Spyware/virus? [Solved]

Hi there! Thanks in advance for taking the time to help me. I dont think i have a serious issue, but rather something fairly minor - i would love to nip it in the butt before it gets worse! Currently i have been having one noticalbe issue: Some web pages simply wont open up, and these are pages that absolutely should. The most noticeable example is hotmail.com and this is the reason i decided to get this issue resolved, since i need to check a hotmail account of mine. In addition twice in as many weeks I have had an add on turned on that makes hyperlinks out of common words on ANY web page, and the hyperlinks simply direct me to advertisements. As far as I know i didnt install or enable such an add on, but both times I had to go in and disable one to (temporarily) stop the problem.

Its possible that some or all of these issues are related to an .exe file that i foolishly downloaded and ran called DownTango.

Here are the logs:


OTL logfile created on: 11/14/2012 06:36:36 PM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.12 Gb Total Physical Memory | 1.28 Gb Available Physical Memory | 41.08% Memory free
4.96 Gb Paging File | 3.21 Gb Available in Paging File | 64.70% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 931.50 Gb Total Space | 599.71 Gb Free Space | 64.38% Space Free | Partition Type: NTFS
Drive F: | 232.78 Gb Total Space | 61.92 Gb Free Space | 26.60% Space Free | Partition Type: NTFS

Computer Name: OWNER-91716EBEA | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Diablo III\Diablo III.exe (Blizzard Entertainment)
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
PRC - C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Documents and Settings\All Users\Application Data\Battle.net\Agent\Agent.1363\Agent.exe (Blizzard Entertainment)
PRC - C:\Program Files\Razer\Naga\RazerNagaSysTray.exe (Razer USA Ltd)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\WgaTray.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
MOD - C:\Program Files\AVG Secure Search\vprot.exe ()
MOD - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
MOD - C:\Program Files\Common Files\AVG Secure Search\DNTInstaller\13.2.0\avgdttbx.dll ()
MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\13.2.0\SiteSafety.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\WINDOWS\system32\sbe.dll ()
MOD - c:\WINDOWS\assembly\GAC\BDATunePIA\6.0.3000.0__31bf3856ad364e35\bdatunepia.dll ()
MOD - c:\WINDOWS\assembly\NativeImages1_v1.0.3705\System.Xml\1.0.3300.0__b77a5c561934e089_6e1ceed7\system.xml.dll ()
MOD - c:\WINDOWS\assembly\NativeImages1_v1.0.3705\mscorlib\1.0.3300.0__b77a5c561934e089_5d68add7\mscorlib.dll ()
MOD - c:\WINDOWS\assembly\NativeImages1_v1.0.3705\System\1.0.3300.0__b77a5c561934e089_fcc69637\System.dll ()
MOD - c:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.3300.0__b03f5f7f11d50a3a\system.enterpriseservices.thunk.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()


========== Services (SafeList) ==========

SRV - (PEVSystemStart) – C:\ComboFix\pev.cfxxe EXEC /i C:\ComboFix\REGT.cfxxe /S C:\ComboFix\CregB.dat File not found
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (vToolbarUpdater13.2.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (avgwd) – C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe (McAfee, Inc.)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (VMnetAdapter) – system32\DRIVERS\vmnetadapter.sys File not found
DRV - (vmci) – system32\DRIVERS\vmci.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (mbr) – C:\DOCUME~1\Owner\LOCALS~1\Temp\mbr.sys File not found
DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\ADMINI~1.OW~\LOCALS~1\Temp\catchme.sys File not found
DRV - (a2zlzuxf) – File not found
DRV - (avgtp) – C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSHX) – C:\WINDOWS\system32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) – C:\WINDOWS\system32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\WINDOWS\system32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (sptd) – C:\WINDOWS\system32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (NVHDA) – C:\WINDOWS\system32\drivers\nvhda32.sys (NVIDIA Corporation)
DRV - (RzSynapse) – C:\WINDOWS\system32\drivers\RzSynapse.sys (Razer USA Ltd)
DRV - (mfesmfk) – C:\WINDOWS\system32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (gdrv) – C:\WINDOWS\gdrv.sys (Windows ® 2000 DDK provider)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (NvNdis) – C:\WINDOWS\system32\drivers\nvndis.sys (NVIDIA Corporation.)
DRV - (pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=Z134&install;_date=20110910
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{3E88D830-AC60-49F2-9420-DF627C60D3DF}: "URL" = http://www.google.com/search?q={searchTerms}
IE - HKCU\..\SearchScopes\{7ABD5EFD-88A6-E9CE-80AE-DBCA8C52F41C}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={8FDA850…mp;d=2012-09-27 15:04:49&v;=12.2.5.34&sap;=dsp&q;={searchTerms}
IE - HKCU\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2304157
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?fr=mcafee&p;={searchTerms}
IE - HKCU\..\SearchScopes\{F9620000-1A10-4939-98EE-030C60AE63DF}: "URL" = http://search.avg.com/?d=4e0b2c6b&i;=23…guage}&nt;=1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig?hl=en&source;=iglk"
FF - prefs.js..extensions.enabledAddons: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.119
FF - prefs.js..extensions.enabledAddons: [removed]:0.72.17
FF - prefs.js..extensions.enabledAddons: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\13.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MI1933~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MI1933~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Documents and Settings\All Users\Application Data\CodecCheck\firefox [2011/09/09 21:23:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/02/05 11:48:09 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\Documents and Settings\All Users\Application Data\AVG Secure Search\FireFoxExt\13.2.0.5 [2012/11/08 14:30:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/10/27 20:01:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/27 20:01:28 | 000,000,000 | —D | M]

[2011/10/12 11:41:41 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2012/11/14 15:25:20 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\82fki3nt.default\extensions
[2012/06/29 15:24:55 | 000,000,000 | —D | M] (Bitdefender QuickScan) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\82fki3nt.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2012/07/25 14:38:59 | 000,741,958 | —- | M] () (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\82fki3nt.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/10/27 20:01:26 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/09/09 21:23:15 | 000,000,000 | —D | M] ("Premiumplay Codec-C") – C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\CODECCHECK\FIREFOX
[2012/02/05 11:48:09 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2010/01/20 03:00:24 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012/10/27 20:01:34 | 000,261,600 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/11/08 14:29:57 | 000,003,572 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/08/29 16:58:01 | 000,002,465 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/10/11 19:52:44 | 000,002,058 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2011/04/29 10:06:27 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll ()
O2 - BHO: (CrossRider) - {A876E312-7D08-401a-B7A6-FAFC5DC2F292} - C:\Program Files\CrossriderWebApps\Crossrider.dll ()
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKLM..\Run: [Razer Naga Driver] C:\Program Files\Razer\Naga\RazerNagaSysTray.exe (Razer USA Ltd)
O4 - HKLM..\Run: [ROC_ROC_NT] C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe ()
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe ()
O4 - HKLM..\RunOnce: C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll ()
O4 - HKLM..\RunOnce: C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXDFXAudioPlugin.dll ()
O4 - HKLM..\RunOnce: C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll ()
O4 - HKLM..\RunOnce: C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll ()
O4 - HKLM..\RunOnce: C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll ()
O4 - HKLM..\RunOnce: C:\Program Files\DivX\DivX Plus Player\DSEPlugins\Direct3DVideoOutput.dll (DivX, LLC)
O4 - HKLM..\RunOnce: C:\Program Files\DivX\DivX Plus Player\DSEPlugins\DirectShowAudioDecode.dll (DivX, LLC)
O4 - HKLM..\RunOnce: C:\Program Files\DivX\DivX Plus Player\DSEPlugins\DirectSoundAudioOutput.dll (DivX, LLC)
O4 - HKLM..\RunOnce: C:\Program Files\DivX\DivX Plus Player\DSEPlugins\DivXDeinterlaceFilter.dll (DivX, LLC)
O4 - HKLM..\RunOnce: C:\Program Files\DivX\DivX Plus Player\DSEPlugins\DivXPlaybackModule.dll (DivX, LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://active.macromedia.com/flash2/cabs/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E011F3E3-20C6-4F59-818E-A8BAC93FF73C}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Desktop Background.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/05/09 03:25:49 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2005/08/16 02:43:04 | 000,000,000 | —- | M] () - F:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2030/08/29 05:22:31 | 000,143,872 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\iacenc.dll
[2012/11/14 18:24:32 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HiJackThis.exe
[2012/11/14 18:11:38 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2012/11/14 07:33:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Sun
[2012/11/13 12:52:04 | 000,058,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\synceng.dll
[2012/11/11 20:56:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee Security Scan Plus
[2012/11/09 20:59:45 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/11/09 20:59:35 | 000,821,736 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2012/11/09 20:59:35 | 000,246,760 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/11/09 20:59:26 | 000,174,056 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/11/09 20:59:26 | 000,093,672 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2012/11/09 20:56:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
[2012/11/09 20:56:46 | 000,000,000 | —D | C] – C:\Program Files\McAfee Security Scan
[2012/11/09 18:08:53 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\DownTango
[2012/11/08 14:30:04 | 000,000,000 | —D | C] – C:\WINDOWS\System32\cache
[2012/11/08 09:24:34 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AVG
[2012/10/27 20:01:26 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2012/10/22 21:48:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2012/10/22 21:47:16 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/10/22 21:47:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2030/08/29 05:22:31 | 000,143,872 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\iacenc.dll
[2030/08/29 05:22:31 | 000,056,832 | —- | M] () – C:\WINDOWS\System32\iyvu9_32.dll
[2012/11/14 18:26:35 | 000,625,664 | —- | M] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2012/11/14 18:24:32 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HiJackThis.exe
[2012/11/14 18:11:39 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2012/11/14 17:39:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/11/14 14:48:31 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/11/14 06:26:06 | 000,436,466 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/11/14 06:26:06 | 000,068,854 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/11/14 03:17:36 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/11/14 03:17:31 | 000,291,680 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/11/14 03:06:23 | 000,000,593 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/11/12 20:42:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/11/11 20:56:45 | 000,001,771 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2012/11/11 20:56:45 | 000,001,765 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/11/09 21:03:34 | 049,510,804 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Umek Live at the Coronet Theater.mp3
[2012/11/09 20:59:14 | 000,821,736 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2012/11/09 20:59:14 | 000,746,984 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2012/11/09 20:59:14 | 000,246,760 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/11/09 20:59:14 | 000,174,056 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/11/09 20:59:14 | 000,174,056 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/11/09 20:59:14 | 000,143,872 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/11/09 20:59:14 | 000,093,672 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2012/11/09 20:56:39 | 000,697,272 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/11/09 20:56:39 | 000,073,656 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/11/09 18:08:05 | 000,000,014 | —- | M] () – C:\end
[2012/11/08 14:29:53 | 000,026,984 | —- | M] (AVG Technologies) – C:\WINDOWS\System32\drivers\avgtpx86.sys
[2012/11/08 09:24:34 | 000,000,702 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2013.lnk
[2012/10/27 19:00:56 | 616,593,452 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Deejay AUM - 'Circus Time'.wav
[2012/10/22 21:48:19 | 000,001,542 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2012/10/22 13:02:46 | 000,179,936 | —- | M] (AVG Technologies CZ, s.r.o. ) – C:\WINDOWS\System32\drivers\avgidsdriverx.sys
[2012/10/22 00:37:31 | 001,866,368 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\win32k.sys
[2012/10/22 00:37:31 | 001,866,368 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\win32k.sys
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2030/08/29 05:22:31 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\iyvu9_32.dll
[2012/11/14 18:26:34 | 000,625,664 | —- | C] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2012/11/09 21:03:33 | 049,510,804 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Umek Live at the Coronet Theater.mp3
[2012/11/09 20:56:46 | 000,001,771 | —- | C] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2012/11/09 20:56:46 | 000,001,765 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/11/09 18:08:03 | 000,000,014 | —- | C] () – C:\end
[2012/10/27 18:57:49 | 616,593,452 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Deejay AUM - 'Circus Time'.wav
[2012/10/22 21:48:19 | 000,001,542 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2012/09/12 19:38:53 | 000,027,520 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\dt.dat
[2012/05/12 02:13:25 | 001,360,296 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/10/12 13:01:13 | 001,094,820 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/10/12 13:01:13 | 001,094,820 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/10/12 13:01:13 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/10/12 13:00:29 | 002,811,988 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2011/07/15 13:30:40 | 000,020,250 | —- | C] () – C:\WINDOWS\W2BNEUnin.dat
[2011/06/18 15:05:26 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/06/18 15:05:26 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/06/18 15:05:26 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/06/18 15:05:26 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/06/18 15:05:26 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/04/27 02:02:01 | 000,000,127 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2011/01/23 09:02:10 | 000,011,074 | —- | C] () – C:\WINDOWS\hpdj3600.ini
[2010/11/25 13:05:26 | 000,000,410 | —- | C] () – C:\WINDOWS\MORDOR.INI
[2010/09/15 23:16:47 | 000,002,528 | —- | C] () – C:\Documents and Settings\Owner\Application Data\$_hpcst$.hpc
[2010/07/25 16:03:06 | 000,000,000 | —- | C] () – C:\Documents and Settings\Owner\defogger_reenable
[2010/05/26 14:48:35 | 008,892,928 | —- | C] () – C:\Documents and Settings\All Users\Application Data\atscie.msi
[2009/11/03 22:50:07 | 000,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2009/05/22 00:22:25 | 000,038,912 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/05/19 22:23:59 | 000,000,000 | —- | C] () – C:\Documents and Settings\Owner\Application Data\AVSMediaPlayer.m3u

