error - 7/11/2012 6:54:45 PM | Computer Name = David-PC | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068

Error - 7/11/2012 6:54:45 PM | Computer Name = David-PC | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068

Error - 7/11/2012 6:54:45 PM | Computer Name = David-PC | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068

Error - 7/11/2012 6:54:45 PM | Computer Name = David-PC | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068

Error - 7/11/2012 6:54:45 PM | Computer Name = David-PC | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068

Error - 7/11/2012 6:54:46 PM | Computer Name = David-PC | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068

Error - 7/11/2012 6:54:46 PM | Computer Name = David-PC | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068

Error - 7/11/2012 6:54:46 PM | Computer Name = David-PC | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068

Error - 7/11/2012 6:54:46 PM | Computer Name = David-PC | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068

Error - 7/11/2012 6:54:46 PM | Computer Name = David-PC | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068


< End of report >
Post #2
Hi jcmondavi,

:welcome:

My name is NoodleTech. I would be glad to assist you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not delete anything unless instructed to.
  • DO NOT use tools such as ComboFix without supervision.
  • Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.
===================================================

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments,  attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
===================================================

Please download aswMBR.exe and save it to your desktop. 

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan
  • Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
  • Note - do NOT attempt any Fix yet.
  • You will also notice another file created on the desktop named MBR.dat.
  • Right click that file and select Send To>Compressed (zipped) file.
  • Attach that zipped file in your next reply as well.
Post #3
Thank you for your help. I am unable to run ASWMBR. Tried in Safe mode also. When clicked nothing happens. . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 Run by [removed] at 18:00:31 on 2012-07-16 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2933.1511 [GMT -4:00] . SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\WLANExt.exe C:\Windows\system32\conhost.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe C:\Windows\system32\msiexec.exe c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe C:\ProgramData\Rpcnet\Bin\rpcld.exe C:\WINDOWS\SysWOW64\rpcnet.exe C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Intel\WiFi\bin\EvtEng.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\System32\igfxtray.exe C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\DllHost.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\servicing\TrustedInstaller.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://www.google.com/ie uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll uURLSearchHooks: H - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL BHO: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll uRun: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices mRun: [Absolute Notifier] "C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe" mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray StartupFolder: C:\Users\David\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\EPSONA~1.LNK - D:\Common\EpsonReg\EPS2.exe mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 IE: Open with Nuance PDF Converter 7.0 - C:\Program Files (x86)\Nuance\PDF Converter 7\cnvres_eng.dll /100 IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105 IE: Send image to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBC} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{420EFB18-F474-410B-9B79-10B6600E7AFA} : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{DF54E6FA-92F1-42BF-86BB-D3383CE30E7F} : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{DF54E6FA-92F1-42BF-86BB-D3383CE30E7F}\E656477656162723230303 : DhcpNameServer = 10.0.0.1 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL Handler: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - C:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO-X64: SkypeIEPluginBHO - No File BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL BHO-X64: URLRedirectionBHO - No File BHO-X64: Avira SearchFree Toolbar plus Web Protection: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll BHO-X64: Ask Toolbar BHO - No File BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB-X64: Avira SearchFree Toolbar plus Web Protection: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll mRun-x64: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices mRun-x64: [Absolute Notifier] "C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe" mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray IE-X64: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\j7yrdded.default\ FF - prefs.js: browser.search.selectedEngine - Ask.com FF - prefs.js: browser.startup.homepage - hxxp://search.avira.com/?l=dis&o=APN10400&gct=hp&dc=US&locale=en_US FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10400&locale=en_US&apn_uid=c5429061-fddd-4a86-b530-467cfd274930&apn_ptnrs=^ABY&apn_sauid=78E696F2-06E4-4081-9CEA-B8742B99280D&apn_dtid=^YYYYYY^YY^US&&q= FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll FF - plugin: C:\Users\David\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Users\David\AppData\Roaming\Mozilla\plugins\NPShipRush_FedEx.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys –> C:\Windows\system32\Drivers\PxHlpa64.sys [?] R1 ElRawDisk;ElRawDisk;\??\C:\Windows\system32\drivers\ElRawDsk.sys –> C:\Windows\system32\drivers\ElRawDsk.sys [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-9-6 169408] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-4-4 63928] R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-7-12 913792] R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2011-5-24 98208] R2 FlipShareServer;FlipShare Server;C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe [2011-5-6 1085440] R2 ioloSystemService;iolo System Service;C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe [2012-4-22 1047336] R2 rpcld;Remote Procedure Call (RPC) LD;C:\ProgramData\Rpcnet\Bin\rpcld.exe –> C:\ProgramData\Rpcnet\Bin\rpcld.exe [?] R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-5-23 1692480] R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-5-23 2533400] R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys –> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?] R3 HECIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys –> C:\Windows\system32\DRIVERS\HECIx64.sys [?] R3 Impcd;Impcd;C:\Windows\system32\DRIVERS\Impcd.sys –> C:\Windows\system32\DRIVERS\Impcd.sys [?] R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys –> C:\Windows\system32\DRIVERS\IntcDAud.sys [?] R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys –> C:\Windows\system32\DRIVERS\L1C62x64.sys [?] R3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETw5s64.sys –> C:\Windows\system32\DRIVERS\NETw5s64.sys [?] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys –> C:\Windows\system32\DRIVERS\vwifimp.sys [?] R3 wdkmd;Intel WiDi KMD;C:\Windows\system32\DRIVERS\WDKMD.sys –> C:\Windows\system32\DRIVERS\WDKMD.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-7-14 655944] S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-3 250056] S3 btusbflt;Bluetooth USB Filter;C:\Windows\system32\drivers\btusbflt.sys –> C:\Windows\system32\drivers\btusbflt.sys [?] S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 31125880] S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-24 129976] S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-3-5 340240] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys –> C:\Windows\system32\Drivers\RtsUStor.sys [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S4 AbsoluteNotifier;Absolute Notifier;C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2011-5-10 10920] S4 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-8-25 13672] S4 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== File Associations =============== . JSEFile=NOTEPAD.EXE %1 . =============== Created Last 30 ================ . 2012-07-16 02:32:22 ——– d-sh–w- C:\$RECYCLE.BIN 2012-07-15 20:56:43 ——– d—–w- C:\ComboFix 2012-07-15 02:51:44 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-07-14 16:18:45 ——– d—–w- C:\ProgramData\Spybot - Search & Destroy 2012-07-14 02:53:51 9013136 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2012-07-14 02:53:47 9013136 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{26BF2FD7-1F52-4D5F-A03B-DCEDD722B647}\mpengine.dll 2012-07-12 06:46:26 24448 —-a-w- C:\Windows\System32\RegistryDefragBootTime.exe 2012-07-12 06:36:36 9013136 ——w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\mpengine.dll 2012-07-12 06:36:36 279656 ——w- C:\Windows\System32\MpSigStub.exe 2012-07-12 06:36:10 366592 —-a-w- C:\Windows\System32\qdvd.dll 2012-07-12 06:36:09 514560 —-a-w- C:\Windows\SysWow64\qdvd.dll 2012-07-12 06:22:25 ——– d—–w- C:\Users\David\AppData\Local\AskToolbar 2012-07-12 06:22:13 ——– d—–w- C:\Program Files (x86)\Ask.com 2012-07-12 06:21:57 ——– d—–w- C:\Users\David\AppData\Local\APN 2012-07-12 06:21:30 ——– d—–w- C:\ProgramData\Avira 2012-07-12 06:20:32 3148800 —-a-w- C:\Windows\System32\win32k.sys 2012-07-12 06:16:31 ——– d—–w- C:\ProgramData\IObit 2012-07-12 06:16:05 ——– d—–w- C:\Users\David\AppData\Roaming\IObit 2012-07-12 06:15:59 ——– d—–w- C:\Program Files (x86)\IObit 2012-07-12 06:01:58 ——– d—–w- C:\Windows\pss 2012-07-12 04:50:55 98816 —-a-w- C:\Windows\sed.exe 2012-07-12 04:50:55 518144 —-a-w- C:\Windows\SWREG.exe 2012-07-12 04:50:55 256000 —-a-w- C:\Windows\PEV.exe 2012-07-12 04:50:55 208896 —-a-w- C:\Windows\MBR.exe 2012-07-12 04:25:44 ——– d—–w- C:\Program Files (x86)\Avira 2012-07-07 08:10:20 ——– d—–w- C:\Users\David\AppData\Roaming\AnvSoft 2012-07-07 08:00:55 ——– d—–w- C:\Program Files (x86)\AnvSoft 2012-07-07 07:01:29 178688 —-a-w- C:\Windows\SysWow64\unrar.dll 2012-07-07 06:37:02 ——– d—–w- C:\Program Files (x86)\NCH Software 2012-07-07 06:36:58 ——– d—–w- C:\Users\David\AppData\Roaming\NCH Software 2012-07-07 06:31:55 ——– d—–w- C:\Users\David\AppData\Roaming\HandBrake 2012-07-07 06:24:19 ——– d—–w- C:\Users\David\AppData\Roaming\AVS4YOU 2012-07-07 06:14:45 11137024 —-a-w- C:\Windows\SysWow64\libmfxsw32.dll 2012-07-07 06:14:32 ——– d—–w- C:\Program Files (x86)\Common Files\AVSMedia 2012-07-07 06:14:20 ——– d—–w- C:\ProgramData\AVS4YOU 2012-07-07 06:14:20 ——– d—–w- C:\Program Files (x86)\AVS4YOU 2012-06-29 21:17:32 ——– d—–w- C:\Users\David\AppData\Roaming\Sony Creative Software Inc 2012-06-29 05:47:58 ——– d—–w- C:\Users\David\AppData\Local\Sony 2012-06-29 05:44:08 ——– d—–w- C:\Program Files (x86)\iZotope 2012-06-29 05:36:35 ——– d—–w- C:\Program Files (x86)\Sony 2012-06-29 04:56:06 ——– d—–w- C:\Users\David\My Backup Files 2012-06-29 03:21:20 ——– d—–w- C:\Users\David\AppData\Roaming\Flip Video 2012-06-29 03:20:14 ——– d—–w- C:\ProgramData\Flip Video 2012-06-29 03:20:08 ——– d—–w- C:\Program Files (x86)\Flip Video 2012-06-29 02:48:20 ——– d—–w- C:\Users\David\AppData\Local\Apple Computer 2012-06-29 02:48:14 34152 —-a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys 2012-06-29 02:48:14 126312 —-a-w- C:\Windows\System32\GEARAspi64.dll 2012-06-29 02:48:14 107368 —-a-w- C:\Windows\SysWow64\GEARAspi.dll 2012-06-29 02:46:50 ——– d–h–w- C:\Program Files\iPod 2012-06-29 02:46:49 ——– d–h–w- C:\Program Files\iTunes 2012-06-29 02:46:49 ——– d—–w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2012-06-29 02:46:49 ——– d—–w- C:\Program Files (x86)\iTunes 2012-06-29 02:44:51 ——– d–h–w- C:\Program Files\Bonjour 2012-06-29 02:44:51 ——– d—–w- C:\Program Files (x86)\Bonjour 2012-06-27 02:08:21 ——– d—–w- C:\Users\David\AppData\Local\Macromedia 2012-06-22 21:49:58 2622464 —-a-w- C:\Windows\System32\wucltux.dll 2012-06-22 21:49:38 99840 —-a-w- C:\Windows\System32\wudriver.dll 2012-06-22 21:49:28 36864 —-a-w- C:\Windows\System32\wuapp.exe 2012-06-22 21:49:28 186752 —-a-w- C:\Windows\System32\wuwebv.dll 2012-06-20 17:59:56 ——– d—–w- C:\Users\David\AppData\Local\Evernote 2012-06-20 17:59:31 ——– d—–w- C:\Program Files (x86)\Evernote 2012-06-19 02:52:07 ——– d—–w- C:\Users\David\AppData\Roaming\RealNetworks . ==================== Find3M ==================== . 2012-07-16 21:53:10 17920 —-a-w- C:\Windows\System32\rpcnetp.exe 2012-07-16 21:53:08 58288 —-a-w- C:\Windows\SysWow64\rpcnet.dll 2012-07-14 22:22:57 17920 —-a-w- C:\Windows\SysWow64\rpcnetp.dll 2012-07-14 22:21:35 17920 —-a-w- C:\Windows\SysWow64\rpcnetp.exe 2012-07-13 01:22:19 70344 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-13 01:22:19 426184 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-07-13 01:21:49 9822920 —-a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe 2012-07-12 23:30:58 13160 —-a-w- C:\Windows\SysWow64\Upgrd.exe 2012-07-12 23:30:54 58288 ——w- C:\Windows\SysWow64\rpcnet.exe 2012-06-06 06:06:16 2004480 —-a-w- C:\Windows\System32\msxml6.dll 2012-06-06 06:06:16 1881600 —-a-w- C:\Windows\System32\msxml3.dll 2012-06-06 06:02:54 1133568 —-a-w- C:\Windows\System32\cdosys.dll 2012-06-06 05:05:52 1390080 —-a-w- C:\Windows\SysWow64\msxml6.dll 2012-06-06 05:05:52 1236992 —-a-w- C:\Windows\SysWow64\msxml3.dll 2012-06-06 05:03:06 805376 —-a-w- C:\Windows\SysWow64\cdosys.dll 2012-06-04 17:42:57 49592 —-a-w- C:\Windows\SysWow64\pkgslv.exe 2012-06-04 17:42:56 46008 —-a-w- C:\Windows\SysWow64\pkgmgr.dll 2012-06-02 12:12:17 2311680 —-a-w- C:\Windows\System32\jscript9.dll 2012-06-02 12:05:28 1392128 —-a-w- C:\Windows\System32\wininet.dll 2012-06-02 12:04:50 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl 2012-06-02 12:01:40 173056 —-a-w- C:\Windows\System32\ieUnatt.exe 2012-06-02 11:57:08 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2012-06-02 08:33:25 1800192 —-a-w- C:\Windows\SysWow64\jscript9.dll 2012-06-02 08:25:08 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll 2012-06-02 08:25:03 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-06-02 08:20:33 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-06-02 08:16:52 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2012-06-02 05:50:10 458704 —-a-w- C:\Windows\System32\drivers\cng.sys 2012-06-02 05:48:16 95600 —-a-w- C:\Windows\System32\drivers\ksecdd.sys 2012-06-02 05:48:16 151920 —-a-w- C:\Windows\System32\drivers\ksecpkg.sys 2012-06-02 05:45:31 340992 —-a-w- C:\Windows\System32\schannel.dll 2012-06-02 05:44:21 307200 —-a-w- C:\Windows\System32\ncrypt.dll 2012-06-02 04:40:42 22016 —-a-w- C:\Windows\SysWow64\secur32.dll 2012-06-02 04:40:39 225280 —-a-w- C:\Windows\SysWow64\schannel.dll 2012-06-02 04:39:10 219136 —-a-w- C:\Windows\SysWow64\ncrypt.dll 2012-06-02 04:34:09 96768 —-a-w- C:\Windows\SysWow64\sspicli.dll 2012-05-18 23:22:54 499712 —-a-w- C:\Windows\SysWow64\msvcp71.dll 2012-05-18 23:22:54 348160 —-a-w- C:\Windows\SysWow64\msvcr71.dll 2012-05-04 11:06:22 5559664 —-a-w- C:\Windows\System32\ntoskrnl.exe 2012-05-04 10:03:53 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:03:50 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-05-01 05:40:20 209920 —-a-w- C:\Windows\System32\profsvc.dll 2012-04-28 03:55:21 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys 2012-04-26 05:41:56 77312 —-a-w- C:\Windows\System32\rdpwsx.dll 2012-04-26 05:41:55 149504 —-a-w- C:\Windows\System32\rdpcorekmts.dll 2012-04-26 05:34:27 9216 —-a-w- C:\Windows\System32\rdrmemptylst.exe 2012-04-25 16:11:36 52736 —-a-w- C:\Windows\System32\drivers\usbaapl64.sys 2012-04-25 16:11:36 4547944 —-a-w- C:\Windows\System32\usbaaplrc.dll 2012-04-24 05:37:37 184320 —-a-w- C:\Windows\System32\cryptsvc.dll 2012-04-24 05:37:37 140288 —-a-w- C:\Windows\System32\cryptnet.dll 2012-04-24 05:37:36 1462272 —-a-w- C:\Windows\System32\crypt32.dll 2012-04-24 04:36:42 140288 —-a-w- C:\Windows\SysWow64\cryptsvc.dll 2012-04-24 04:36:42 1158656 —-a-w- C:\Windows\SysWow64\crypt32.dll 2012-04-24 04:36:42 103936 —-a-w- C:\Windows\SysWow64\cryptnet.dll 2012-04-19 00:56:30 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx 2012-04-19 00:56:30 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts . ============= FINISH: 18:09:37.38 ===============