========== ZeroAccess Check ==========

[2009/05/09 03:28:37 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2011/04/25 06:47:19 | 001,510,400 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 04:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 16:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/10/22 21:48:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2010/06/03 19:20:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2012/11/08 14:30:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Secure Search
[2012/09/27 14:05:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG2013
[2009/05/15 20:56:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2012/04/19 21:33:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Battle.net
[2011/07/07 22:10:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BioWare
[2011/09/09 21:23:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CodecCheck
[2011/06/28 19:55:59 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2012/09/22 15:12:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2011/07/07 22:10:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2010/06/04 11:52:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2011/09/09 21:23:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallMate
[2012/11/14 18:27:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/09/09 21:22:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Premium
[2011/12/25 23:36:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/12/08 15:13:22 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{0E8E33D8-193A-414A-A909-0F101A142D26}
[2010/04/03 18:22:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/09 22:02:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/17 19:30:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/12/24 19:05:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG
[2012/09/27 14:04:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG Secure Search
[2012/09/27 14:17:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG2013
[2012/11/13 10:49:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Azureus
[2012/09/22 19:03:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\DAEMON Tools Lite
[2012/02/05 11:50:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\DDMSettings
[2012/10/13 19:07:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\GetRightToGo
[2009/05/28 10:13:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\MSNInstaller
[2012/11/12 20:40:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mumble
[2009/05/20 22:57:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2012/10/29 15:16:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\QuickScan
[2012/03/06 20:26:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Spotify
[2009/08/10 20:44:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Steinberg
[2010/06/09 21:20:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SystemRequirementsLab
[2012/09/27 14:05:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\TuneUp Software

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

< End of report >


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 06:25:47 PM, on 11/14/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
C:\Program Files\AVG\AVG2013\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG2013\avgidsagent.exe
C:\Program Files\AVG\AVG2013\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG2013\avgnsx.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe
C:\Program Files\AVG\AVG2013\avgemcx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Razer\Naga\RazerNagaSysTray.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\AVG\AVG2013\avgui.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\All Users\Application Data\Battle.net\Agent\Agent.1363\Agent.exe
C:\Program Files\Diablo III\Diablo III.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (file missing)
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll
O2 - BHO: CrossRider - {A876E312-7D08-401a-B7A6-FAFC5DC2F292} - C:\Program Files\CrossriderWebApps\Crossrider.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MI1933~1\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [Razer Naga Driver] C:\Program Files\Razer\Naga\RazerNagaSysTray.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [ROC_ROC_NT] "C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\RunOnce: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXDFXAudioPlugin.dll",DllRegisterServer
O4 - HKLM\..\RunOnce: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DivX\DivX Plus Player\DSEPlugins\Direct3DVideoOutput.dll",DllRegisterServer
O4 - HKLM\..\RunOnce: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DivX\DivX Plus Player\DSEPlugins\DirectShowAudioDecode.dll",DllRegisterServer
O4 - HKLM\..\RunOnce: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DivX\DivX Plus Player\DSEPlugins\DirectSoundAudioOutput.dll",DllRegisterServer
O4 - HKLM\..\RunOnce: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DivX\DivX Plus Player\DSEPlugins\DivXDeinterlaceFilter.dll",DllRegisterServer
O4 - HKLM\..\RunOnce: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DivX\DivX Plus Player\DSEPlugins\DivXPlaybackModule.dll",DllRegisterServer
O4 - HKLM\..\RunOnce: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll",DllRegisterServer
O4 - HKLM\..\RunOnce: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll",DllRegisterServer
O4 - HKLM\..\RunOnce: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll",DllRegisterServer
O4 - HKLM\..\RunOnce: "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll",DllRegisterServer
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - S-1-5-18 Startup: CurseClientStartup.ccip (User 'SYSTEM')
O4 - .DEFAULT Startup: CurseClientStartup.ccip (User 'Default user')
O4 - Startup: CurseClientStartup.ccip
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MI1933~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (file missing)
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: PEVSystemStart - Unknown owner - C:\ComboFix\pev.cfxxe (file missing)
O23 - Service: vToolbarUpdater13.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe

–
End of file - 11853 bytes


.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 18:26:41.10 on Wed 11/14/2012
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.9.2
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3198.1427 [GMT -8:00]
.
AV: AVG Anti-Virus Free Edition 2013 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Disabled*
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
C:\Program Files\AVG\AVG2013\avgcsrvx.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG2013\avgidsagent.exe
C:\Program Files\AVG\AVG2013\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG2013\avgnsx.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe
C:\Program Files\AVG\AVG2013\avgemcx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Razer\Naga\RazerNagaSysTray.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\AVG\AVG2013\avgui.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\All Users\Application Data\Battle.net\Agent\Agent.1363\Agent.exe
C:\Program Files\Diablo III\Diablo III.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Owner\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\13.2.0.5\AVG Secure Search_toolbar.dll
BHO: CrossRider: {a876e312-7d08-401a-b7a6-fafc5dc2f292} - c:\program files\crossriderwebapps\Crossrider.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\mi1933~1\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\13.2.0.5\AVG Secure Search_toolbar.dll
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Xvid] c:\program files\xvid\CheckUpdate.exe
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
mRun: [Razer Naga Driver] c:\program files\razer\naga\RazerNagaSysTray.exe
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [AVG_UI] "c:\program files\avg\avg2013\avgui.exe" /TRAYONLY
mRun: [vProt] "c:\program files\avg secure search\vprot.exe"
mRun: [ROC_ROC_NT] "c:\program files\avg secure search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRunOnce: "c:\windows\system32\rundll32.exe" "c:\program files\divx\divx plus player\dpxplugins\DPXDFXAudioPlugin.dll",DllRegisterServer
mRunOnce: "c:\windows\system32\rundll32.exe" "c:\program files\divx\divx plus player\dseplugins\Direct3DVideoOutput.dll",DllRegisterServer
mRunOnce: "c:\windows\system32\rundll32.exe" "c:\program files\divx\divx plus player\dseplugins\DirectShowAudioDecode.dll",DllRegisterServer
mRunOnce: "c:\windows\system32\rundll32.exe" "c:\program files\divx\divx plus player\dseplugins\DirectSoundAudioOutput.dll",DllRegisterServer
mRunOnce: "c:\windows\system32\rundll32.exe" "c:\program files\divx\divx plus player\dseplugins\DivXDeinterlaceFilter.dll",DllRegisterServer
mRunOnce: "c:\windows\system32\rundll32.exe" "c:\program files\divx\divx plus player\dseplugins\DivXPlaybackModule.dll",DllRegisterServer
mRunOnce: "c:\windows\system32\rundll32.exe" "c:\program files\divx\divx plus player\dpxplugins\DPXBannerAdPlugin.dll",DllRegisterServer
mRunOnce: "c:\windows\system32\rundll32.exe" "c:\program files\divx\divx plus player\dpxplugins\DPXDownloadManagerPlugin.dll",DllRegisterServer
mRunOnce: "c:\windows\system32\rundll32.exe" "c:\program files\divx\divx plus player\dpxplugins\DPXMediaManagerPlugin.dll",DllRegisterServer
mRunOnce: "c:\windows\system32\rundll32.exe" "c:\program files\divx\divx plus player\dpxplugins\DPXPlayerPlugin.dll",DllRegisterServer
StartupFolder: c:\documents and settings\owner\start menu\programs\startup\CurseClientStartup.ccip
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.285\SSScheduler.exe
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\mi1933~1\office14\ONBttnIE.dll/105
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://active.macromedia.com/flash2/cabs/swflash.cab
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\13.2.0\ViProtocol.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 55776]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2012-8-9 177376]
R0 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 93536]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 35552]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2011-12-23 179936]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 19936]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 159712]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-4 164832]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-9-27 26984]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2013\avgidsagent.exe [2012-11-6 5814392]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2013\avgwdsvc.exe [2012-10-22 196664]
R2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files\common files\avg secure search\vtoolbarupdater\13.2.0\ToolbarUpdater.exe [2012-11-8 711112]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2011-11-18 124264]
R3 RzSynapse;Razer Driver;c:\windows\system32\drivers\RzSynapse.sys [2011-4-4 103424]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\drivers\vmci.sys –> c:\windows\system32\drivers\vmci.sys [?]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-5-11 1258856]
S2 PEVSystemStart;PEVSystemStart;"c:\combofix\pev.cfxxe" exec /i "c:\combofix\regt.cfxxe" /s "c:\combofix\cregb.dat" –> c:\combofix\pev.cfxxe [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-7 250808]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.285\McCHSvc.exe [2012-9-5 234776]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-5-15 34248]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-5-15 40552]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-30 115168]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
.
=============== Created Last 30 ================
.
2030-08-29 13:22:31 56832 ——w- c:\windows\system32\iyvu9_32.dll
2030-08-29 13:22:31 143872 ——w- c:\windows\system32\iacenc.dll
2012-11-14 15:33:02 ——– d—–w- c:\docume~1\owner\locals~1\applic~1\Sun
2012-11-13 20:52:04 58368 -c—-w- c:\windows\system32\dllcache\synceng.dll
2012-11-10 04:59:35 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-11-10 04:59:26 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-10 04:56:51 ——– d—–w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
2012-11-10 04:56:46 ——– d—–w- c:\program files\McAfee Security Scan
2012-11-10 02:08:53 ——– d—–w- c:\docume~1\owner\locals~1\applic~1\DownTango
2012-11-08 22:30:04 ——– d—–w- c:\windows\system32\cache
2012-10-23 05:47:16 ——– d—–w- c:\program files\iPod
2012-10-23 05:47:11 ——– d—–w- c:\docume~1\alluse~1\applic~1\188F1432-103A-4ffb-80F1-36B633C5C9E1
.
==================== Find3M ====================
.
2012-11-10 04:59:14 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-11-10 04:59:14 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-11-10 04:56:39 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-10 04:56:39 697272 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-22 08:37:31 1866368 —-a-w- c:\windows\system32\win32k.sys
2012-10-02 18:04:21 58368 —-a-w- c:\windows\system32\synceng.dll
2012-09-15 00:14:00 1094820 —-a-w- c:\windows\system32\nvdrsdb0.bin
2012-09-15 00:14:00 1 —-a-w- c:\windows\system32\nvdrssel.bin
2012-09-15 00:13:56 1094820 —-a-w- c:\windows\system32\nvdrsdb1.bin
2012-08-30 19:10:00 888168 —-a-w- c:\windows\system32\nvdispgenco32.dll
2012-08-30 19:10:00 7446528 —-a-w- c:\windows\system32\nvcuda.dll
2012-08-30 19:10:00 5947392 —-a-w- c:\windows\system32\nvopencl.dll
2012-08-30 19:10:00 4494208 —-a-w- c:\windows\system32\nv4_disp.dll
2012-08-30 19:10:00 2578792 —-a-w- c:\windows\system32\nvcuvid.dll
2012-08-30 19:10:00 2376704 —-a-w- c:\windows\system32\nvapi.dll
2012-08-30 19:10:00 19103744 —-a-w- c:\windows\system32\nvoglnt.dll
2012-08-30 19:10:00 1866088 —-a-w- c:\windows\system32\nvcuvenc.dll
2012-08-30 19:10:00 17551360 —-a-w- c:\windows\system32\nvcompiler.dll
2012-08-30 19:10:00 1009512 —-a-w- c:\windows\system32\nvdispco32.dll
2012-08-30 16:44:07 54272 —-a-w- c:\windows\system32\nvwddi.dll
2012-08-30 16:43:36 164200 —-a-w- c:\windows\system32\nvsvc32.exe
2012-08-30 16:43:36 15512424 —-a-w- c:\windows\system32\nvcpl.dll
2012-08-30 16:43:34 143720 —-a-w- c:\windows\system32\nvcolor.exe
2012-08-30 16:43:34 108392 —-a-w- c:\windows\system32\nvmctray.dll
2012-08-28 15:14:53 916992 —-a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14:53 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14:52 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07:15 385024 —-a-w- c:\windows\system32\html.iec
2012-08-24 13:53:22 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-08-21 20:01:22 106928 —-a-w- c:\windows\system32\GEARAspi.dll
2012-08-21 13:33:26 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58:09 2027520 —-a-w- c:\windows\system32\ntkrnlpa.exe
.
============= FINISH: 18:26:58.76 ===============