Attachments:

Post #4
I was able to get it to run. aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-07-17 19:13:13 —————————– 19:13:13.680 OS Version: Windows x64 6.1.7601 Service Pack 1 19:13:13.680 Number of processors: 2 586 0x2505 19:13:13.680 ComputerName: DAVID-PC UserName: David 19:13:17.736 Initialize success 19:14:21.119 AVAST engine defs: 12071701 19:14:31.821 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 19:14:31.821 Disk 0 Vendor: ST932032 D005 Size: 305245MB BusType: 3 19:14:31.837 Disk 0 MBR read successfully 19:14:31.837 Disk 0 MBR scan 19:14:31.868 Disk 0 Windows 7 default MBR code 19:14:31.883 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 101 MB offset 63 19:14:31.899 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 15000 MB offset 208896 19:14:31.930 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 290133 MB offset 30928896 19:14:31.961 Disk 0 scanning C:\Windows\system32\drivers 19:14:44.348 Service scanning 19:15:11.648 Modules scanning 19:15:11.648 Disk 0 trace - called modules: 19:15:11.663 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 19:15:11.663 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800324c3c0] 19:15:11.663 3 CLASSPNP.SYS[fffff88001ba043f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800309e050] 19:15:12.475 AVAST engine scan C:\Windows 19:15:14.924 AVAST engine scan C:\Windows\system32 19:15:18.730 File: C:\Windows\system32\autochk.exe **INFECTED** Win32:Malware-gen 19:18:58.035 AVAST engine scan C:\Windows\system32\drivers 19:19:13.760 AVAST engine scan C:\Users\David 19:26:15.289 AVAST engine scan C:\ProgramData 19:30:16.309 Scan finished successfully 19:44:46.962 Disk 0 MBR has been saved successfully to "C:\Users\David\Desktop\MBR.dat" 19:44:46.962 The log file has been saved successfully to "C:\Users\David\Desktop\aswMBR.txt"

Attachments:

Post #6
ComboFix 12-07-14.01 - David 07/15/2012 17:02:27.2.2 - x64Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2933.1479 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Spybot - Search and Destroy *Disabled/Updated* {1EAF1D03-5480-F3B2-EB14-11F0F5EE2699} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\PCDr\5907\Downloads\246b20c1-8ea9-4148-a34e-d03c8a1d5a76.dll c:\programdata\PCDr\5907\Downloads\27e5bc9a-105f-4d7f-8352-e6ef1c8933dd.dll c:\programdata\PCDr\5907\Downloads\a2192d8a-3d73-4ff7-be9b-02134f41db63.dll . . ((((((((((((((((((((((((( Files Created from 2012-06-16 to 2012-07-16 ))))))))))))))))))))))))))))))) . . 2012-07-16 00:16 . 2012-07-16 00:16 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-07-15 20:57 . 2012-07-15 20:57 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{26BF2FD7-1F52-4D5F-A03B-DCEDD722B647}\offreg.dll 2012-07-15 02:51 . 2012-07-15 02:51 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-07-14 16:18 . 2012-07-14 21:38 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2012-07-14 16:18 . 2012-07-15 20:56 ——– d—–w- c:\program files (x86)\Spybot - Search & Destroy 2 2012-07-14 02:53 . 2012-06-18 07:12 9013136 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{26BF2FD7-1F52-4D5F-A03B-DCEDD722B647}\mpengine.dll 2012-07-12 06:46 . 2012-05-24 14:47 24448 —-a-w- c:\windows\system32\RegistryDefragBootTime.exe 2012-07-12 06:36 . 2012-05-31 16:25 279656 ——w- c:\windows\system32\MpSigStub.exe 2012-07-12 06:36 . 2012-07-12 06:36 366592 —-a-w- c:\windows\system32\qdvd.dll 2012-07-12 06:36 . 2012-07-12 06:36 514560 —-a-w- c:\windows\SysWow64\qdvd.dll 2012-07-12 06:22 . 2012-07-12 06:22 ——– d—–w- c:\users\David\AppData\Local\AskToolbar 2012-07-12 06:22 . 2012-07-12 06:22 ——– d—–w- c:\program files (x86)\Ask.com 2012-07-12 06:21 . 2012-07-12 06:21 ——– d—–w- c:\users\David\AppData\Local\APN 2012-07-12 06:21 . 2012-07-15 20:54 ——– d—–w- c:\programdata\Avira 2012-07-12 06:20 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-12 06:16 . 2012-07-12 06:16 ——– d—–w- c:\programdata\IObit 2012-07-12 06:16 . 2012-07-15 00:00 ——– d—–w- c:\users\David\AppData\Roaming\IObit 2012-07-12 06:15 . 2012-07-12 06:15 ——– d—–w- c:\program files (x86)\IObit 2012-07-12 04:25 . 2012-07-12 06:21 ——– d—–w- c:\program files (x86)\Avira 2012-07-07 08:10 . 2012-07-07 08:10 ——– d—–w- c:\users\David\AppData\Roaming\AnvSoft 2012-07-07 08:00 . 2012-07-07 08:00 ——– d—–w- c:\program files (x86)\AnvSoft 2012-07-07 07:01 . 2012-06-09 17:21 178688 —-a-w- c:\windows\SysWow64\unrar.dll 2012-07-07 06:37 . 2012-07-14 13:24 ——– d—–w- c:\programdata\NCH Software 2012-07-07 06:37 . 2012-07-14 23:47 ——– d—–w- c:\program files (x86)\NCH Software 2012-07-07 06:36 . 2012-07-14 23:47 ——– d—–w- c:\users\David\AppData\Roaming\NCH Software 2012-07-07 06:31 . 2012-07-07 06:31 ——– d—–w- c:\users\David\AppData\Roaming\HandBrake 2012-07-07 06:24 . 2012-07-07 06:24 ——– d—–w- c:\users\David\AppData\Roaming\AVS4YOU 2012-07-07 06:14 . 2012-03-23 23:58 11137024 —-a-w- c:\windows\SysWow64\libmfxsw32.dll 2012-07-07 06:14 . 2012-07-15 00:14 ——– d—–w- c:\program files (x86)\Common Files\AVSMedia 2012-07-07 06:14 . 2012-07-15 00:13 ——– d—–w- c:\program files (x86)\AVS4YOU 2012-07-07 06:14 . 2012-07-07 06:24 ——– d—–w- c:\programdata\AVS4YOU 2012-06-29 21:17 . 2012-06-29 21:17 ——– d—–w- c:\users\David\AppData\Roaming\Sony Creative Software Inc 2012-06-29 20:56 . 2012-06-29 20:56 ——– d—–w- c:\users\David\AppData\Roaming\Publish Providers 2012-06-29 05:47 . 2012-06-29 21:15 ——– d—–w- c:\users\David\AppData\Local\Sony 2012-06-29 05:44 . 2012-06-29 05:44 ——– d—–w- c:\program files (x86)\iZotope 2012-06-29 05:36 . 2012-06-29 05:45 ——– d—–w- c:\programdata\Sony 2012-06-29 05:36 . 2012-06-29 05:44 ——– d—–w- c:\program files (x86)\Sony 2012-06-29 05:17 . 2012-07-07 07:15 ——– d—–w- c:\users\David\AppData\Roaming\Sony 2012-06-29 04:56 . 2012-06-29 04:56 ——– d—–w- c:\users\David\My Backup Files 2012-06-29 03:21 . 2012-06-29 03:21 ——– d—–w- c:\users\David\AppData\Roaming\Flip Video 2012-06-29 03:20 . 2012-06-29 03:20 ——– d—–w- c:\programdata\Flip Video 2012-06-29 03:20 . 2012-06-29 03:20 ——– d—–w- c:\program files (x86)\Flip Video 2012-06-29 02:48 . 2012-06-29 02:48 ——– d—–w- c:\users\David\AppData\Local\Apple Computer 2012-06-29 02:48 . 2012-06-29 02:48 ——– dc—-w- c:\windows\system32\DRVSTORE 2012-06-29 02:48 . 2009-05-18 17:17 34152 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-06-29 02:48 . 2008-04-17 16:12 126312 —-a-w- c:\windows\system32\GEARAspi64.dll 2012-06-29 02:48 . 2008-04-17 16:12 107368 —-a-w- c:\windows\SysWow64\GEARAspi.dll 2012-06-29 02:46 . 2012-06-29 02:46 ——– d–h–w- c:\program files\iPod 2012-06-29 02:46 . 2012-06-29 02:48 ——– d—–w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2012-06-29 02:46 . 2012-06-29 02:48 ——– d–h–w- c:\program files\iTunes 2012-06-29 02:46 . 2012-06-29 02:48 ——– d—–w- c:\program files (x86)\iTunes 2012-06-29 02:45 . 2012-06-29 02:45 ——– d–h–w- c:\program files\Common Files\Apple 2012-06-29 02:44 . 2012-06-29 02:44 ——– d–h–w- c:\program files\Bonjour 2012-06-29 02:44 . 2012-06-29 02:44 ——– d—–w- c:\program files (x86)\Bonjour 2012-06-27 02:08 . 2012-06-27 02:08 ——– d—–w- c:\users\David\AppData\Local\Macromedia 2012-06-22 21:49 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-22 21:49 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-22 21:49 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-22 21:49 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-22 21:49 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-22 21:49 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-22 21:49 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-22 21:49 . 2012-06-02 19:19 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-22 21:49 . 2012-06-02 19:15 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-20 17:59 . 2012-06-20 17:59 ——– d—–w- c:\users\David\AppData\Local\Evernote 2012-06-20 17:59 . 2012-06-20 17:59 ——– d—–w- c:\program files (x86)\Evernote 2012-06-19 02:52 . 2012-06-19 02:52 ——– d—–w- c:\users\David\AppData\Roaming\RealNetworks . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-16 00:09 . 2012-03-19 06:40 17920 —-a-w- c:\windows\system32\rpcnetp.exe 2012-07-15 20:12 . 2012-03-19 07:12 58288 —-a-w- c:\windows\SysWow64\rpcnet.dll 2012-07-14 22:22 . 2012-03-19 06:42 17920 —-a-w- c:\windows\SysWow64\rpcnetp.dll 2012-07-14 22:21 . 2012-03-19 06:40 17920 —-a-w- c:\windows\SysWow64\rpcnetp.exe 2012-07-13 01:22 . 2012-04-03 22:09 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-13 01:22 . 2012-03-20 23:57 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-13 01:21 . 2012-04-14 05:08 9822920 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-07-12 23:30 . 2012-03-19 07:11 13160 —-a-w- c:\windows\SysWow64\Upgrd.exe 2012-07-12 23:30 . 2012-03-19 07:12 58288 ——w- c:\windows\SysWow64\rpcnet.exe 2012-06-04 17:42 . 2010-08-20 19:22 49592 —-a-w- c:\windows\SysWow64\pkgslv.exe 2012-06-04 17:42 . 2010-08-20 19:22 46008 —-a-w- c:\windows\SysWow64\pkgmgr.dll 2012-05-18 23:22 . 2003-03-19 01:14 499712 —-a-w- c:\windows\SysWow64\msvcp71.dll 2012-05-18 23:22 . 2003-02-21 09:42 348160 —-a-w- c:\windows\SysWow64\msvcr71.dll 2012-05-04 11:06 . 2012-06-13 21:35 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 10:03 . 2012-06-13 21:35 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:03 . 2012-06-13 21:35 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-05-01 05:40 . 2012-06-13 21:35 209920 —-a-w- c:\windows\system32\profsvc.dll 2012-04-28 03:55 . 2012-06-13 21:35 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-04-26 05:41 . 2012-06-13 21:35 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-04-26 05:41 . 2012-06-13 21:35 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-04-26 05:34 . 2012-06-13 21:35 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-04-25 16:11 . 2012-04-25 16:11 52736 —-a-w- c:\windows\system32\drivers\usbaapl64.sys 2012-04-25 16:11 . 2012-04-25 16:11 4547944 —-a-w- c:\windows\system32\usbaaplrc.dll 2012-04-24 05:37 . 2012-06-13 21:35 184320 —-a-w- c:\windows\system32\cryptsvc.dll 2012-04-24 05:37 . 2012-06-13 21:35 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-04-24 05:37 . 2012-06-13 21:35 1462272 —-a-w- c:\windows\system32\crypt32.dll 2012-04-24 04:36 . 2012-06-13 21:35 1158656 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-04-24 04:36 . 2012-06-13 21:35 140288 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-04-24 04:36 . 2012-06-13 21:35 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll 2012-04-19 00:56 . 2012-04-19 00:56 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-04-19 00:56 . 2012-04-19 00:56 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts 2012-04-17 14:11 . 2012-04-07 03:51 49152 —-a-w- c:\windows\system32\iolobtdfg.exe 2012-04-17 14:11 . 2012-04-07 03:51 17920 —-a-w- c:\windows\system32\smrgdf.exe 2012-04-17 13:37 . 2012-04-07 03:51 2154032 —-a-w- c:\windows\system32\Incinerator64.dll 2012-04-17 13:37 . 2012-04-07 03:51 2095816 —-a-w- c:\windows\SysWow64\Incinerator32.dll 2012-04-17 12:25 . 2012-04-07 03:51 31432 —ha-w- c:\windows\system32\drivers\ElRawDsk.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-07-12_05.32.15 ))))))))))))))))))))))))))))))))))))))))) . + 2011-06-11 05:58 . 2011-06-11 05:58 51024 c:\windows\SysWOW64\vcomp100.dll - 2012-03-19 07:14 . 2011-11-17 05:28 96768 c:\windows\SysWOW64\sspicli.dll + 2012-07-11 05:05 . 2012-06-02 04:34 96768 c:\windows\SysWOW64\sspicli.dll - 2012-03-19 07:14 . 2011-11-17 05:34 22016 c:\windows\SysWOW64\secur32.dll + 2012-07-11 05:05 . 2012-06-02 04:40 22016 c:\windows\SysWOW64\secur32.dll - 2012-06-14 03:58 . 2012-05-17 22:25 73216 c:\windows\SysWOW64\mshtmled.dll + 2012-07-12 06:10 . 2012-06-02 08:17 73216 c:\windows\SysWOW64\mshtmled.dll - 2012-06-14 03:58 . 2012-05-17 22:31 66048 c:\windows\SysWOW64\migration\WininetPlugin.dll + 2012-07-12 06:10 . 2012-06-02 08:22 66048 c:\windows\SysWOW64\migration\WininetPlugin.dll + 2011-06-11 05:58 . 2011-06-11 05:58 81744 c:\windows\SysWOW64\mfcm100u.dll + 2011-06-11 05:58 . 2011-06-11 05:58 81744 c:\windows\SysWOW64\mfcm100.dll + 2011-06-11 05:58 . 2011-06-11 05:58 60752 c:\windows\SysWOW64\mfc100rus.dll + 2011-06-11 05:58 . 2011-06-11 05:58 43344 c:\windows\SysWOW64\mfc100kor.dll + 2011-06-11 05:58 . 2011-06-11 05:58 43856 c:\windows\SysWOW64\mfc100jpn.dll + 2011-06-11 05:58 . 2011-06-11 05:58 62288 c:\windows\SysWOW64\mfc100ita.dll + 2011-06-11 05:58 . 2011-06-11 05:58 64336 c:\windows\SysWOW64\mfc100fra.dll + 2011-06-11 05:58 . 2011-06-11 05:58 63824 c:\windows\SysWOW64\mfc100esn.dll + 2011-06-11 05:58 . 2011-06-11 05:58 55120 c:\windows\SysWOW64\mfc100enu.dll + 2011-06-11 05:58 . 2011-06-11 05:58 64336 c:\windows\SysWOW64\mfc100deu.dll + 2011-06-11 05:58 . 2011-06-11 05:58 36176 c:\windows\SysWOW64\mfc100cht.dll + 2011-06-11 05:58 . 