Please run the following:

• Please download aswMBR.exe and save it to your desktop.
  
• Double click aswMBR.exe to start the tool.
• When asked if you want to download Avast's virus definitions please select Yes.
  
• Click Scan
  
  
• Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
• You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

NEXT

Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right-mouse click JRT.exe and select Run as administrator
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message

Thank you for the help so far! First steps done, here are the logs:

aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software
Run date: 2012-11-16 06:36:25
—————————–
06:36:25.813 OS Version: Windows 5.1.2600 Service Pack 3
06:36:25.813 Number of processors: 4 586 0x203
06:36:25.813 ComputerName: OWNER-91716EBEA UserName: Owner
06:36:30.313 Initialize success
06:42:35.061 AVAST engine defs: 12111600
06:44:20.958 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
06:44:20.958 Disk 0 Vendor: WDC_WD10EAVS-32D7B1 01.01A01 Size: 953868MB BusType: 3
06:44:20.958 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-e
06:44:20.958 Disk 1 Vendor: Maxtor_7L250S0 BACE1G10 Size: 238417MB BusType: 3
06:44:20.989 Disk 0 MBR read successfully
06:44:20.989 Disk 0 MBR scan
06:44:21.021 Disk 0 Windows XP default MBR code
06:44:21.021 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 953859 MB offset 63
06:44:21.021 Disk 0 scanning sectors +1953504000
06:44:21.036 Disk 0 malicious Win32:MBRoot code @ sector 1953504003 !
06:44:21.036 Disk 0 PE file @ sector 1953504025 !
06:44:21.083 Disk 0 scanning C:\WINDOWS\system32\drivers
06:44:31.098 Service scanning
06:44:47.643 Modules scanning
06:44:55.627 Disk 0 trace - called modules:
06:44:55.674 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys pciide.sys PCIIDEX.SYS
06:44:55.674 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8afe2ab8]
06:44:55.674 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> \Device\00000075[0x8af66f18]
06:44:55.674 5 ACPI.sys[b7e64620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8afe7d98]
06:44:57.721 AVAST engine scan C:\WINDOWS
06:45:09.829 AVAST engine scan C:\WINDOWS\system32
06:48:46.059 AVAST engine scan C:\WINDOWS\system32\drivers
06:49:38.008 AVAST engine scan C:\Documents and Settings\Owner
07:44:05.153 AVAST engine scan C:\Documents and Settings\All Users
07:51:00.694 Scan finished successfully
11:43:53.907 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Owner\Desktop\MBR.dat"
11:43:53.907 The log file has been saved successfully to "C:\Documents and Settings\Owner\Desktop\aswMBR.txt"




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 3.1.2 (11.16.2012)
OS: Microsoft Windows XP x86
Ran by [removed] on Fri 11/16/2012 at 11:45:23.67
Blog: http://thisisudax.blogspot.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\conduit.engine"
Successfully deleted: [Registry Key] "hkey_local_machine\software\conduit"
Successfully deleted: [Registry Key] hkey_classes_root\clsid\{a6bf16ab-42a1-4bc5-965d-5e407e449aaa}
Successfully deleted: [Registry Key] hkey_classes_root\clsid\{a876e312-7d08-401a-b7a6-fafc5dc2f292}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{a876e312-7d08-401a-b7a6-fafc5dc2f292}



~~~ Files

Successfully deleted: [File] C:\eula.1028.txt
Successfully deleted: [File] C:\eula.1031.txt
Successfully deleted: [File] C:\eula.1033.txt
Successfully deleted: [File] C:\eula.1036.txt
Successfully deleted: [File] C:\eula.1040.txt
Successfully deleted: [File] C:\eula.1041.txt
Successfully deleted: [File] C:\eula.1042.txt
Successfully deleted: [File] C:\eula.2052.txt
Successfully deleted: [File] C:\install.res.1028.dll
Successfully deleted: [File] C:\install.res.1031.dll
Successfully deleted: [File] C:\install.res.1033.dll
Successfully deleted: [File] C:\install.res.1036.dll
Successfully deleted: [File] C:\install.res.1040.dll
Successfully deleted: [File] C:\install.res.1041.dll
Successfully deleted: [File] C:\install.res.1042.dll
Successfully deleted: [File] C:\install.res.2052.dll
Successfully deleted: [File] C:\install.res.3082.dll



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files\Common Files\dvdvideosoft"
Successfully deleted: [Folder] "C:\Program Files\crossriderwebapps"
Successfully deleted: [Folder] "C:\Program Files\dvdvideosoft"



~~~ FireFox

Successfully deleted: [Registry Value] hkey_local_machine\software\mozilla\firefox\extensions\\[removed]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 11/16/2012 at 11:48:45.84
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please do the following:

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• when the window opens, click on Change Parameters
• under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
• click OK
• Press Start Scan
  
  • If Malicious objects are found then ensure Cure is selected
  • If TDLFS File System is found then ensure Cure is selected (if Cure is not available, select Skip)
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

NEXT


Download ComboFix from the following location:

Link 1

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

• Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

ok, we appear to have found a rootkit virus? I really dont know much of what that means, but clearely we are making progress here are the logs:

12:51:56.0203 1280 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
12:51:56.0859 1280 ============================================================
12:51:56.0859 1280 Current date / time: 2012/11/16 12:51:56.0859
12:51:56.0859 1280 SystemInfo:
12:51:56.0859 1280
12:51:56.0859 1280 OS Version: 5.1.2600 ServicePack: 3.0
12:51:56.0859 1280 Product type: Workstation
12:51:56.0859 1280 ComputerName: OWNER-91716EBEA
12:51:56.0859 1280 UserName: Owner
12:51:56.0859 1280 Windows directory: C:\WINDOWS
12:51:56.0859 1280 System windows directory: C:\WINDOWS
12:51:56.0859 1280 Processor architecture: Intel x86
12:51:56.0859 1280 Number of processors: 4
12:51:56.0859 1280 Page size: 0x1000
12:51:56.0859 1280 Boot type: Normal boot
12:51:56.0859 1280 ============================================================
12:51:58.0187 1280 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0CADE00 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
12:51:58.0203 1280 Drive \Device\Harddisk1\DR1 - Size: 0x3A3518C200 (232.83 Gb), SectorSize: 0x200, Cylinders: 0x76B9, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
12:51:58.0203 1280 ============================================================
12:51:58.0203 1280 \Device\Harddisk0\DR0:
12:51:58.0203 1280 MBR partitions:
12:51:58.0203 1280 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74701AC1
12:51:58.0203 1280 \Device\Harddisk1\DR1:
12:51:58.0203 1280 MBR partitions:
12:51:58.0203 1280 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x139C5, BlocksNum 0x1D18D6F3
12:51:58.0203 1280 ============================================================
12:51:58.0234 1280 C: <-> \Device\Harddisk0\DR0\Partition1
12:51:58.0265 1280 F: <-> \Device\Harddisk1\DR1\Partition1
12:51:58.0265 1280 ============================================================
12:51:58.0265 1280 Initialize success
12:51:58.0265 1280 ============================================================
12:52:15.0687 2880 ============================================================
12:52:15.0687 2880 Scan started
12:52:15.0687 2880 Mode: Manual; TDLFS;
12:52:15.0687 2880 ============================================================
12:52:15.0953 2880 ================ Scan system memory ========================
12:52:15.0953 2880 System memory - ok
12:52:15.0953 2880 ================ Scan services =============================
12:52:16.0078 2880 Abiosdsk - ok
12:52:16.0078 2880 abp480n5 - ok
12:52:16.0109 2880 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
12:52:16.0125 2880 ACPI - ok
12:52:16.0156 2880 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
12:52:16.0156 2880 ACPIEC - ok
12:52:16.0218 2880 [ 0CB0AA071C7B86A64F361DCFDF357329 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
12:52:16.0234 2880 AdobeFlashPlayerUpdateSvc - ok
12:52:16.0234 2880 adpu160m - ok
12:52:16.0281 2880 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
12:52:16.0281 2880 aec - ok
12:52:16.0328 2880 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
12:52:16.0328 2880 AFD - ok
12:52:16.0328 2880 Aha154x - ok
12:52:16.0328 2880 aic78u2 - ok
12:52:16.0343 2880 aic78xx - ok
12:52:16.0375 2880 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
12:52:16.0375 2880 Alerter - ok
12:52:16.0390 2880 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
12:52:16.0390 2880 ALG - ok
12:52:16.0406 2880 AliIde - ok
12:52:16.0453 2880 [ 033448D435E65C4BD72E70521FD05C76 ] AmdPPM C:\WINDOWS\system32\DRIVERS\AmdPPM.sys
12:52:16.0453 2880 AmdPPM - ok
12:52:16.0453 2880 amsint - ok
12:52:16.0578 2880 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
12:52:16.0578 2880 Apple Mobile Device - ok
12:52:16.0609 2880 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
12:52:16.0609 2880 AppMgmt - ok
12:52:16.0640 2880 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys
12:52:16.0640 2880 Arp1394 - ok
12:52:16.0656 2880 asc - ok
12:52:16.0656 2880 asc3350p - ok
12:52:16.0656 2880 asc3550 - ok
12:52:16.0765 2880 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
12:52:16.0781 2880 aspnet_state - ok
12:52:16.0796 2880 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
12:52:16.0796 2880 AsyncMac - ok
12:52:16.0812 2880 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
12:52:16.0812 2880 atapi - ok
12:52:16.0828 2880 Atdisk - ok
12:52:16.0843 2880 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
12:52:16.0843 2880 Atmarpc - ok
12:52:16.0859 2880 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
12:52:16.0875 2880 AudioSrv - ok
12:52:16.0906 2880 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
12:52:16.0906 2880 audstub - ok
12:52:17.0125 2880 [ 56C73C5BC1656656CAC38A23B4310466 ] AVGIDSAgent C:\Program Files\AVG\AVG2013\avgidsagent.exe
12:52:17.0281 2880 AVGIDSAgent - ok
12:52:17.0328 2880 [ 7BB2C605094DBCA536D127B434214862 ] AVGIDSDriver C:\WINDOWS\system32\DRIVERS\avgidsdriverx.sys
12:52:17.0343 2880 AVGIDSDriver - ok
12:52:17.0359 2880 [ 8F50F98686C9A397A19FCBAE284DB1C5 ] AVGIDSHX C:\WINDOWS\system32\DRIVERS\avgidshx.sys
12:52:17.0359 2880 AVGIDSHX - ok
12:52:17.0390 2880 [ A8DE230CC8536790CA07D37FBCD87A74 ] AVGIDSShim C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys
12:52:17.0390 2880 AVGIDSShim - ok
12:52:17.0437 2880 [ D53D35031365A0ECCB1DC1BC1B15B18E ] Avgldx86 C:\WINDOWS\system32\DRIVERS\avgldx86.sys
12:52:17.0437 2880 Avgldx86 - ok
12:52:17.0453 2880 [ 95889A9D23F3133250FA8AD13C982D58 ] Avglogx C:\WINDOWS\system32\DRIVERS\avglogx.sys
12:52:17.0468 2880 Avglogx - ok
12:52:17.0468 2880 [ 6C7C00B8DD22B4343B47FED148387057 ] Avgmfx86 C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
12:52:17.0468 2880 Avgmfx86 - ok
12:52:17.0484 2880 [ F3D57358DE0B8B3491013C615754A7C7 ] Avgrkx86 C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
12:52:17.0484 2880 Avgrkx86 - ok
12:52:17.0500 2880 [ BA73B38E9033FC6018DB736B635706AE ] Avgtdix C:\WINDOWS\system32\DRIVERS\avgtdix.sys
12:52:17.0500 2880 Avgtdix - ok
12:52:17.0546 2880 [ 57D83B82117C2DDB9D7E9AEA691CEDFC ] avgtp C:\WINDOWS\system32\drivers\avgtpx86.sys
12:52:17.0546 2880 avgtp - ok
12:52:17.0578 2880 [ 6B72E1E329C4E98C6B6FDD2D265E3BA3 ] avgwd C:\Program Files\AVG\AVG2013\avgwdsvc.exe
12:52:17.0578 2880 avgwd - ok
12:52:17.0625 2880 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
12:52:17.0640 2880 Beep - ok
12:52:17.0687 2880 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll
12:52:17.0687 2880 BITS - ok
12:52:17.0750 2880 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
12:52:17.0750 2880 Bonjour Service - ok
12:52:17.0781 2880 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll
12:52:17.0796 2880 Browser - ok
12:52:17.0921 2880 catchme - ok
12:52:17.0937 2880 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
12:52:17.0937 2880 cbidf2k - ok
12:52:17.0937 2880 cd20xrnt - ok
12:52:17.0968 2880 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
12:52:17.0968 2880 Cdaudio - ok
12:52:18.0015 2880 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
12:52:18.0015 2880 Cdfs - ok
12:52:18.0062 2880 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
12:52:18.0062 2880 Cdrom - ok
12:52:18.0062 2880 Changer - ok
12:52:18.0078 2880 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
12:52:18.0078 2880 CiSvc - ok
12:52:18.0109 2880 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
12:52:18.0109 2880 ClipSrv - ok
12:52:18.0140 2880 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:52:18.0140 2880 clr_optimization_v2.0.50727_32 - ok
12:52:18.0156 2880 CmdIde - ok
12:52:18.0156 2880 COMSysApp - ok
12:52:18.0156 2880 Cpqarray - ok
12:52:18.0203 2880 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
12:52:18.0203 2880 CryptSvc - ok
12:52:18.0218 2880 dac2w2k - ok
12:52:18.0218 2880 dac960nt - ok
12:52:18.0265 2880 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
12:52:18.0265 2880 DcomLaunch - ok
12:52:18.0296 2880 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
12:52:18.0296 2880 Dhcp - ok
12:52:18.0296 2880 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
12:52:18.0312 2880 Disk - ok
12:52:18.0312 2880 dmadmin - ok
12:52:18.0375 2880 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
12:52:18.0390 2880 dmboot - ok
12:52:18.0406 2880 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
12:52:18.0406 2880 dmio - ok
12:52:18.0421 2880 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
12:52:18.0421 2880 dmload - ok
12:52:18.0437 2880 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
12:52:18.0437 2880 dmserver - ok
12:52:18.0453 2880 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
12:52:18.0453 2880 DMusic - ok
12:52:18.0468 2880 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
12:52:18.0484 2880 Dnscache - ok
12:52:18.0500 2880 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
12:52:18.0500 2880 Dot3svc - ok
12:52:18.0500 2880 dpti2o - ok
12:52:18.0531 2880 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
12:52:18.0531 2880 drmkaud - ok
12:52:18.0546 2880 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
12:52:18.0546 2880 EapHost - ok
12:52:18.0593 2880 [ 27434C42A13C11F92CA45840B720D671 ] ehRecvr C:\WINDOWS\eHome\ehRecvr.exe
12:52:18.0593 2880 ehRecvr - ok
12:52:18.0593 2880 [ 16910F8B482919BB6035ED053B691692 ] ehSched C:\WINDOWS\eHome\ehSched.exe
12:52:18.0593 2880 ehSched - ok
12:52:18.0609 2880 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
12:52:18.0625 2880 ERSvc - ok
12:52:18.0656 2880 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
12:52:18.0656 2880 Eventlog - ok
12:52:18.0703 2880 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
12:52:18.0703 2880 EventSystem - ok
12:52:18.0718 2880 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
12:52:18.0718 2880 Fastfat - ok
12:52:18.0765 2880 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
12:52:18.0765 2880 FastUserSwitchingCompatibility - ok
12:52:18.0781 2880 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
12:52:18.0781 2880 Fdc - ok
12:52:18.0812 2880 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
12:52:18.0812 2880 Fips - ok
12:52:18.0828 2880 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
12:52:18.0828 2880 Flpydisk - ok
12:52:18.0875 2880 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
12:52:18.0875 2880 FltMgr - ok
12:52:18.0968 2880 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
12:52:18.0968 2880 FontCache3.0.0.0 - ok
12:52:18.0984 2880 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
12:52:18.0984 2880 Fs_Rec - ok
12:52:18.0984 2880 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
12:52:18.0984 2880 Ftdisk - ok
12:52:19.0015 2880 [ 5C230948DD6652228F88CA7AE6CB276C ] gdrv C:\WINDOWS\gdrv.sys
12:52:19.0140 2880 gdrv - ok
12:52:19.0171 2880 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
12:52:19.0171 2880 GEARAspiWDM - ok
12:52:19.0218 2880 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
12:52:19.0218 2880 Gpc - ok
12:52:19.0265 2880 [ 3FCC124B6E08EE0E9351F717DD136939 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
12:52:19.0265 2880 HDAudBus - ok
12:52:19.0343 2880 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
12:52:19.0343 2880 helpsvc - ok
12:52:19.0375 2880 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll
12:52:19.0390 2880 HidServ - ok
12:52:19.0421 2880 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
12:52:19.0421 2880 HidUsb - ok
12:52:19.0453 2880 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
12:52:19.0453 2880 hkmsvc - ok
12:52:19.0453 2880 hpn - ok
12:52:19.0500 2880 [ D03D10F7DED688FECF50F8FBF1EA9B8A ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys
12:52:19.0515 2880 HPZid412 - ok
12:52:19.0546 2880 [ 89F41658929393487B6B7D13C8528CE3 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
12:52:19.0546 2880 HPZipr12 - ok
12:52:19.0562 2880 [ ABCB05CCDBF03000354B9553820E39F8 ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys
12:52:19.0562 2880 HPZius12 - ok
12:52:19.0593 2880 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
12:52:19.0593 2880 HTTP - ok
12:52:19.0640 2880 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
12:52:19.0640 2880 HTTPFilter - ok
12:52:19.0640 2880 i2omgmt - ok
12:52:19.0656 2880 i2omp - ok
12:52:19.0703 2880 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
12:52:19.0703 2880 i8042prt - ok
12:52:19.0734 2880 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
12:52:19.0750 2880 IDriverT - ok
12:52:19.0828 2880 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
12:52:19.0859 2880 idsvc - ok
12:52:19.0906 2880 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
12:52:19.0906 2880 Imapi - ok
12:52:19.0937 2880 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
12:52:19.0937 2880 ImapiService - ok
12:52:19.0953 2880 ini910u - ok
12:52:20.0093 2880 [ 927CF2BE4E57FF55E23759AC0CA57AA3 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys
12:52:20.0109 2880 IntcAzAudAddService - ok
12:52:20.0125 2880 IntelIde - ok
12:52:20.0156 2880 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
12:52:20.0156 2880 Ip6Fw - ok
12:52:20.0171 2880 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
12:52:20.0171 2880 IpFilterDriver - ok
12:52:20.0187 2880 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
12:52:20.0187 2880 IpInIp - ok
12:52:20.0218 2880 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
12:52:20.0218 2880 IpNat - ok
12:52:20.0265 2880 [ BC0EA61246F8D940FBC5F652D337D6BD ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
12:52:20.0281 2880 iPod Service - ok
12:52:20.0343 2880 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
12:52:20.0343 2880 IPSec - ok
12:52:20.0359 2880 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
12:52:20.0359 2880 IRENUM - ok
12:52:20.0375 2880 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
12:52:20.0375 2880 isapnp - ok
12:52:20.0515 2880 [ B591E761161D1EF547D76EF236EAA6A5 ] JavaQuickStarterService C:\Program Files\Java\jre7\bin\jqs.exe
12:52:20.0515 2880 JavaQuickStarterService - ok
12:52:20.0546 2880 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
12:52:20.0546 2880 Kbdclass - ok
12:52:20.0562 2880 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
12:52:20.0562 2880 kbdhid - ok
12:52:20.0578 2880 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
12:52:20.0578 2880 kmixer - ok
12:52:20.0609 2880 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
12:52:20.0609 2880 KSecDD - ok
12:52:20.0625 2880 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
12:52:20.0625 2880 lanmanserver - ok
12:52:20.0656 2880 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
12:52:20.0656 2880 lanmanworkstation - ok
12:52:20.0656 2880 lbrtfdc - ok
12:52:20.0703 2880 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
12:52:20.0703 2880 LmHosts - ok
12:52:20.0703 2880 MBAMSwissArmy - ok
12:52:20.0796 2880 [ 034606B82FA5BD3E73AB427B6D55F915 ] McComponentHostService C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe
12:52:20.0796 2880 McComponentHostService - ok
12:52:20.0843 2880 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
12:52:20.0843 2880 Messenger - ok
12:52:20.0859 2880 [ 41FE2F288E05A6C8AB85DD56770FFBAD ] mferkdk C:\WINDOWS\system32\drivers\mferkdk.sys
12:52:20.0859 2880 mferkdk - ok
12:52:20.0875 2880 [ 096B52EA918AA909BA5903D79E129005 ] mfesmfk C:\WINDOWS\system32\drivers\mfesmfk.sys
12:52:20.0875 2880 mfesmfk - ok
12:52:20.0906 2880 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
12:52:20.0906 2880 mnmdd - ok
12:52:20.0937 2880 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
12:52:20.0937 2880 mnmsrvc - ok
12:52:20.0953 2880 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
12:52:20.0953 2880 Modem - ok
12:52:21.0000 2880 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
12:52:21.0000 2880 Mouclass - ok
12:52:21.0015 2880 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
12:52:21.0015 2880 mouhid - ok
12:52:21.0031 2880 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
12:52:21.0031 2880 MountMgr - ok
12:52:21.0078 2880 [ 8BE15F71DE6FF33FC56DCDE7B2B9EFE8 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
12:52:21.0078 2880 MozillaMaintenance - ok
12:52:21.0093 2880 mraid35x - ok
12:52:21.0093 2880 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
12:52:21.0093 2880 MRxDAV - ok
12:52:21.0156 2880 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
12:52:21.0171 2880 MRxSmb - ok
12:52:21.0187 2880 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
12:52:21.0203 2880 MSDTC - ok
12:52:21.0203 2880 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
12:52:21.0203 2880 Msfs - ok
12:52:21.0203 2880 MSIServer - ok
12:52:21.0234 2880 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
12:52:21.0250 2880 MSKSSRV - ok
12:52:21.0281 2880 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
12:52:21.0281 2880 MSPCLOCK - ok
12:52:21.0312 2880 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
12:52:21.0312 2880 MSPQM - ok
12:52:21.0328 2880 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
12:52:21.0328 2880 mssmbios - ok
12:52:21.0359 2880 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
12:52:21.0359 2880 Mup - ok
12:52:21.0375 2880 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
12:52:21.0390 2880 napagent - ok
12:52:21.0437 2880 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
12:52:21.0437 2880 NDIS - ok
12:52:21.0468 2880 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
12:52:21.0468 2880 NdisTapi - ok
12:52:21.0484 2880 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
12:52:21.0484 2880 Ndisuio - ok
12:52:21.0484 2880 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
12:52:21.0484 2880 NdisWan - ok
12:52:21.0515 2880 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
12:52:21.0515 2880 NDProxy - ok
12:52:21.0578 2880 [ 2969D26EEE289BE7422AA46FC55F4E38 ] Net Driver HPZ12 C:\WINDOWS\system32\HPZinw12.dll