2011-06-11 05:58 36176 c:\windows\SysWOW64\mfc100chs.dll + 2012-07-12 06:10 . 2012-06-02 08:21 65024 c:\windows\SysWOW64\jsproxy.dll - 2012-06-14 03:58 . 2012-05-17 22:31 65024 c:\windows\SysWOW64\jsproxy.dll + 2009-07-14 04:54 . 2012-07-15 20:12 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2012-07-12 03:42 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2012-07-12 03:42 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-07-15 20:12 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-07-12 03:42 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2012-07-15 20:12 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-05-24 02:55 . 2012-07-15 20:14 58178 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-07-15 20:14 40648 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2012-03-19 06:57 . 2012-07-14 13:15 14864 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1443603178-1069732724-762211521-1001_UserData.bin - 2012-06-14 03:58 . 2012-05-18 01:51 96768 c:\windows\system32\mshtmled.dll + 2012-07-12 06:10 . 2012-06-02 11:57 96768 c:\windows\system32\mshtmled.dll - 2012-06-14 03:58 . 2012-05-18 01:56 86528 c:\windows\system32\migration\WininetPlugin.dll + 2012-07-12 06:10 . 2012-06-02 12:03 86528 c:\windows\system32\migration\WininetPlugin.dll + 2012-07-12 06:10 . 2012-06-02 12:03 85504 c:\windows\system32\jsproxy.dll - 2012-06-14 03:58 . 2012-05-18 01:56 85504 c:\windows\system32\jsproxy.dll + 2012-07-11 05:05 . 2012-06-02 05:48 95600 c:\windows\system32\drivers\ksecdd.sys - 2012-03-19 07:14 . 2011-11-17 06:49 95600 c:\windows\system32\drivers\ksecdd.sys - 2012-03-19 06:41 . 2012-07-12 03:22 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2012-03-19 06:41 . 2012-07-15 05:03 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2012-03-19 06:41 . 2012-07-15 05:03 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2012-03-19 06:41 . 2012-07-12 03:22 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-07-15 05:03 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-07-12 03:22 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:46 . 2012-07-05 16:25 94000 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat + 2009-07-14 04:46 . 2012-07-12 23:20 94000 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat + 2012-03-19 06:45 . 2012-07-12 06:18 34144 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\oisicon.exe - 2012-03-19 06:45 . 2012-06-14 04:13 34144 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\oisicon.exe - 2012-03-19 06:45 . 2012-06-14 04:13 42848 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\msouc.exe + 2012-03-19 06:45 . 2012-07-12 06:18 42848 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\msouc.exe - 2012-03-19 06:45 . 2012-06-14 04:13 19296 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\cagicon.exe + 2012-03-19 06:45 . 2012-07-12 06:18 19296 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\cagicon.exe + 2011-02-04 17:40 . 2011-02-04 17:40 49488 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\VBAJET32.DLL + 2010-12-21 04:48 . 2010-12-21 04:48 44992 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACERCLR.DLL - 2009-07-14 00:19 . 2009-07-14 01:07 2048 c:\windows\SysWOW64\msxml3r.dll + 2012-07-11 05:05 . 2010-06-26 03:24 2048 c:\windows\SysWOW64\msxml3r.dll + 2012-07-11 05:05 . 2010-06-26 03:55 2048 c:\windows\system32\msxml3r.dll - 2009-07-14 00:41 . 2009-07-14 01:30 2048 c:\windows\system32\msxml3r.dll + 2012-07-15 20:12 . 2012-07-15 20:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-07-12 04:46 . 2012-07-12 04:46 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-07-15 20:12 . 2012-07-15 20:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-07-12 04:46 . 2012-07-12 04:46 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-07-12 06:10 . 2012-06-02 08:23 231936 c:\windows\SysWOW64\url.dll - 2012-06-14 03:58 . 2012-05-17 22:33 231936 c:\windows\SysWOW64\url.dll + 2012-07-11 05:05 . 2012-06-02 04:40 225280 c:\windows\SysWOW64\schannel.dll + 2012-07-11 05:05 . 2012-06-02 04:39 219136 c:\windows\SysWOW64\ncrypt.dll - 2009-07-13 23:33 . 2009-07-14 01:16 219136 c:\windows\SysWOW64\ncrypt.dll + 2011-06-11 05:58 . 2011-06-11 05:58 773968 c:\windows\SysWOW64\msvcr100.dll + 2011-06-11 05:58 . 2011-06-11 05:58 421200 c:\windows\SysWOW64\msvcp100.dll + 2012-07-13 01:22 . 2012-07-13 01:22 686280 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_265_Plugin.exe + 2012-07-12 06:08 . 2012-07-12 06:08 686280 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.exe + 2012-07-12 06:08 . 2012-07-12 06:08 465096 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.dll + 2012-04-03 22:09 . 2012-07-13 01:22 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe - 2012-04-03 22:09 . 2012-06-23 03:49 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe - 2012-06-14 03:58 . 2012-05-17 22:29 716800 c:\windows\SysWOW64\jscript.dll + 2012-07-12 06:10 . 2012-06-02 08:19 716800 c:\windows\SysWOW64\jscript.dll - 2012-06-14 03:58 . 2012-05-17 22:29 142848 c:\windows\SysWOW64\ieUnatt.exe + 2012-07-12 06:10 . 2012-06-02 08:20 142848 c:\windows\SysWOW64\ieUnatt.exe - 2012-06-14 03:58 . 2012-05-17 22:20 176640 c:\windows\SysWOW64\ieui.dll + 2012-07-12 06:10 . 2012-06-02 08:14 176640 c:\windows\SysWOW64\ieui.dll + 2012-07-14 22:23 . 2012-07-15 20:12 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2012-07-11 05:05 . 2012-06-06 05:03 805376 c:\windows\SysWOW64\cdosys.dll - 2012-03-21 13:55 . 2010-11-20 12:18 805376 c:\windows\SysWOW64\cdosys.dll + 2011-06-11 05:58 . 2011-06-11 05:58 138056 c:\windows\SysWOW64\atl100.dll + 2012-03-21 03:02 . 2012-07-16 00:09 271600 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin - 2012-06-14 03:58 . 2012-05-18 01:58 237056 c:\windows\system32\url.dll + 2012-07-12 06:10 . 2012-06-02 12:04 237056 c:\windows\system32\url.dll - 2012-03-19 07:14 . 2011-11-17 06:35 340992 c:\windows\system32\schannel.dll + 2012-07-11 05:05 . 2012-06-02 05:45 340992 c:\windows\system32\schannel.dll + 2009-07-14 02:36 . 2012-07-16 00:10 636084 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-07-12 03:26 636084 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-07-16 00:10 111626 c:\windows\system32\perfc009.dat - 2009-07-14 02:36 . 2012-07-12 03:26 111626 c:\windows\system32\perfc009.dat + 2012-07-11 05:05 . 2012-06-02 05:44 307200 c:\windows\system32\ncrypt.dll - 2009-07-13 23:49 . 2009-07-14 01:41 307200 c:\windows\system32\ncrypt.dll + 2012-07-13 01:21 . 2012-07-13 01:21 417992 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_265_Plugin.exe + 2012-07-12 06:08 . 2012-07-12 06:08 417992 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_265_ActiveX.exe + 2012-07-12 06:08 . 2012-07-12 06:08 512200 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_265_ActiveX.dll + 2012-07-12 06:10 . 2012-06-02 12:00 818688 c:\windows\system32\jscript.dll - 2012-06-14 03:58 . 2012-05-18 01:55 818688 c:\windows\system32\jscript.dll - 2012-06-14 03:58 . 2012-05-18 01:55 173056 c:\windows\system32\ieUnatt.exe + 2012-07-12 06:10 . 2012-06-02 12:01 173056 c:\windows\system32\ieUnatt.exe + 2012-07-12 06:10 . 2012-06-02 11:54 248320 c:\windows\system32\ieui.dll - 2012-06-14 03:58 . 2012-05-18 01:47 248320 c:\windows\system32\ieui.dll - 2009-07-14 04:45 . 2012-06-14 11:13 775448 c:\windows\system32\FNTCACHE.DAT + 2009-07-14 04:45 . 2012-07-12 06:57 775448 c:\windows\system32\FNTCACHE.DAT + 2012-07-11 05:05 . 2012-06-02 05:48 151920 c:\windows\system32\drivers\ksecpkg.sys + 2012-07-11 05:05 . 2012-06-02 05:50 458704 c:\windows\system32\drivers\cng.sys - 2012-07-04 06:37 . 2012-07-11 05:25 615216 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2012-07-04 06:37 . 2012-07-14 03:24 615216 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2009-07-14 05:01 . 2012-07-15 05:22 579776 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-07-10 20:41 579776 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-02-20 03:08 . 2011-02-20 03:08 163840 c:\windows\Installer\603e0.msi + 2012-03-19 06:45 . 2012-07-12 06:18 415584 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\pubs.exe - 2012-03-19 06:45 . 2012-06-14 04:13 415584 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\pubs.exe + 2012-03-19 06:45 . 2012-07-12 06:18 303456 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\outicon.exe - 2012-03-19 06:45 . 2012-06-14 04:13 303456 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\outicon.exe + 2012-03-19 06:45 . 2012-07-12 06:18 571232 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\misc.exe - 2012-03-19 06:45 . 2012-06-14 04:13 571232 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\misc.exe - 2012-03-19 06:45 . 2012-06-14 04:13 326496 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\joticon.exe + 2012-03-19 06:45 . 2012-07-12 06:18 326496 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\joticon.exe + 2012-03-19 06:45 . 2012-07-12 06:18 470616 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\inficon.exe + 2012-03-19 06:45 . 2012-07-12 06:18 178528 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\grvicons.exe - 2012-03-19 06:45 . 2012-06-14 04:13 178528 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\grvicons.exe + 2012-07-12 06:22 . 2012-07-12 06:22 102400 c:\windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\ARPPRODUCTICON.exe + 2011-02-05 03:52 . 2011-02-05 03:52 403320 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\OFFXML.DLL + 2010-10-20 20:06 . 2010-10-20 20:06 169352 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\IPOLK.DLL + 2011-02-04 17:40 . 2011-02-04 17:40 452936 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\EXPSRV.DLL + 2010-12-28 04:49 . 2010-12-28 04:49 362904 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACEXBE.DLL + 2010-12-28 04:49 . 2010-12-28 04:49 220560 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACETXT.DLL + 2010-12-28 04:49 . 2010-12-28 04:49 527776 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACEREP.DLL + 2010-12-21 04:48 . 2010-12-21 04:48 329624 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACER3X.DLL + 2010-12-28 04:49 . 2010-12-28 04:49 383904 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACEOLEDB.DLL + 2010-12-21 04:48 . 2010-12-21 04:48 278448 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACEODBC.DLL + 2010-12-28 04:49 . 2010-12-28 04:49 644504 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACEEXCL.DLL + 2010-12-28 04:49 . 2010-12-28 04:49 334752 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACEEXCH.DLL + 2010-12-28 04:49 . 2010-12-28 04:49 686504 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACEES.DLL + 2010-12-28 04:49 . 2010-12-28 04:49 548792 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACEDAO.DLL + 2010-12-28 04:49 . 2010-12-28 04:49 548792 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACACEDAO.DLL - 2012-06-14 03:58 . 2012-05-17 22:35 1129472 c:\windows\SysWOW64\wininet.dll + 2012-07-12 06:10 . 2012-06-02 08:25 1129472 c:\windows\SysWOW64\wininet.dll - 2012-06-14 03:58 . 2012-05-17 22:36 1103872 c:\windows\SysWOW64\urlmon.dll + 2012-07-12 06:10 . 2012-06-02 08:26 1103872 c:\windows\SysWOW64\urlmon.dll - 2012-03-21 13:58 . 2010-11-20 12:19 1390080 c:\windows\SysWOW64\msxml6.dll + 2012-07-11 05:05 . 2012-06-06 05:05 1390080 c:\windows\SysWOW64\msxml6.dll - 2012-03-21 13:58 . 2010-11-20 12:19 1236992 c:\windows\SysWOW64\msxml3.dll + 2012-07-11 05:05 . 2012-06-06 05:05 1236992 c:\windows\SysWOW64\msxml3.dll + 2011-06-11 05:58 . 2011-06-11 05:58 4422992 c:\windows\SysWOW64\mfc100u.dll + 2011-06-11 05:58 . 2011-06-11 05:58 4397384 c:\windows\SysWOW64\mfc100.dll + 2012-07-13 01:22 . 2012-07-13 01:22 9465032 c:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll + 2012-07-13 01:22 . 2012-07-13 01:22 1536712 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe - 2012-06-14 03:58 . 2012-05-17 22:45 1800192 c:\windows\SysWOW64\jscript9.dll + 2012-07-12 06:10 . 2012-06-02 08:33 1800192 c:\windows\SysWOW64\jscript9.dll + 2012-07-12 06:10 . 2012-06-02 08:19 1793024 c:\windows\SysWOW64\iertutil.dll - 2012-06-14 03:58 . 2012-05-17 22:27 1793024 c:\windows\SysWOW64\iertutil.dll - 2012-06-14 03:58 . 2012-05-17 22:48 9737728 c:\windows\SysWOW64\ieframe.dll + 2012-07-12 06:10 . 2012-06-02 08:43 9737728 c:\windows\SysWOW64\ieframe.dll + 2012-07-12 06:10 . 2012-06-02 12:05 1392128 c:\windows\system32\wininet.dll - 2012-06-14 03:58 . 2012-05-18 01:59 1392128 c:\windows\system32\wininet.dll + 2012-07-12 06:10 . 2012-06-02 12:05 1346048 c:\windows\system32\urlmon.dll - 2012-06-14 03:58 . 2012-05-18 01:59 1346048 c:\windows\system32\urlmon.dll + 2012-07-11 05:05 . 2012-06-06 06:06 2004480 c:\windows\system32\msxml6.dll - 2012-03-21 13:59 . 2010-11-20 13:27 2004480 c:\windows\system32\msxml6.dll + 2012-07-11 05:05 . 2012-06-06 06:06 1881600 c:\windows\system32\msxml3.dll - 2012-06-14 03:58 . 2012-05-18 02:06 2311680 c:\windows\system32\jscript9.dll + 2012-07-12 06:10 . 2012-06-02 12:12 2311680 c:\windows\system32\jscript9.dll - 2012-06-14 03:58 . 2012-05-18 01:54 2144768 c:\windows\system32\iertutil.dll + 2012-07-12 06:10 . 2012-06-02 11:59 2144768 c:\windows\system32\iertutil.dll - 2012-03-21 13:55 . 2010-11-20 13:25 1133568 c:\windows\system32\cdosys.dll + 2012-07-11 05:05 . 2012-06-06 06:02 1133568 c:\windows\system32\cdosys.dll + 2009-07-14 04:45 . 2012-07-12 07:00 7114300 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat - 2009-07-14 04:45 . 2012-06-29 20:44 7114300 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat + 2012-06-20 05:29 . 2012-06-20 05:29 5262848 c:\windows\Installer\603da.msp + 2012-06-20 06:00 . 2012-06-20 06:00 3461120 c:\windows\Installer\603c1.msp + 2012-04-05 05:56 . 2012-04-05 05:56 2820096 c:\windows\Installer\603ab.msp + 2012-04-05 05:54 . 2012-04-05 05:54 8301056 c:\windows\Installer\60395.msp + 2012-06-20 06:06 . 2012-06-20 06:06 1839104 c:\windows\Installer\6037d.msp + 2011-06-29 01:27 . 2011-06-29 01:27 4028928 c:\windows\Installer\1d53c1.msp + 2012-07-12 06:22 . 2012-07-12 06:22 3916800 c:\windows\Installer\11060e.msi + 2012-03-19 06:45 . 2012-07-12 06:18 1479520 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\xlicons.exe - 2012-03-19 06:45 . 2012-06-14 04:13 1479520 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\xlicons.exe + 2012-03-19 06:45 . 2012-07-12 06:18 1858400 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\wordicon.exe - 2012-03-19 06:45 . 2012-06-14 04:13 1858400 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\wordicon.exe - 2012-03-19 06:45 . 2012-06-14 04:13 3792736 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\pptico.exe + 2012-03-19 06:45 . 2012-07-12 06:18 3792736 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\pptico.exe + 2012-03-19 06:45 . 2012-07-12 06:18 1449312 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\accicons.exe - 2012-03-19 06:45 . 2012-06-14 04:13 1449312 c:\windows\Installer\{91140000-0011-0000-0000-0000000FF1CE}\accicons.exe + 2010-10-22 21:12 . 2010-10-22 21:12 5496688 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\IPEDITOR.DLL + 2011-01-13 00:33 . 2011-01-13 00:33 5867896 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\IPDESIGN.DLL + 2010-10-22 21:12 . 2010-10-22 21:12 1734000 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\INFOPATH.EXE + 2010-10-22 22:55 . 2010-10-22 22:55 3049376 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACEWDAT.DLL + 2011-03-11 21:46 . 2011-03-11 21:46 2194312 c:\windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\14.0.6029\ACECORE.DLL + 2012-07-11 05:05 . 2012-06-09 04:41 12873728 c:\windows\SysWOW64\shell32.dll + 2012-07-12 06:10 . 2012-06-02 09:07 12314624 c:\windows\SysWOW64\mshtml.dll - 2012-06-14 03:58 . 2012-05-17 23:11 12314624 c:\windows\SysWOW64\mshtml.dll + 2012-07-12 06:39 . 2012-07-14 22:21 10846208 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT + 2012-07-11 05:05 . 2012-06-09 05:43 14172672 c:\windows\system32\shell32.dll - 2012-03-19 07:14 . 2012-01-04 10:44 14172672 c:\windows\system32\shell32.dll - 2012-06-14 03:58 . 2012-05-18 02:47 17807360 c:\windows\system32\mshtml.dll + 2012-07-12 06:10 . 2012-06-02 12:49 17807360 c:\windows\system32\mshtml.dll + 2012-03-21 17:40 . 2012-07-12 06:12 59701280 c:\windows\system32\MRT.exe + 2012-07-13 01:21 . 2012-07-13 01:21 12314312 c:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll - 2012-06-14 03:58 . 2012-05-18 02:16 10924032 c:\windows\system32\ieframe.dll + 2012-07-12 06:10 . 2012-06-02 12:17 10924032 c:\windows\system32\ieframe.dll + 2012-03-20 03:30 . 2012-07-15 05:22 13016968 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1443603178-1069732724-762211521-1001-8192.dat - 2012-03-21 04:37 . 2012-07-10 20:41 31305628 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1443603178-1069732724-762211521-1001-12288.dat + 2012-03-21 04:37 . 2012-07-14 03:24 31305628 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1443603178-1069732724-762211521-1001-12288.dat . – Snapshot reset to current date – . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-20 1519824] . [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2012-06-20 17:18 1519824 —-a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-20 1519824] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "Absolute Notifier"="c:\program files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe" [2011-05-10 85672] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920] . c:\users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Epson all-in-one Registration.lnk - d:\common\EpsonReg\EPS2.exe [N/A] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ sdnclean64.exe . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944] R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] R2 rpcld;Remote Procedure Call (RPC) LD;c:\programdata\Rpcnet\Bin\rpcld.exe [x] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-13 250056] R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-03-31 53800] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-21 129976] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-03-05 340240] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-05-07 245792] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-19 1255736] R4 AbsoluteNotifier;Absolute Notifier;c:\program files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2011-05-10 10920] R4 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-08-25 13672] R4 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856] S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [2012-04-17 31432] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-06 169408] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928] S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208] S2 FlipShareServer;FlipShare Server;c:\program files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe [2011-05-06 1085440] S2 ioloSystemService;iolo System Service;c:\program files (x86)\iolo\Common\Lib\ioloServiceManager.exe [2012-04-17 1047336] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-07-01 2533400] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-08-12 175168] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344] S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 158976] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 287232] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2009-12-22 74280] S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-03-18 7680512] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920] S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [2010-06-18 39832] S4 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x] . . — Other Services/Drivers In Memory — . *Deregistered* - avipbb . Contents of the 'Scheduled Tasks' folder . 2012-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 01:22] . 2012-07-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1443603178-1069732724-762211521-1001Core.job - c:\users\David\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-05 01:34] . 2012-07-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1443603178-1069732724-762211521-1001UA.job - c:\users\David\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-05 01:34] . 2012-06-19 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11] . 2012-07-15 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-29 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-29 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-29 415256] "IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-03-05 1928976] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-29 497648] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://www.google.com/ie mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000 IE: Open with Nuance PDF Converter 7.0 - c:\program files (x86)\Nuance\PDF Converter 7\cnvres_eng.dll /100 IE: Se&nd to OneNote - c:\progra~2\MICROS~4\Office14\ONBttnIE.dll/105 IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\David\AppData\Roaming\Mozilla\Firefox\Profiles\j7yrdded.default\ FF - prefs.js: browser.search.selectedEngine - Ask.com FF - prefs.js: browser.startup.homepage - hxxp://search.avira.com/?l=dis&o=APN10400&gct=hp&dc=US&locale=en_US FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10400&locale=en_US&apn_uid=c5429061-fddd-4a86-b530-467cfd274930&apn_ptnrs=^ABY&apn_sauid=78E696F2-06E4-4081-9CEA-B8742B99280D&apn_dtid=^YYYYYY^YY^US&&q= . . ——- File Associations ——- . JSEFile=NOTEPAD.EXE %1 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-07-15 20:37:49 ComboFix-quarantined-files.txt 2012-07-16 00:37 ComboFix2.txt 2012-07-12 05:51 . Pre-Run: 232,537,255,936 bytes free Post-Run: 232,129,638,400 bytes free . - - End Of File - - 9F78B0CD81FE804D846C73932CF092C3
Post #7
Hi jcmondavi,