12:52:21.0578 2880 Net Driver HPZ12 - ok
12:52:21.0593 2880 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
12:52:21.0593 2880 NetBIOS - ok
12:52:21.0625 2880 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
12:52:21.0625 2880 NetBT - ok
12:52:21.0671 2880 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
12:52:21.0671 2880 NetDDE - ok
12:52:21.0671 2880 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
12:52:21.0671 2880 NetDDEdsdm - ok
12:52:21.0734 2880 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
12:52:21.0734 2880 Netlogon - ok
12:52:21.0765 2880 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
12:52:21.0781 2880 Netman - ok
12:52:21.0812 2880 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
12:52:21.0812 2880 NetTcpPortSharing - ok
12:52:21.0843 2880 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys
12:52:21.0843 2880 NIC1394 - ok
12:52:21.0890 2880 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
12:52:21.0890 2880 Nla - ok
12:52:21.0921 2880 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
12:52:21.0921 2880 Npfs - ok
12:52:21.0953 2880 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
12:52:21.0953 2880 Ntfs - ok
12:52:21.0968 2880 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
12:52:21.0968 2880 NtLmSsp - ok
12:52:22.0000 2880 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
12:52:22.0015 2880 NtmsSvc - ok
12:52:22.0046 2880 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
12:52:22.0046 2880 Null - ok
12:52:22.0343 2880 [ 774A0D43912F75DA99D32F2D9E6A674C ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
12:52:22.0609 2880 nv - ok
12:52:22.0656 2880 [ A211AB524324E84C2C805B52DFCDD544 ] NVHDA C:\WINDOWS\system32\drivers\nvhda32.sys
12:52:22.0656 2880 NVHDA - ok
12:52:22.0687 2880 [ 0B7F59271F2694EFD2F540B3332DDF5C ] NvNdis C:\WINDOWS\system32\Drivers\NvNdis.sys
12:52:22.0687 2880 NvNdis - ok
12:52:22.0734 2880 [ 6B665BDA473E2888A036D0BA5663B5A5 ] NVSvc C:\WINDOWS\system32\nvsvc32.exe
12:52:22.0734 2880 NVSvc - ok
12:52:22.0796 2880 [ 8BB901D3DBD7CA15C4D9F1EC98927379 ] nvUpdatusService C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
12:52:22.0843 2880 nvUpdatusService - ok
12:52:22.0859 2880 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
12:52:22.0859 2880 NwlnkFlt - ok
12:52:22.0875 2880 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
12:52:22.0875 2880 NwlnkFwd - ok
12:52:22.0906 2880 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys
12:52:22.0906 2880 ohci1394 - ok
12:52:22.0953 2880 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
12:52:22.0953 2880 ose - ok
12:52:23.0109 2880 [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
12:52:23.0234 2880 osppsvc - ok
12:52:23.0281 2880 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys
12:52:23.0296 2880 Parport - ok
12:52:23.0296 2880 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
12:52:23.0296 2880 PartMgr - ok
12:52:23.0328 2880 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
12:52:23.0328 2880 ParVdm - ok
12:52:23.0343 2880 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
12:52:23.0343 2880 PCI - ok
12:52:23.0343 2880 PCIDump - ok
12:52:23.0343 2880 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
12:52:23.0343 2880 PCIIde - ok
12:52:23.0359 2880 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
12:52:23.0359 2880 Pcmcia - ok
12:52:23.0375 2880 PDCOMP - ok
12:52:23.0375 2880 PDFRAME - ok
12:52:23.0375 2880 PDRELI - ok
12:52:23.0375 2880 PDRFRAME - ok
12:52:23.0375 2880 perc2 - ok
12:52:23.0390 2880 perc2hib - ok
12:52:23.0406 2880 PEVSystemStart - ok
12:52:23.0453 2880 [ DA86016F0672ADA925F589EDE715F185 ] pfc C:\WINDOWS\system32\drivers\pfc.sys
12:52:23.0453 2880 pfc - ok
12:52:23.0468 2880 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
12:52:23.0468 2880 PlugPlay - ok
12:52:23.0484 2880 [ BAFC9706BDF425A02B66468AB2605C59 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.dll
12:52:23.0484 2880 Pml Driver HPZ12 - ok
12:52:23.0484 2880 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
12:52:23.0484 2880 PolicyAgent - ok
12:52:23.0500 2880 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
12:52:23.0500 2880 PptpMiniport - ok
12:52:23.0515 2880 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys
12:52:23.0515 2880 Processor - ok
12:52:23.0515 2880 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
12:52:23.0515 2880 ProtectedStorage - ok
12:52:23.0531 2880 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
12:52:23.0531 2880 PSched - ok
12:52:23.0531 2880 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
12:52:23.0531 2880 Ptilink - ok
12:52:23.0562 2880 [ E42E3433DBB4CFFE8FDD91EAB29AEA8E ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
12:52:23.0562 2880 PxHelp20 - ok
12:52:23.0562 2880 ql1080 - ok
12:52:23.0562 2880 Ql10wnt - ok
12:52:23.0562 2880 ql12160 - ok
12:52:23.0562 2880 ql1240 - ok
12:52:23.0578 2880 ql1280 - ok
12:52:23.0593 2880 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
12:52:23.0593 2880 RasAcd - ok
12:52:23.0640 2880 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
12:52:23.0640 2880 RasAuto - ok
12:52:23.0671 2880 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
12:52:23.0671 2880 Rasl2tp - ok
12:52:23.0703 2880 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
12:52:23.0703 2880 RasMan - ok
12:52:23.0703 2880 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
12:52:23.0703 2880 RasPppoe - ok
12:52:23.0703 2880 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
12:52:23.0703 2880 Raspti - ok
12:52:23.0734 2880 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
12:52:23.0750 2880 Rdbss - ok
12:52:23.0781 2880 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
12:52:23.0781 2880 RDPCDD - ok
12:52:23.0781 2880 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
12:52:23.0781 2880 rdpdr - ok
12:52:23.0828 2880 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
12:52:23.0828 2880 RDPWD - ok
12:52:23.0843 2880 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
12:52:23.0843 2880 RDSessMgr - ok
12:52:23.0875 2880 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
12:52:23.0875 2880 redbook - ok
12:52:23.0890 2880 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
12:52:23.0906 2880 RemoteAccess - ok
12:52:23.0937 2880 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
12:52:23.0937 2880 RemoteRegistry - ok
12:52:23.0953 2880 [ F17713D108ACA124A139FDE877EEF68A ] RimUsb C:\WINDOWS\system32\Drivers\RimUsb.sys
12:52:23.0953 2880 RimUsb - ok
12:52:23.0968 2880 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
12:52:23.0968 2880 RpcLocator - ok
12:52:24.0000 2880 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll
12:52:24.0000 2880 RpcSs - ok
12:52:24.0062 2880 [ 0E11B35E972796042044BC27CE13B065 ] rspndr C:\WINDOWS\system32\DRIVERS\rspndr.sys
12:52:24.0062 2880 rspndr - ok
12:52:24.0093 2880 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
12:52:24.0093 2880 RSVP - ok
12:52:24.0125 2880 [ F0A21C62B9B835E1C96268EAAE31D239 ] RTLE8023xp C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
12:52:24.0125 2880 RTLE8023xp - ok
12:52:24.0156 2880 [ 2E2F0D988F6D46E5E5E84D9FCAD39081 ] RzSynapse C:\WINDOWS\system32\DRIVERS\RzSynapse.sys
12:52:24.0156 2880 RzSynapse - ok
12:52:24.0171 2880 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
12:52:24.0171 2880 SamSs - ok
12:52:24.0203 2880 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
12:52:24.0203 2880 SCardSvr - ok
12:52:24.0234 2880 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
12:52:24.0234 2880 Schedule - ok
12:52:24.0265 2880 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
12:52:24.0281 2880 Secdrv - ok
12:52:24.0281 2880 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
12:52:24.0281 2880 seclogon - ok
12:52:24.0296 2880 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
12:52:24.0296 2880 SENS - ok
12:52:24.0312 2880 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
12:52:24.0312 2880 serenum - ok
12:52:24.0328 2880 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
12:52:24.0328 2880 Serial - ok
12:52:24.0359 2880 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
12:52:24.0359 2880 Sfloppy - ok
12:52:24.0406 2880 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
12:52:24.0406 2880 SharedAccess - ok
12:52:24.0421 2880 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
12:52:24.0421 2880 ShellHWDetection - ok
12:52:24.0421 2880 Simbad - ok
12:52:24.0437 2880 Sparrow - ok
12:52:24.0484 2880 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
12:52:24.0484 2880 splitter - ok
12:52:24.0515 2880 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
12:52:24.0531 2880 Spooler - ok
12:52:24.0578 2880 [ 0022CFFF1A41E5CE3A764050A7DDF22A ] sptd C:\WINDOWS\System32\Drivers\sptd.sys
12:52:24.0578 2880 sptd - ok
12:52:24.0578 2880 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
12:52:24.0578 2880 sr - ok
12:52:24.0625 2880 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
12:52:24.0625 2880 srservice - ok
12:52:24.0656 2880 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
12:52:24.0656 2880 Srv - ok
12:52:24.0671 2880 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
12:52:24.0671 2880 SSDPSRV - ok
12:52:24.0703 2880 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
12:52:24.0703 2880 stisvc - ok
12:52:24.0750 2880 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
12:52:24.0750 2880 swenum - ok
12:52:24.0750 2880 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
12:52:24.0750 2880 swmidi - ok
12:52:24.0765 2880 SwPrv - ok
12:52:24.0765 2880 symc810 - ok
12:52:24.0765 2880 symc8xx - ok
12:52:24.0765 2880 sym_hi - ok
12:52:24.0765 2880 sym_u3 - ok
12:52:24.0812 2880 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
12:52:24.0812 2880 sysaudio - ok
12:52:24.0828 2880 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
12:52:24.0828 2880 SysmonLog - ok
12:52:24.0843 2880 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
12:52:24.0859 2880 TapiSrv - ok
12:52:24.0890 2880 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
12:52:24.0890 2880 Tcpip - ok
12:52:24.0906 2880 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
12:52:24.0921 2880 TDPIPE - ok
12:52:24.0921 2880 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
12:52:24.0921 2880 TDTCP - ok
12:52:24.0921 2880 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
12:52:24.0937 2880 TermService - ok
12:52:24.0953 2880 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
12:52:24.0953 2880 Themes - ok
12:52:24.0984 2880 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
12:52:24.0984 2880 TlntSvr - ok
12:52:25.0000 2880 TosIde - ok
12:52:25.0015 2880 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
12:52:25.0015 2880 TrkWks - ok
12:52:25.0046 2880 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
12:52:25.0046 2880 Udfs - ok
12:52:25.0046 2880 ultra - ok
12:52:25.0062 2880 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
12:52:25.0078 2880 Update - ok
12:52:25.0093 2880 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
12:52:25.0093 2880 upnphost - ok
12:52:25.0125 2880 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
12:52:25.0125 2880 UPS - ok
12:52:25.0156 2880 [ 73B41F4EAD65F355962168D766AF0F2E ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys
12:52:25.0156 2880 USBAAPL - ok
12:52:25.0187 2880 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
12:52:25.0187 2880 usbaudio - ok
12:52:25.0218 2880 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
12:52:25.0218 2880 usbccgp - ok
12:52:25.0234 2880 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
12:52:25.0234 2880 usbehci - ok
12:52:25.0265 2880 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
12:52:25.0265 2880 usbhub - ok
12:52:25.0281 2880 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys
12:52:25.0281 2880 usbohci - ok
12:52:25.0312 2880 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
12:52:25.0312 2880 usbprint - ok
12:52:25.0312 2880 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
12:52:25.0328 2880 usbscan - ok
12:52:25.0343 2880 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
12:52:25.0343 2880 USBSTOR - ok
12:52:25.0359 2880 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
12:52:25.0359 2880 VgaSave - ok
12:52:25.0359 2880 ViaIde - ok
12:52:25.0359 2880 vmci - ok
12:52:25.0375 2880 VMnetAdapter - ok
12:52:25.0421 2880 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
12:52:25.0421 2880 VolSnap - ok
12:52:25.0468 2880 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
12:52:25.0468 2880 VSS - ok
12:52:25.0562 2880 [ 7D110D645030C05A06C3CD08D1E47D0A ] vToolbarUpdater13.2.0 C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe
12:52:25.0578 2880 vToolbarUpdater13.2.0 - ok
12:52:25.0640 2880 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll
12:52:25.0640 2880 W32Time - ok
12:52:25.0656 2880 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
12:52:25.0656 2880 Wanarp - ok
12:52:25.0703 2880 [ BBCFEAB7E871CDDAC2D397EE7FA91FDC ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys
12:52:25.0703 2880 Wdf01000 - ok
12:52:25.0703 2880 WDICA - ok
12:52:25.0718 2880 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
12:52:25.0718 2880 wdmaud - ok
12:52:25.0734 2880 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
12:52:25.0734 2880 WebClient - ok
12:52:25.0828 2880 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
12:52:25.0828 2880 winmgmt - ok
12:52:25.0843 2880 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
12:52:25.0859 2880 WmdmPmSN - ok
12:52:25.0890 2880 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll
12:52:25.0906 2880 Wmi - ok
12:52:25.0953 2880 [ AE2C8544E747C20062DB27456EA2D67A ] WmiAcpi C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
12:52:25.0953 2880 WmiAcpi - ok
12:52:25.0968 2880 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
12:52:25.0968 2880 WmiApSrv - ok
12:52:26.0062 2880 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
12:52:26.0078 2880 WMPNetworkSvc - ok
12:52:26.0109 2880 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
12:52:26.0109 2880 WpdUsb - ok
12:52:26.0140 2880 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
12:52:26.0140 2880 WS2IFSL - ok
12:52:26.0187 2880 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
12:52:26.0187 2880 wscsvc - ok
12:52:26.0218 2880 [ 365980DA5B43B397542429B0743E6226 ] wuauserv C:\WINDOWS\system32\wuauserv.dll
12:52:26.0218 2880 wuauserv - ok
12:52:26.0265 2880 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
12:52:26.0265 2880 WudfPf - ok
12:52:26.0296 2880 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
12:52:26.0296 2880 WudfRd - ok
12:52:26.0328 2880 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
12:52:26.0328 2880 WudfSvc - ok
12:52:26.0375 2880 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
12:52:26.0390 2880 WZCSVC - ok
12:52:26.0437 2880 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
12:52:26.0437 2880 xmlprov - ok
12:52:26.0453 2880 ================ Scan global ===============================
12:52:26.0484 2880 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
12:52:26.0515 2880 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
12:52:26.0546 2880 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
12:52:26.0593 2880 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
12:52:26.0593 2880 [Global] - ok
12:52:26.0593 2880 ================ Scan MBR ==================================
12:52:26.0609 2880 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
12:52:26.0656 2880 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - infected
12:52:26.0671 2880 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Sinowal.b (0)
12:52:26.0703 2880 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
12:52:26.0703 2880 \Device\Harddisk0\DR0 - detected TDSS File System (1)
12:52:26.0703 2880 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
12:52:26.0734 2880 \Device\Harddisk1\DR1 ( Rootkit.Boot.Sinowal.b ) - infected
12:52:26.0734 2880 \Device\Harddisk1\DR1 - detected Rootkit.Boot.Sinowal.b (0)
12:52:26.0781 2880 ================ Scan VBR ==================================
12:52:26.0781 2880 [ 88938F9309459AB49E8C69F0B6AD10B6 ] \Device\Harddisk0\DR0\Partition1
12:52:26.0781 2880 \Device\Harddisk0\DR0\Partition1 - ok
12:52:26.0781 2880 [ 0647173B5C4EACBE80536BFA78F1ABC9 ] \Device\Harddisk1\DR1\Partition1
12:52:26.0781 2880 \Device\Harddisk1\DR1\Partition1 - ok
12:52:26.0781 2880 ============================================================
12:52:26.0781 2880 Scan finished
12:52:26.0781 2880 ============================================================
12:52:26.0796 1960 Detected object count: 3
12:52:26.0796 1960 Actual detected object count: 3
12:55:30.0031 1960 \Device\Harddisk0\DR0\# - copied to quarantine
12:55:30.0046 1960 \Device\Harddisk0\DR0 - copied to quarantine
12:55:30.0078 1960 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - will be cured on reboot
12:55:30.0078 1960 \Device\Harddisk0\DR0 - ok
12:55:30.0078 1960 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - User select action: Cure
12:55:30.0078 1960 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
12:55:30.0078 1960 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
12:55:30.0296 1960 \Device\Harddisk1\DR1\# - copied to quarantine
12:55:30.0296 1960 \Device\Harddisk1\DR1 - copied to quarantine
12:55:30.0343 1960 \Device\Harddisk1\DR1 ( Rootkit.Boot.Sinowal.b ) - will be cured on reboot
12:55:30.0343 1960 \Device\Harddisk1\DR1 - ok
12:55:30.0343 1960 \Device\Harddisk1\DR1 ( Rootkit.Boot.Sinowal.b ) - User select action: Cure
12:55:38.0921 3408 Deinitialize success