Please delete ComboFix from your desktop and follow the instructions below to download a new copy and run it.

Refer to the ComboFix User's Guide

  • Download ComboFix from one of these locations:

    Link 1
    Link 2

    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  • Double click on ComboFix.exe & follow the prompts.
  • Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  • When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    ———————————————————————————————
  • Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ———————————————————————————————

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
Post #8
ComboFix 12-07-16.01 - David 07/17/2012 21:30:59.3.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2933.1496 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-06-18 to 2012-07-18 ))))))))))))))))))))))))))))))) . . 2012-07-18 01:39 . 2012-07-18 01:39 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-07-18 01:08 . 2012-07-18 01:08 ——– d—–w- c:\program files (x86)\Spybot - Search & Destroy 2012-07-18 01:05 . 2012-07-18 01:05 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{95948B6E-DE72-4B8A-938E-F49639131618}\offreg.dll 2012-07-18 00:33 . 2012-07-03 16:21 25232 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys 2012-07-18 00:33 . 2012-07-03 16:21 355856 —-a-w- c:\windows\system32\drivers\aswSP.sys 2012-07-18 00:33 . 2012-07-03 16:21 54072 —-a-w- c:\windows\system32\drivers\aswRdr2.sys 2012-07-18 00:33 . 2012-07-03 16:21 958400 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2012-07-18 00:33 . 2012-07-03 16:21 59728 —-a-w- c:\windows\system32\drivers\aswTdi.sys 2012-07-18 00:33 . 2012-07-03 16:21 71064 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2012-07-18 00:33 . 2012-07-03 16:21 285328 —-a-w- c:\windows\system32\aswBoot.exe 2012-07-18 00:33 . 2012-07-03 16:21 41224 —-a-w- c:\windows\avastSS.scr 2012-07-18 00:33 . 2012-07-03 16:21 227648 —-a-w- c:\windows\SysWow64\aswBoot.exe 2012-07-18 00:33 . 2012-07-18 00:33 ——– d—–w- c:\programdata\AVAST Software 2012-07-18 00:33 . 2012-07-18 00:33 ——– d—–w- c:\program files\AVAST Software 2012-07-18 00:21 . 2012-07-18 00:21 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-07-18 00:21 . 2012-07-03 17:46 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-07-17 23:11 . 2012-07-18 00:24 ——– d—–w- C:\TDSSKiller_Quarantine 2012-07-17 19:37 . 2012-06-29 10:04 9133488 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{95948B6E-DE72-4B8A-938E-F49639131618}\mpengine.dll 2012-07-16 22:19 . 2012-07-16 22:19 ——– d—–w- c:\users\David\AppData\Roaming\HamsterSoft 2012-07-16 22:19 . 2012-07-16 22:19 ——– d—–w- c:\program files (x86)\Hamster Soft 2012-07-14 16:18 . 2012-07-18 01:29 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2012-07-12 06:46 . 2012-05-24 14:47 24448 —-a-w- c:\windows\system32\RegistryDefragBootTime.exe 2012-07-12 06:36 . 2012-05-31 16:25 279656 ——w- c:\windows\system32\MpSigStub.exe 2012-07-12 06:36 . 2012-07-12 06:36 366592 —-a-w- c:\windows\system32\qdvd.dll 2012-07-12 06:36 . 2012-07-12 06:36 514560 —-a-w- c:\windows\SysWow64\qdvd.dll 2012-07-12 06:22 . 2012-07-12 06:22 ——– d—–w- c:\users\David\AppData\Local\AskToolbar 2012-07-12 06:22 . 2012-07-12 06:22 ——– d—–w- c:\program files (x86)\Ask.com 2012-07-12 06:21 . 2012-07-12 06:21 ——– d—–w- c:\users\David\AppData\Local\APN 2012-07-12 06:21 . 2012-07-15 20:54 ——– d—–w- c:\programdata\Avira 2012-07-12 06:20 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-12 06:16 . 2012-07-12 06:16 ——– d—–w- c:\programdata\IObit 2012-07-12 06:16 . 2012-07-15 00:00 ——– d—–w- c:\users\David\AppData\Roaming\IObit 2012-07-12 06:15 . 2012-07-12 06:15 ——– d—–w- c:\program files (x86)\IObit 2012-07-12 04:25 . 2012-07-16 02:29 ——– d—–w- c:\program files (x86)\Avira 2012-07-07 08:10 . 2012-07-07 08:10 ——– d—–w- c:\users\David\AppData\Roaming\AnvSoft 2012-07-07 07:01 . 2012-06-09 17:21 178688 —-a-w- c:\windows\SysWow64\unrar.dll 2012-07-07 06:37 . 2012-07-14 13:24 ——– d—–w- c:\programdata\NCH Software 2012-07-07 06:37 . 2012-07-14 23:47 ——– d—–w- c:\program files (x86)\NCH Software 2012-07-07 06:36 . 2012-07-14 23:47 ——– d—–w- c:\users\David\AppData\Roaming\NCH Software 2012-07-07 06:31 . 2012-07-07 06:31 ——– d—–w- c:\users\David\AppData\Roaming\HandBrake 2012-07-07 06:24 . 2012-07-07 06:24 ——– d—–w- c:\users\David\AppData\Roaming\AVS4YOU 2012-07-07 06:14 . 2012-03-23 23:58 11137024 —-a-w- c:\windows\SysWow64\libmfxsw32.dll 2012-07-07 06:14 . 2012-07-15 00:14 ——– d—–w- c:\program files (x86)\Common Files\AVSMedia 2012-07-07 06:14 . 2012-07-15 00:13 ——– d—–w- c:\program files (x86)\AVS4YOU 2012-07-07 06:14 . 2012-07-07 06:24 ——– d—–w- c:\programdata\AVS4YOU 2012-06-29 21:17 . 2012-06-29 21:17 ——– d—–w- c:\users\David\AppData\Roaming\Sony Creative Software Inc 2012-06-29 20:56 . 2012-06-29 20:56 ——– d—–w- c:\users\David\AppData\Roaming\Publish Providers 2012-06-29 05:47 . 2012-06-29 21:15 ——– d—–w- c:\users\David\AppData\Local\Sony 2012-06-29 05:44 . 2012-06-29 05:44 ——– d—–w- c:\program files (x86)\iZotope 2012-06-29 05:36 . 2012-06-29 05:45 ——– d—–w- c:\programdata\Sony 2012-06-29 05:36 . 2012-06-29 05:44 ——– d—–w- c:\program files (x86)\Sony 2012-06-29 05:17 . 2012-07-07 07:15 ——– d—–w- c:\users\David\AppData\Roaming\Sony 2012-06-29 04:56 . 2012-06-29 04:56 ——– d—–w- c:\users\David\My Backup Files 2012-06-29 03:21 . 2012-06-29 03:21 ——– d—–w- c:\users\David\AppData\Roaming\Flip Video 2012-06-29 03:20 . 2012-06-29 03:20 ——– d—–w- c:\programdata\Flip Video 2012-06-29 03:20 . 2012-06-29 03:20 ——– d—–w- c:\program files (x86)\Flip Video 2012-06-29 02:48 . 2012-06-29 02:48 ——– d—–w- c:\users\David\AppData\Local\Apple Computer 2012-06-29 02:48 . 2012-06-29 02:48 ——– dc—-w- c:\windows\system32\DRVSTORE 2012-06-29 02:48 . 2009-05-18 17:17 34152 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-06-29 02:48 . 2008-04-17 16:12 126312 —-a-w- c:\windows\system32\GEARAspi64.dll 2012-06-29 02:48 . 2008-04-17 16:12 107368 —-a-w- c:\windows\SysWow64\GEARAspi.dll 2012-06-29 02:46 . 2012-06-29 02:46 ——– d–h–w- c:\program files\iPod 2012-06-29 02:46 . 2012-06-29 02:48 ——– d—–w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2012-06-29 02:46 . 2012-06-29 02:48 ——– d–h–w- c:\program files\iTunes 2012-06-29 02:46 . 2012-06-29 02:48 ——– d—–w- c:\program files (x86)\iTunes 2012-06-29 02:45 . 2012-06-29 02:45 ——– d–h–w- c:\program files\Common Files\Apple 2012-06-29 02:44 . 2012-06-29 02:44 ——– d–h–w- c:\program files\Bonjour 2012-06-29 02:44 . 2012-06-29 02:44 ——– d—–w- c:\program files (x86)\Bonjour 2012-06-27 02:08 . 2012-06-27 02:08 ——– d—–w- c:\users\David\AppData\Local\Macromedia 2012-06-22 21:49 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-22 21:49 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-22 21:49 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-22 21:49 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-22 21:49 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-22 21:49 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-22 21:49 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-22 21:49 . 2012-06-02 19:19 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-22 21:49 . 2012-06-02 19:15 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-20 17:59 . 2012-06-20 17:59 ——– d—–w- c:\users\David\AppData\Local\Evernote 2012-06-20 17:59 . 2012-06-20 17:59 ——– d—–w- c:\program files (x86)\Evernote 2012-06-19 02:52 . 2012-06-19 02:52 ——– d—–w- c:\users\David\AppData\Roaming\RealNetworks . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-18 00:49 . 2012-03-19 06:40 17920 —-a-w- c:\windows\system32\rpcnetp.exe 2012-07-18 00:49 . 2012-03-19 07:12 58288 —-a-w- c:\windows\SysWow64\rpcnet.dll 2012-07-14 22:22 . 2012-03-19 06:42 17920 —-a-w- c:\windows\SysWow64\rpcnetp.dll 2012-07-14 22:21 . 2012-03-19 06:40 17920 —-a-w- c:\windows\SysWow64\rpcnetp.exe 2012-07-13 01:22 . 2012-04-03 22:09 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-13 01:22 . 2012-03-20 23:57 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-13 01:21 . 2012-04-14 05:08 9822920 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-07-12 23:30 . 2012-03-19 07:11 13160 —-a-w- c:\windows\SysWow64\Upgrd.exe 2012-07-12 23:30 . 2012-03-19 07:12 58288 ——w- c:\windows\SysWow64\rpcnet.exe 2012-06-04 17:42 . 2010-08-20 19:22 49592 —-a-w- c:\windows\SysWow64\pkgslv.exe 2012-06-04 17:42 . 2010-08-20 19:22 46008 —-a-w- c:\windows\SysWow64\pkgmgr.dll 2012-05-18 23:22 . 2003-03-19 01:14 499712 —-a-w- c:\windows\SysWow64\msvcp71.dll 2012-05-18 23:22 . 2003-02-21 09:42 348160 —-a-w- c:\windows\SysWow64\msvcr71.dll 2012-05-04 11:06 . 2012-06-13 21:35 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 10:03 . 2012-06-13 21:35 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:03 . 2012-06-13 21:35 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-05-01 05:40 . 2012-06-13 21:35 209920 —-a-w- c:\windows\system32\profsvc.dll 2012-04-28 03:55 . 2012-06-13 21:35 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-04-26 05:41 . 2012-06-13 21:35 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-04-26 05:41 . 2012-06-13 21:35 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-04-26 05:34 . 2012-06-13 21:35 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-04-25 16:11 . 2012-04-25 16:11 52736 —-a-w- c:\windows\system32\drivers\usbaapl64.sys 2012-04-25 16:11 . 2012-04-25 16:11 4547944 —-a-w- c:\windows\system32\usbaaplrc.dll 2012-04-24 05:37 . 2012-06-13 21:35 184320 —-a-w- c:\windows\system32\cryptsvc.dll 2012-04-24 05:37 . 2012-06-13 21:35 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-04-24 05:37 . 2012-06-13 21:35 1462272 —-a-w- c:\windows\system32\crypt32.dll 2012-04-24 04:36 . 2012-06-13 21:35 1158656 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-04-24 04:36 . 2012-06-13 21:35 140288 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-04-24 04:36 . 2012-06-13 21:35 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll . . ((((((((((((((((((((((((((((( SnapShot_2012-07-16_00.18.47 ))))))))))))))))))))))))))))))))))))))))) . - 2009-07-14 04:54 . 2012-07-15 20:12 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-07-18 00:59 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2012-07-15 20:12 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-07-18 00:59 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-07-15 20:12 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2012-07-18 00:59 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-05-24 02:55 . 2012-07-18 00:51 59212 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-07-18 00:51 40902 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2012-03-19 06:57 . 2012-07-18 00:51 15714 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1443603178-1069732724-762211521-1001_UserData.bin - 2012-03-19 06:41 . 2012-07-15 05:03 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2012-03-19 06:41 . 2012-07-17 00:22 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2012-03-19 06:41 . 2012-07-15 05:03 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2012-03-19 06:41 . 2012-07-17 00:22 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-07-15 05:03 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2012-07-17 00:22 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:46 . 2012-07-18 00:52 91680 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat - 2012-07-15 20:12 . 2012-07-15 20:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-07-18 00:48 . 2012-07-18 00:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-07-15 20:12 . 2012-07-15 20:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-07-18 00:48 . 2012-07-18 00:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-07-14 22:23 . 2012-07-15 20:12 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2012-07-14 22:23 . 2012-07-18 00:58 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2012-03-21 03:02 . 2012-07-17 22:29 273194 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-07-14 02:36 . 2012-07-17 19:26 636084 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-07-16 00:10 636084 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-07-16 00:10 111626 c:\windows\system32\perfc009.dat + 2009-07-14 02:36 . 2012-07-17 19:26 111626 c:\windows\system32\perfc009.dat - 2012-07-04 06:37 . 2012-07-14 03:24 615216 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2012-07-04 06:37 . 2012-07-17 23:01 615216 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2009-07-14 05:01 . 2012-07-17 23:01 579776 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-07-15 05:22 579776 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 04:45 . 2012-07-12 07:00 7114300 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat + 2009-07-14 04:45 . 2012-07-18 00:52 7114300 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat + 2012-03-20 03:30 . 2012-07-17 23:01 13655184 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1443603178-1069732724-762211521-1001-8192.dat - 2012-03-21 04:37 . 2012-07-14 03:24 31305628 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1443603178-1069732724-762211521-1001-12288.dat + 2012-03-21 04:37 . 2012-07-17 23:01 31305628 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1443603178-1069732724-762211521-1001-12288.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-20 1519824] . [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2012-06-20 17:18 1519824 —-a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-20 1519824] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920] . c:\users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Epson all-in-one Registration.lnk - d:\common\EpsonReg\EPS2.exe [N/A] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ sdnclean64.exe . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-13 250056] R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-03-31 53800] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-03-05 340240] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R4 AbsoluteNotifier;Absolute Notifier;c:\program files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2011-05-10 10920] R4 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-08-25 13672] R4 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [2012-04-17 31432] S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-06 169408] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-07-03 71064] S2 FlipShareServer;FlipShare Server;c:\program files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe [2011-05-06 1085440] S2 ioloSystemService;iolo System Service;c:\program files (x86)\iolo\Common\Lib\ioloServiceManager.exe [2012-04-17 1047336] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-08-12 175168] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344] S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 158976] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 287232] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2009-12-22 74280] S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-03-18 7680512] . . — Other Services/Drivers In Memory — . *NewlyCreated* - ASWFSBLK *NewlyCreated* - ASWMONFLT *NewlyCreated* - ASWRDR *NewlyCreated* - ASWSNX *NewlyCreated* - ASWSP *NewlyCreated* - ASWTDI *NewlyCreated* - MBAMPROTECTOR . Contents of the 'Scheduled Tasks' folder . 2012-07-18 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 01:22] . 2012-07-18 c:\windows\Tasks\avast! Emergency Update.job - c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-18 16:21] . 2012-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1443603178-1069732724-762211521-1001Core.job - c:\users\David\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-05 01:34] . 2012-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1443603178-1069732724-762211521-1001UA.job - c:\users\David\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-05 01:34] . 2012-07-18 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11] . 2012-07-18 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2012-07-03 16:21 133400 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-29 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-29 386584] "IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-03-05 1928976] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://www.google.com/ie mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~2\MICROS~4\Office14\ONBttnIE.dll/105 IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 10.0.0.1 . . ——- File Associations ——- . JSEFile=NOTEPAD.EXE %1 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-07-17 21:42:34 ComboFix-quarantined-files.txt 2012-07-18 01:42 ComboFix2.txt 2012-07-16 00:38 ComboFix3.txt 2012-07-12 05:51 . Pre-Run: 230,729,072,640 bytes free Post-Run: 230,501,425,152 bytes free . - - End Of File - - E629B49BEFDEE993B2BF2F2C29CC198D
Post #9 last edited
Hi jcmondavi,

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

File::
C:\Windows\system32\autochk.exe
Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe


Then post the results log using Copy / Paste
Post #10
ComboFix 12-07-16.01 - David 07/18/2012 18:46:30.5.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2933.1212 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\David\Desktop\CFScript.txt AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-06-18 to 2012-07-18 ))))))))))))))))))))))))))))))) . . 2012-07-18 22:55 . 2012-07-18 22:55 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-07-18 03:21 . 2012-07-18 13:01 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{95948B6E-DE72-4B8A-938E-F49639131618}\offreg.dll 2012-07-18 01:08 . 2012-07-18 01:57 ——– d—–w- c:\program files (x86)\Spybot - Search & Destroy 2012-07-18 00:33 . 2012-07-03 16:21 25232 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys 2012-07-18 00:33 . 2012-07-03 16:21 355856 —-a-w- c:\windows\system32\drivers\aswSP.sys 2012-07-18 00:33 . 2012-07-03 16:21 54072 —-a-w- c:\windows\system32\drivers\aswRdr2.sys 2012-07-18 00:33 . 2012-07-03 16:21 958400 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2012-07-18 00:33 . 2012-07-03 16:21 59728 —-a-w- c:\windows\system32\drivers\aswTdi.sys 2012-07-18 00:33 . 2012-07-03 16:21 71064 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2012-07-18 00:33 . 2012-07-03 16:21 285328 —-a-w- c:\windows\system32\aswBoot.exe 2012-07-18 00:33 . 2012-07-03 16:21 41224 —-a-w- c:\windows\avastSS.scr 2012-07-18 00:33 . 2012-07-03 16:21 227648 —-a-w- c:\windows\SysWow64\aswBoot.exe 2012-07-18 00:33 . 2012-07-18 00:33 ——– d—–w- c:\programdata\AVAST Software 2012-07-18 00:33 . 2012-07-18 00:33 ——– d—–w- c:\program files\AVAST Software 2012-07-18 00:21 . 2012-07-18 00:21 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-07-18 00:21 . 2012-07-03 17:46 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-07-17 23:11 . 2012-07-18 00:24 ——– d—–w- C:\TDSSKiller_Quarantine 2012-07-17 19:37 . 2012-06-29 10:04 9133488 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{95948B6E-DE72-4B8A-938E-F49639131618}\mpengine.dll 2012-07-16 22:19 . 2012-07-16 22:19 ——– d—–w- c:\users\David\AppData\Roaming\HamsterSoft 2012-07-16 22:19 . 2012-07-16 22:19 ——– d—–w- c:\program files (x86)\Hamster Soft 2012-07-14 16:18 . 2012-07-18 12:30 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2012-07-12 06:46 . 2012-05-24 14:47 24448 —-a-w- c:\windows\system32\RegistryDefragBootTime.exe 2012-07-12 06:36 . 2012-05-31 16:25 279656 ——w- c:\windows\system32\MpSigStub.exe 2012-07-12 06:36 . 2012-07-12 06:36 366592 —-a-w- c:\windows\system32\qdvd.dll 2012-07-12 06:36 . 2012-07-12 06:36 514560 —-a-w- c:\windows\SysWow64\qdvd.dll 2012-07-12 06:22 . 2012-07-12 06:22 ——– d—–w- c:\users\David\AppData\Local\AskToolbar 2012-07-12 06:22 . 2012-07-12 06:22 ——– d—–w- c:\program files (x86)\Ask.com 2012-07-12 06:21 . 2012-07-12 06:21 ——– d—–w- c:\users\David\AppData\Local\APN 2012-07-12 06:21 . 2012-07-15 20:54 ——– d—–w- c:\programdata\Avira 2012-07-12 06:20 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-12 06:16 . 2012-07-12 06:16 ——– d—–w- c:\programdata\IObit 2012-07-12 06:16 . 2012-07-15 00:00 ——– d—–w- c:\users\David\AppData\Roaming\IObit 2012-07-12 06:15 . 2012-07-12 06:15 ——– d—–w- c:\program files (x86)\IObit 2012-07-12 04:25 . 2012-07-16 02:29 ——– d—–w- c:\program files (x86)\Avira 2012-07-07 08:10 . 2012-07-07 08:10 ——– d—–w- c:\users\David\AppData\Roaming\AnvSoft 2012-07-07 07:01 . 2012-06-09 17:21 178688 —-a-w- c:\windows\SysWow64\unrar.dll 2012-07-07 06:37 . 2012-07-14 13:24 ——– d—–w- c:\programdata\NCH Software 2012-07-07 06:37 . 2012-07-14 23:47 ——– d—–w- c:\program files (x86)\NCH Software 2012-07-07 06:36 . 2012-07-14 23:47 ——– d—–w- c:\users\David\AppData\Roaming\NCH Software 2012-07-07 06:31 . 2012-07-07 06:31 ——– d—–w- c:\users\David\AppData\Roaming\HandBrake 2012-07-07 06:24 . 2012-07-07 06:24 ——– d—–w- c:\users\David\AppData\Roaming\AVS4YOU 2012-07-07 06:14 . 2012-03-23 23:58 11137024 —-a-w- c:\windows\SysWow64\libmfxsw32.dll 2012-07-07 06:14 . 2012-07-15 00:14 ——– d—–w- c:\program files (x86)\Common Files\AVSMedia 2012-07-07 06:14 . 2012-07-15 00:13 ——– d—–w- c:\program files (x86)\AVS4YOU 2012-07-07 06:14 . 2012-07-07 06:24 ——– d—–w- c:\programdata\AVS4YOU 2012-06-29 21:17 . 2012-06-29 21:17 ——– d—–w- c:\users\David\AppData\Roaming\Sony Creative Software Inc 2012-06-29 20:56 . 2012-06-29 20:56 ——– d—–w- c:\users\David\AppData\Roaming\Publish Providers 2012-06-29 05:47 . 2012-06-29 21:15 ——– d—–w- c:\users\David\AppData\Local\Sony 2012-06-29 05:44 . 2012-06-29 05:44 ——– d—–w- c:\program files (x86)\iZotope 2012-06-29 05:36 . 2012-06-29 05:45 ——– d—–w- c:\programdata\Sony 2012-06-29 05:36 . 2012-06-29 05:44 ——– d—–w- c:\program files (x86)\Sony 2012-06-29 05:17 . 2012-07-07 07:15 ——– d—–w- c:\users\David\AppData\Roaming\Sony 2012-06-29 04:56 . 2012-06-29 04:56 ——– d—–w- c:\users\David\My Backup Files 2012-06-29 03:21 . 2012-06-29 03:21 ——– d—–w- c:\users\David\AppData\Roaming\Flip Video 2012-06-29 03:20 . 2012-06-29 03:20 ——– d—–w- c:\programdata\Flip Video 2012-06-29 03:20 . 2012-06-29 03:20 ——– d—–w- c:\program files (x86)\Flip Video 2012-06-29 02:48 . 2012-06-29 02:48 ——– d—–w- c:\users\David\AppData\Local\Apple Computer 2012-06-29 02:48 . 2012-06-29 02:48 ——– dc—-w- c:\windows\system32\DRVSTORE 2012-06-29 02:48 . 2009-05-18 17:17 34152 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-06-29 02:48 . 2008-04-17 16:12 126312 —-a-w- c:\windows\system32\GEARAspi64.dll 2012-06-29 02:48 . 2008-04-17 16:12 107368 —-a-w- c:\windows\SysWow64\GEARAspi.dll 2012-06-29 02:46 . 2012-06-29 02:46 ——– d–h–w- c:\program files\iPod 2012-06-29 02:46 . 2012-06-29 02:48 ——– d—–w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2012-06-29 02:46 . 2012-06-29 02:48 ——– d–h–w- c:\program files\iTunes 2012-06-29 02:46 . 2012-06-29 02:48 ——– d—–w- c:\program files (x86)\iTunes 2012-06-29 02:45 . 2012-06-29 02:45 ——– d–h–w- c:\program files\Common Files\Apple 2012-06-29 02:44 . 2012-06-29 02:44 ——– d–h–w- c:\program files\Bonjour 2012-06-29 02:44 . 2012-06-29 02:44 ——– d—–w- c:\program files (x86)\Bonjour 2012-06-27 02:08 . 2012-06-27 02:08 ——– d—–w- c:\users\David\AppData\Local\Macromedia 2012-06-22 21:49 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-22 21:49 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-22 21:49 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-22 21:49 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-22 21:49 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-22 21:49 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-22 21:49 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-22 21:49 . 2012-06-02 19:19 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-22 21:49 . 2012-06-02 19:15 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-20 17:59 . 2012-06-20 17:59 ——– d—–w- c:\users\David\AppData\Local\Evernote 2012-06-20 17:59 . 2012-06-20 17:59 ——– d—–w- c:\program files (x86)\Evernote 2012-06-19 02:52 . 2012-06-19 02:52 ——– d—–w- c:\users\David\AppData\Roaming\RealNetworks . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-18 22:22 . 2012-03-19 06:40 17920 —-a-w- c:\windows\system32\rpcnetp.exe 2012-07-18 12:05 . 2012-03-19 07:12 58288 —-a-w- c:\windows\SysWow64\rpcnet.dll 2012-07-14 22:22 . 2012-03-19 06:42 17920 —-a-w- c:\windows\SysWow64\rpcnetp.dll 2012-07-14 22:21 . 2012-03-19 06:40 17920 —-a-w- c:\windows\SysWow64\rpcnetp.exe 2012-07-13 01:22 . 2012-04-03 22:09 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-13 01:22 . 2012-03-20 23:57 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-13 01:21 . 2012-04-14 05:08 9822920 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-07-12 23:30 . 2012-03-19 07:11 13160 —-a-w- c:\windows\SysWow64\Upgrd.exe 2012-07-12 23:30 . 2012-03-19 07:12 58288 ——w- c:\windows\SysWow64\rpcnet.exe 2012-06-04 17:42 . 2010-08-20 19:22 49592 —-a-w- c:\windows\SysWow64\pkgslv.exe 2012-06-04 17:42 . 2010-08-20 19:22 46008 —-a-w- c:\windows\SysWow64\pkgmgr.dll 2012-05-18 23:22 . 2003-03-19 01:14 499712 —-a-w- c:\windows\SysWow64\msvcp71.dll 2012-05-18 23:22 . 2003-02-21 09:42 348160 —-a-w- c:\windows\SysWow64\msvcr71.dll 2012-05-04 11:06 . 2012-06-13 21:35 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 10:03 . 2012-06-13 21:35 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:03 . 2012-06-13 21:35 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-05-01 05:40 . 2012-06-13 21:35 209920 —-a-w- c:\windows\system32\profsvc.dll 2012-04-28 03:55 . 2012-06-13 21:35 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-04-26 05:41 . 2012-06-13 21:35 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-04-26 05:41 . 2012-06-13 21:35 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-04-26 05:34 . 2012-06-13 21:35 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-04-25 16:11 . 2012-04-25 16:11 52736 —-a-w- c:\windows\system32\drivers\usbaapl64.sys 2012-04-25 16:11 . 2012-04-25 16:11 4547944 —-a-w- c:\windows\system32\usbaaplrc.dll 2012-04-24 05:37 . 2012-06-13 21:35 184320 —-a-w- c:\windows\system32\cryptsvc.dll 2012-04-24 05:37 . 2012-06-13 21:35 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-04-24 05:37 . 2012-06-13 21:35 1462272 —-a-w- c:\windows\system32\crypt32.dll 2012-04-24 04:36 . 2012-06-13 21:35 1158656 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-04-24 04:36 . 2012-06-13 21:35 140288 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-04-24 04:36 . 2012-06-13 21:35 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll . . ((((((((((((((((((((((((((((( SnapShot_2012-07-16_00.18.47 ))))))))))))))))))))))))))))))))))))))))) . - 2009-07-14 04:54 . 