ComboFix 12-11-16.02 - Owner 11/16/2012 13:05:37.6.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3198.2391 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
C:\install.exe
c:\windows\ST6UNST.000
c:\windows\system32\avgfwdx.dll
c:\windows\system32\Cache
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\654f20bdf01bc851.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr70.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-10-16 to 2012-11-16 )))))))))))))))))))))))))))))))
.
.
2030-08-29 13:22 . 2030-08-29 13:22 56832 ——w- c:\windows\system32\iyvu9_32.dll
2030-08-29 13:22 . 2030-08-29 13:22 143872 ——w- c:\windows\system32\iacenc.dll
2012-11-16 20:55 . 2012-11-16 20:55 ——– d—–w- C:\TDSSKiller_Quarantine
2012-11-16 19:50 . 2012-11-16 19:50 ——– d—–w- c:\documents and settings\Administrator.OWNER-91716EBEA\Local Settings\Application Data\AVG Secure Search
2012-11-16 19:50 . 2012-11-16 19:50 ——– d—–w- c:\documents and settings\Administrator.OWNER-91716EBEA\Application Data\AVG2013
2012-11-16 19:49 . 2012-11-16 19:49 ——– d—–w- c:\documents and settings\Administrator.OWNER-91716EBEA\Local Settings\Application Data\Avg2013
2012-11-16 19:49 . 2012-11-16 19:49 ——– d—–w- c:\documents and settings\Administrator.OWNER-91716EBEA\Application Data\Apple Computer
2012-11-16 19:45 . 2012-11-16 19:45 ——– d—–w- c:\windows\ERUNT
2012-11-16 19:45 . 2012-11-16 19:45 ——– d—–w- C:\JRT
2012-11-14 15:33 . 2012-11-14 15:33 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Sun
2012-11-13 20:52 . 2012-10-02 18:04 58368 -c—-w- c:\windows\system32\dllcache\synceng.dll
2012-11-10 04:59 . 2012-11-10 04:59 ——– d—–w- c:\program files\Common Files\Java
2012-11-10 04:59 . 2012-11-10 04:59 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-11-10 04:59 . 2012-11-10 04:59 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-10 04:56 . 2012-11-10 04:56 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2012-11-10 04:56 . 2012-11-12 04:56 ——– d—–w- c:\program files\McAfee Security Scan
2012-11-10 02:08 . 2012-11-10 02:17 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\DownTango
2012-10-23 05:47 . 2012-10-23 05:47 ——– d—–w- c:\program files\iPod
2012-10-23 05:47 . 2012-10-23 05:48 ——– d—–w- c:\documents and settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-10 04:59 . 2010-07-26 20:07 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-11-10 04:59 . 2010-07-26 20:07 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-11-10 04:56 . 2012-04-07 23:20 697272 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-10 04:56 . 2011-06-15 17:28 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-08 22:29 . 2012-09-27 22:04 26984 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-10-22 21:02 . 2011-12-23 20:32 179936 —-a-w- c:\windows\system32\drivers\avgidsdriverx.sys
2012-10-22 08:37 . 2007-05-15 06:07 1866368 —-a-w- c:\windows\system32\win32k.sys
2012-10-15 11:48 . 2012-04-19 11:50 55776 —-a-w- c:\windows\system32\drivers\avgidshx.sys
2012-10-05 11:32 . 2011-03-01 21:25 93536 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2012-10-02 18:04 . 2004-08-04 13:00 58368 —-a-w- c:\windows\system32\synceng.dll
2012-10-02 10:30 . 2011-01-07 13:41 159712 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2012-09-21 10:46 . 2011-04-05 07:59 164832 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2012-09-21 10:46 . 2012-08-09 20:56 177376 —-a-w- c:\windows\system32\drivers\avglogx.sys
2012-09-21 10:45 . 2011-12-23 20:32 19936 —-a-w- c:\windows\system32\drivers\avgidsshimx.sys
2012-09-14 10:05 . 2011-03-16 23:03 35552 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2012-08-30 19:10 . 2012-09-15 00:13 888168 —-a-w- c:\windows\system32\nvdispgenco32.dll
2012-08-30 19:10 . 2012-09-15 00:13 5947392 —-a-w- c:\windows\system32\nvopencl.dll
2012-08-30 19:10 . 2011-10-12 21:00 7446528 —-a-w- c:\windows\system32\nvcuda.dll
2012-08-30 19:10 . 2011-10-12 21:00 2578792 —-a-w- c:\windows\system32\nvcuvid.dll
2012-08-30 19:10 . 2011-10-12 21:00 1866088 —-a-w- c:\windows\system32\nvcuvenc.dll
2012-08-30 19:10 . 2011-10-12 21:00 17551360 —-a-w- c:\windows\system32\nvcompiler.dll
2012-08-30 19:10 . 2011-10-12 21:00 1009512 —-a-w- c:\windows\system32\nvdispco32.dll
2012-08-30 19:10 . 2009-05-01 05:02 4494208 —-a-w- c:\windows\system32\nv4_disp.dll
2012-08-30 19:10 . 2009-05-01 05:02 12555680 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2012-08-30 19:10 . 2007-09-17 15:07 2376704 —-a-w- c:\windows\system32\nvapi.dll
2012-08-30 19:10 . 2007-09-17 15:07 19103744 —-a-w- c:\windows\system32\nvoglnt.dll
2012-08-30 16:44 . 2007-09-17 15:07 54272 —-a-w- c:\windows\system32\nvwddi.dll
2012-08-30 16:43 . 2007-09-17 15:07 164200 —-a-w- c:\windows\system32\nvsvc32.exe
2012-08-30 16:43 . 2007-09-17 15:07 15512424 —-a-w- c:\windows\system32\nvcpl.dll
2012-08-30 16:43 . 2011-10-12 21:01 143720 —-a-w- c:\windows\system32\nvcolor.exe
2012-08-30 16:43 . 2007-09-17 15:07 108392 —-a-w- c:\windows\system32\nvmctray.dll
2012-08-28 15:14 . 2007-05-15 06:07 916992 —-a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14 . 2004-08-04 13:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14 . 2004-08-04 13:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2004-08-04 13:00 385024 —-a-w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2004-08-04 13:00 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-08-21 20:01 . 2009-05-18 03:30 26840 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-08-21 20:01 . 2009-05-18 03:30 106928 —-a-w- c:\windows\system32\GEARAspi.dll
2012-08-21 13:33 . 2007-05-15 06:05 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2007-02-28 05:16 2027520 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-10-28 04:01 . 2012-10-28 04:01 261600 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-11-08 22:29 1796552 —-a-w- c:\program files\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll" [2012-11-08 1796552]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Xvid"="c:\program files\Xvid\CheckUpdate.exe" [2011-01-17 8192]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Razer Naga Driver"="c:\program files\Razer\Naga\RazerNagaSysTray.exe" [2011-02-17 953744]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-28 59280]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-08-30 15512424]
"NvMediaCenter"="NvMCTray.dll" [2012-08-30 108392]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-08-30 1634112]
"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-11-07 3143800]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-11-08 997320]
"ROC_ROC_NT"="c:\program files\AVG Secure Search\ROC_ROC_NT.exe" [2012-09-27 856160]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-10 421776]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2010-3-5 0]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.285\SSScheduler.exe [2012-9-5 271808]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GEST]
m‘|\ü [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51 919008 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08 1259376 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2004-08-10 11:04 59392 —-a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-08-26 05:51 16851456 —-a-w- c:\windows\RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-07-03 17:04 252848 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"JavaQuickStarterService"=2 (0x2)
"Bonjour Service"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"f:\\Program Files\\World of Warcraft\\Launcher.exe"=
"f:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\VentSrv\\ventrilo_srv.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\BackgroundDownloader.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\Launcher.patch.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Program Files\\World of Warcraft Public Test\\LauncherB.exe"=
"c:\\Program Files\\StarCraft II\\StarCraft II.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\Owner\\Application Data\\Spotify\\spotify.exe"=
"c:\\Program Files\\Diablo III\\Diablo III.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.EXE"=
"c:\\Documents and Settings\\All Users\\Application Data\\Battle.net\\Agent\\Agent.1267\\Agent.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Battle.net\\Agent\\Agent.1363\\Agent.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Apps\\2.0\\P76R76HL.VBN\\Z8PJ4QKH.3OY\\curs..tion_9e9e83ddf3ed3ead_0005.0001_161f1f0e4761792c\\CurseClient.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"3389:TCP"= 3389:TCP:Remote Desktop
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [4/19/2012 03:50 AM 55776]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [8/9/2012 12:56 PM 177376]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [3/16/2011 03:03 PM 35552]
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys –> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [12/23/2011 12:32 PM 179936]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [12/23/2011 12:32 PM 19936]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [1/7/2011 05:41 AM 159712]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4/4/2011 11:59 PM 164832]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [9/27/2012 02:04 PM 26984]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [10/22/2012 01:05 PM 196664]
R2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [11/8/2012 02:29 PM 711112]
R3 RzSynapse;Razer Driver;c:\windows\system32\drivers\RzSynapse.sys [4/4/2011 03:49 PM 103424]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys –> c:\windows\system32\DRIVERS\vmci.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [11/6/2012 07:00 PM 5814392]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.285\McCHSvc.exe [9/5/2012 07:56 AM 234776]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 08704405
*NewlyCreated* - 15126375
*Deregistered* - 08704405
*Deregistered* - 15126375
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 04:56]
.
2012-11-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p;=%s%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\Office14\EXCEL.EXE/3000
IE: Se&nd; to OneNote - c:\progra~1\MI1933~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = [removed] [removed] [removed]
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
SafeBoot-15126375.sys
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe
MSConfigStartUp-mcui_exe - c:\program files\McAfee.com\Agent\mcagent.exe
AddRemove-Crossrider - c:\program files\CrossriderWebApps\uninstall.exe
AddRemove-Free YouTube to Mp3 Converter_is1 - c:\program files\DVDVideoSoft\Free YouTube to Mp3 Converter\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-16 13:14
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2012-11-16 13:16:02
ComboFix-quarantined-files.txt 2012-11-16 21:15
ComboFix2.txt 2011-06-18 23:13
ComboFix3.txt 2011-04-29 18:13
.
Pre-Run: 648,731,906,048 bytes free
Post-Run: 653,886,701,568 bytes free
.
- - End Of File - - D8BE5360F52A80DE6D9268A6825CC2C9

Sorry must have somehow missed posting the adwCleaner logs… here they are as well as combofix logs! As for how everything is running, it appears to be completely issue free at the moment… yay!


# AdwCleaner v2.007 - Logfile created 11/16/2012 at 16:25:12
# Updated 06/11/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Owner - OWNER-91716EBEA
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Owner\Desktop\AdwCleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Deleted on reboot : C:\Program Files\Common Files\AVG Secure Search
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Deleted : C:\WINDOWS\system32\conduitEngine.tmp
Folder Deleted : C:\Documents and Settings\Administrator.OWNER-91716EBEA\Local Settings\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\All Users\Application Data\InstallMate
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Premium
Folder Deleted : C:\Documents and Settings\Owner\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Owner\Local Settings\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Owner\Local Settings\Application Data\Conduit
Folder Deleted : C:\Program Files\AVG Secure Search
Folder Deleted : C:\Program Files\DAEMON Tools Toolbar

***** [Registry] *****

Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\Crossrider
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\bflixtoolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0702A2B6-13AA-4090-9E01-BCDC85DD933F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{622FD888-4E91-4D68-84D4-7262FD0811BF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B0DE3308-5D5A-470D-81B9-634FC078393B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C44FEFF4-EF0C-4CF7-83D0-92B4266A32B9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F131923C-381D-4E4C-A472-4A17118FD742}
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2304157
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Crossrider
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Mozilla Firefox v16.0.2 (en-US)

Profile name : default
File : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\82fki3nt.default\prefs.js

Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Deleted : user_pref("browser.search.selectedEngine", "AVG Secure Search");
Deleted : user_pref("extensions.502c599b9c8b7.scode", "(function(){try{if('aol.com,mail.google.com,mystart.inc[…]
Deleted : user_pref("extensions.crossriderapp435.435.active", true);
Deleted : user_pref("extensions.crossriderapp435.435.affid", "0");
Deleted : user_pref("extensions.crossriderapp435.435.backgroundjs", "\n//—————— PLUGIN resources_[…]
Deleted : user_pref("extensions.crossriderapp435.435.backgroundver", 8);
Deleted : user_pref("extensions.crossriderapp435.435.certdomaininstaller", "");
Deleted : user_pref("extensions.crossriderapp435.435.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 GM[…]
Deleted : user_pref("extensions.crossriderapp435.435.cookie._GPL_aoi.value", "%221329006671%22");
Deleted : user_pref("extensions.crossriderapp435.435.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030 0[…]
Deleted : user_pref("extensions.crossriderapp435.435.cookie._GPL_parent_zoneid.value", "%2218727%22");
Deleted : user_pref("extensions.crossriderapp435.435.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:00[…]
Deleted : user_pref("extensions.crossriderapp435.435.cookie._GPL_zoneid.value", "%2219061%22");
Deleted : user_pref("extensions.crossriderapp435.435.cookie.__GPL_ID.expiration", "Fri Feb 01 2030 00:00:00 GM[…]
Deleted : user_pref("extensions.crossriderapp435.435.cookie.__GPL_ID.value", "1466");
Deleted : user_pref("extensions.crossriderapp435.435.cookie.__GPL_custom_zoneid.expiration", "Fri Feb 01 2030 […]
Deleted : user_pref("extensions.crossriderapp435.435.cookie.__GPL_custom_zoneid.value", "14969");
Deleted : user_pref("extensions.crossriderapp435.435.cookie.__GPL_pubid.expiration", "Fri Feb 01 2030 00:00:00[…]
Deleted : user_pref("extensions.crossriderapp435.435.cookie.__GPL_pubid.value", "%222993%22");
Deleted : user_pref("extensions.crossriderapp435.435.cookie.previous_page.expiration", "Fri Feb 01 2030 00:00:[…]
Deleted : user_pref("extensions.crossriderapp435.435.cookie.previous_page.value", "%22hxxp%3A//us.battle.net/d[…]
Deleted : user_pref("extensions.crossriderapp435.435.description", "Premiumplay Codec check");
Deleted : user_pref("extensions.crossriderapp435.435.domain", "");
Deleted : user_pref("extensions.crossriderapp435.435.emailsig", "");
Deleted : user_pref("extensions.crossriderapp435.435.exposesites", "");
Deleted : user_pref("extensions.crossriderapp435.435.fbremoteurl", "");
Deleted : user_pref("extensions.crossriderapp435.435.group", 0);
Deleted : user_pref("extensions.crossriderapp435.435.homepage", "");
Deleted : user_pref("extensions.crossriderapp435.435.iframe", false);
Deleted : user_pref("extensions.crossriderapp435.435.js", "\n//—————— PLUGIN app_435_specific STA[…]
Deleted : user_pref("extensions.crossriderapp435.435.name", "Codec-V");
Deleted : user_pref("extensions.crossriderapp435.435.premium", true);
Deleted : user_pref("extensions.crossriderapp435.435.publisher", "Premiumplay");
Deleted : user_pref("extensions.crossriderapp435.435.settingsurl", "");
Deleted : user_pref("extensions.crossriderapp435.435.thankyou", "");
Deleted : user_pref("extensions.crossriderapp435.435.ver", 62);
Deleted : user_pref("extensions.crossriderapp435.apps", "435");
Deleted : user_pref("extensions.crossriderapp435.bic", "135644eac04780690165d88561d5707a");
Deleted : user_pref("extensions.crossriderapp435.cid", 435);
Deleted : user_pref("extensions.crossriderapp435.firstrun", false);
Deleted : user_pref("extensions.crossriderapp435.hadappinstalled", true);
Deleted : user_pref("extensions.crossriderapp435.installationdate", 1328827772);
Deleted : user_pref("extensions.crossriderapp435.jsver", 3);
Deleted : user_pref("extensions.crossriderapp435.lastcheck", 22550262);
Deleted : user_pref("extensions.crossriderapp435.lastcheckitem", 22550262);
Deleted : user_pref("extensions.crossriderapp435.misc.lastBgWorkerTimer", "1352993877962");
Deleted : user_pref("extensions.crossriderapp435.misc.lastDomWorkerTimer", "1352993877952");

Profile name : default
File : C:\Documents and Settings\Administrator.OWNER-91716EBEA\Application Data\Mozilla\Firefox\Profiles\vvyipmus.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [10219 octets] - [16/11/2012 16:25:12]

########## EOF - C:\AdwCleaner[S1].txt - [10280 octets] ##########




ComboFix 12-11-16.02 - Owner 11/17/2012 15:32:27.7.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3198.1123 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
FILE ::
"c:\documents and settings\Owner\Application Data\AVG\Rescue\PC Tuneup 2011\111224190528226.rsc"
"c:\documents and settings\Owner\Desktop\Deep_Dish_-_Yoshiesque_Vol._1.exe"
"c:\documents and settings\Owner\Desktop\DTLite4454-0315.exe"
"c:\documents and settings\Owner\My Documents\KeyFinderInstaller.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Owner\Application Data\AVG\Rescue\PC Tuneup 2011\111224190528226.rsc
c:\documents and settings\Owner\Desktop\Deep_Dish_-_Yoshiesque_Vol._1.exe
c:\documents and settings\Owner\Desktop\DTLite4454-0315.exe
c:\documents and settings\Owner\My Documents\KeyFinderInstaller.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-10-17 to 2012-11-17 )))))))))))))))))))))))))))))))
.
.
2030-08-29 13:22 . 2030-08-29 13:22 56832 ——w- c:\windows\system32\iyvu9_32.dll
2030-08-29 13:22 . 2030-08-29 13:22 143872 ——w- c:\windows\system32\iacenc.dll
2012-11-17 23:25 . 2012-11-17 23:25 ——– d—–w- c:\program files\Common Files\Adobe
2012-11-17 01:09 . 2012-11-17 01:09 ——– d—–w- c:\program files\ESET
2012-11-17 00:36 . 2012-11-17 00:36 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-11-17 00:36 . 2012-09-30 03:54 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-11-16 20:55 . 2012-11-16 20:55 ——– d—–w- C:\TDSSKiller_Quarantine
2012-11-16 19:50 . 2012-11-16 19:50 ——– d—–w- c:\documents and settings\Administrator.OWNER-91716EBEA\Application Data\AVG2013
2012-11-16 19:49 . 2012-11-16 19:49 ——– d—–w- c:\documents and settings\Administrator.OWNER-91716EBEA\Local Settings\Application Data\Avg2013
2012-11-16 19:49 . 2012-11-16 19:49 ——– d—–w- c:\documents and settings\Administrator.OWNER-91716EBEA\Application Data\Apple Computer
2012-11-16 19:45 . 2012-11-16 19:45 ——– d—–w- c:\windows\ERUNT
2012-11-16 19:45 . 2012-11-16 19:45 ——– d—–w- C:\JRT
2012-11-14 15:33 . 2012-11-14 15:33 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Sun
2012-11-13 20:52 . 2012-10-02 18:04 58368 -c—-w- c:\windows\system32\dllcache\synceng.dll
2012-11-10 04:59 . 2012-11-10 04:59 ——– d—–w- c:\program files\Common Files\Java
2012-11-10 04:59 . 2012-11-10 04:59 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-11-10 04:59 . 2012-11-10 04:59 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-10 04:56 . 2012-11-10 04:56 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2012-11-10 04:56 . 2012-11-12 04:56 ——– d—–w- c:\program files\McAfee Security Scan
2012-11-10 02:08 . 2012-11-10 02:17 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\DownTango
2012-10-23 05:47 . 2012-10-23 05:47 ——– d—–w- c:\program files\iPod
2012-10-23 05:47 . 2012-10-23 05:48 ——– d—–w- c:\documents and settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-10 04:59 . 2010-07-26 20:07 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-11-10 04:59 . 2010-07-26 20:07 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-11-10 04:56 . 2012-04-07 23:20 697272 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-10 04:56 . 2011-06-15 17:28 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-11-08 22:29 . 2012-09-27 22:04 26984 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-10-22 21:02 . 2011-12-23 20:32 179936 —-a-w- c:\windows\system32\drivers\avgidsdriverx.sys
2012-10-22 08:37 . 2007-05-15 06:07 1866368 —-a-w- c:\windows\system32\win32k.sys
2012-10-15 11:48 . 2012-04-19 11:50 55776 —-a-w- c:\windows\system32\drivers\avgidshx.sys
2012-10-05 11:32 . 2011-03-01 21:25 93536 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2012-10-02 18:04 . 2004-08-04 13:00 58368 —-a-w- c:\windows\system32\synceng.dll
2012-10-02 10:30 . 2011-01-07 13:41 159712 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2012-09-21 10:46 . 2011-04-05 07:59 164832 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2012-09-21 10:46 . 2012-08-09 20:56 177376 —-a-w- c:\windows\system32\drivers\avglogx.sys
2012-09-21 10:45 . 2011-12-23 20:32 19936 —-a-w- c:\windows\system32\drivers\avgidsshimx.sys
2012-09-14 10:05 . 2011-03-16 23:03 35552 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2012-08-30 19:10 . 2012-09-15 00:13 888168 —-a-w- c:\windows\system32\nvdispgenco32.dll
2012-08-30 19:10 . 2012-09-15 00:13 5947392 —-a-w- c:\windows\system32\nvopencl.dll
2012-08-30 19:10 . 2011-10-12 21:00 7446528 —-a-w- c:\windows\system32\nvcuda.dll
2012-08-30 19:10 . 2011-10-12 21:00 2578792 —-a-w- c:\windows\system32\nvcuvid.dll
2012-08-30 19:10 . 2011-10-12 21:00 1866088 —-a-w- c:\windows\system32\nvcuvenc.dll
2012-08-30 19:10 . 2011-10-12 21:00 17551360 —-a-w- c:\windows\system32\nvcompiler.dll
2012-08-30 19:10 . 2011-10-12 21:00 1009512 —-a-w- c:\windows\system32\nvdispco32.dll
2012-08-30 19:10 . 2009-05-01 05:02 4494208 —-a-w- c:\windows\system32\nv4_disp.dll
2012-08-30 19:10 . 2009-05-01 05:02 12555680 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2012-08-30 19:10 . 2007-09-17 15:07 2376704 —-a-w- c:\windows\system32\nvapi.dll
2012-08-30 19:10 . 2007-09-17 15:07 19103744 —-a-w- c:\windows\system32\nvoglnt.dll
2012-08-30 16:44 . 2007-09-17 15:07 54272 —-a-w- c:\windows\system32\nvwddi.dll
2012-08-30 16:43 . 2007-09-17 15:07 164200 —-a-w- c:\windows\system32\nvsvc32.exe
2012-08-30 16:43 . 2007-09-17 15:07 15512424 —-a-w- c:\windows\system32\nvcpl.dll
2012-08-30 16:43 . 2011-10-12 21:01 143720 —-a-w- c:\windows\system32\nvcolor.exe
2012-08-30 16:43 . 2007-09-17 15:07 108392 —-a-w- c:\windows\system32\nvmctray.dll
2012-08-28 15:14 . 2007-05-15 06:07 916992 —-a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14 . 2004-08-04 13:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14 . 2004-08-04 13:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2004-08-04 13:00 385024 —-a-w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2004-08-04 13:00 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-08-21 20:01 . 2009-05-18 03:30 26840 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-08-21 20:01 . 2009-05-18 03:30 106928 —-a-w- c:\windows\system32\GEARAspi.dll
2012-08-21 13:33 . 2007-05-15 06:05 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2007-02-28 05:16 2027520 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-10-28 04:01 . 2012-10-28 04:01 261600 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Xvid"="c:\program files\Xvid\CheckUpdate.exe" [2011-01-17 8192]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Razer Naga Driver"="c:\program files\Razer\Naga\RazerNagaSysTray.exe" [2011-02-17 953744]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-28 59280]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-08-30 15512424]
"NvMediaCenter"="NvMCTray.dll" [2012-08-30 108392]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-08-30 1634112]
"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-11-07 3143800]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-10 421776]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-24 926896]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-09-30 766536]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2010-3-5 0]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.285\SSScheduler.exe [2012-9-5 271808]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GEST]
m‘|\ü [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-09-24 04:43 926896 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08 1259376 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2004-08-10 11:04 59392 —-a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-08-26 05:51 16851