2012-07-15 20:12 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-07-18 22:22 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2012-07-15 20:12 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-07-18 22:22 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-07-15 20:12 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2012-07-18 22:22 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-05-24 02:55 . 2012-07-18 01:53 59534 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-07-18 12:23 41030 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2012-03-19 06:57 . 2012-07-18 12:23 16090 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1443603178-1069732724-762211521-1001_UserData.bin - 2012-03-19 06:41 . 2012-07-15 05:03 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2012-03-19 06:41 . 2012-07-18 12:28 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2012-03-19 06:41 . 2012-07-15 05:03 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2012-03-19 06:41 . 2012-07-18 12:28 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-07-15 05:03 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2012-07-18 12:28 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:46 . 2012-07-18 01:58 91888 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat - 2012-07-15 20:12 . 2012-07-15 20:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-07-18 12:05 . 2012-07-18 12:05 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-07-15 20:12 . 2012-07-15 20:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-07-18 12:05 . 2012-07-18 12:05 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-07-14 22:23 . 2012-07-15 20:12 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2012-07-14 22:23 . 2012-07-18 12:23 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2012-03-21 03:02 . 2012-07-18 22:22 275592 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-07-14 02:36 . 2012-07-18 22:24 636084 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-07-16 00:10 636084 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-07-16 00:10 111626 c:\windows\system32\perfc009.dat + 2009-07-14 02:36 . 2012-07-18 22:24 111626 c:\windows\system32\perfc009.dat - 2012-07-04 06:37 . 2012-07-14 03:24 615216 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2012-07-04 06:37 . 2012-07-17 23:01 615216 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2009-07-14 05:01 . 2012-07-18 05:38 579776 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-07-15 05:22 579776 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 04:45 . 2012-07-12 07:00 7114300 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat + 2009-07-14 04:45 . 2012-07-18 00:52 7114300 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat + 2012-03-20 03:30 . 2012-07-18 05:38 14949082 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1443603178-1069732724-762211521-1001-8192.dat - 2012-03-21 04:37 . 2012-07-14 03:24 31305628 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1443603178-1069732724-762211521-1001-12288.dat + 2012-03-21 04:37 . 2012-07-17 23:01 31305628 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1443603178-1069732724-762211521-1001-12288.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-20 1519824] . [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] 2012-06-20 17:18 1519824 —-a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-20 1519824] . [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920] . c:\users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Epson all-in-one Registration.lnk - d:\common\EpsonReg\EPS2.exe [N/A] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist] [BU] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui] [BU] . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ sdnclean64.exe . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-13 250056] R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-03-31 53800] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-03-05 340240] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-05-07 245792] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-19 1255736] R4 AbsoluteNotifier;Absolute Notifier;c:\program files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2011-05-10 10920] R4 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-08-25 13672] R4 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [2012-04-17 31432] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-06 169408] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-07-03 71064] S2 FlipShareServer;FlipShare Server;c:\program files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe [2011-05-06 1085440] S2 ioloSystemService;iolo System Service;c:\program files (x86)\iolo\Common\Lib\ioloServiceManager.exe [2012-04-17 1047336] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944] S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-07-01 2533400] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-08-12 175168] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344] S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 158976] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 287232] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2009-12-22 74280] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904] S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-03-18 7680512] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920] S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [2010-06-18 39832] . . Contents of the 'Scheduled Tasks' folder . 2012-07-18 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 01:22] . 2012-07-18 c:\windows\Tasks\avast! Emergency Update.job - c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-18 16:21] . 2012-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1443603178-1069732724-762211521-1001Core.job - c:\users\David\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-05 01:34] . 2012-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1443603178-1069732724-762211521-1001UA.job - c:\users\David\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-05 01:34] . 2012-07-18 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11] . 2012-07-18 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2012-07-03 16:21 133400 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-29 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-29 386584] "IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-03-05 1928976] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://www.google.com/ie mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~2\MICROS~4\Office14\ONBttnIE.dll/105 IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 10.0.0.1 DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-07-18 19:07:44 ComboFix-quarantined-files.txt 2012-07-18 23:07 ComboFix2.txt 2012-07-18 22:42 ComboFix3.txt 2012-07-18 01:42 ComboFix4.txt 2012-07-16 00:38 ComboFix5.txt 2012-07-18 22:45 . Pre-Run: 226,522,894,336 bytes free Post-Run: 226,447,728,640 bytes free . - - End Of File - - D06C8F962752ECA5898166C49403C4F9
Post #11
Hi jcmondavi,

Please run Malwarebytes' Anti-Malware.
  • Click the Update tab, then click Check for Updates.
  • If an update is found, download and install the latest version.
  • Next, click Scanner, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
===================================================

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
Post #12
Malwarebytes Anti-Malware (Trial) 1.62.0.1300 www.malwarebytes.org Database version: v2012.07.18.13 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 David :: DAVID-PC [administrator] Protection: Enabled 7/18/2012 8:11:59 PM mbam-log-2012-07-18 (20-11-59).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 195529 Time elapsed: 4 minute(s), 56 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Eset Scan C:\TDSSKiller_Quarantine\17.07.2012_19.09.57\mbr0000\tdlfs0000\tsk0005.dta Win32/Olmasco.O trojan C:\TDSSKiller_Quarantine\17.07.2012_19.09.57\mbr0000\tdlfs0000\tsk0006.dta Win64/Olmasco.Y trojan C:\TDSSKiller_Quarantine\17.07.2012_19.09.57\mbr0000\tdlfs0000\tsk0007.dta Win32/Olmasco.O trojan C:\TDSSKiller_Quarantine\17.07.2012_19.09.57\mbr0000\tdlfs0000\tsk0008.dta Win64/Olmasco.X trojan C:\TDSSKiller_Quarantine\17.07.2012_19.09.57\mbr0000\tdlfs0000\tsk0009.dta Win32/Olmasco.O trojan C:\TDSSKiller_Quarantine\17.07.2012_19.09.57\mbr0000\tdlfs0000\tsk0010.dta Win64/Olmasco.R trojan C:\TDSSKiller_Quarantine\17.07.2012_19.09.57\mbr0000\tdlfs0000\tsk0011.dta Win32/Olmasco.Q trojan C:\TDSSKiller_Quarantine\17.07.2012_19.09.57\mbr0000\tdlfs0000\tsk0012.dta Win64/Olmasco.X trojan
Post #13
Hi jcmondavi,
  • Please download GetPartitions from here
  • You must right click on the link and choose Save as….
  • Save it as GetPartitions.bat to your desktop
  • Double click on the icon to run it (If running Vista or Windows 7, right click on it and select "Run as an Administrator").
  • It will produce a log on your C:\ drive C:\DiskReport.txt
  • please navigate to that file and post the contents of the log in your next reply
Post #14
Microsoft DiskPart version 6.1.7601 Copyright © 1999-2008 Microsoft Corporation. On computer: DAVID-PC Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– Volume 0 D DVD-ROM 0 B No Media Volume 1 RECOVERY NTFS Partition 14 GB Healthy System Volume 2 C OS NTFS Partition 283 GB Healthy Boot
Post #15
jcmondavi,

Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan.
    • If Malicious objects are found, DO NOT cure them.
    • Choose Skip then click on Continue.
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI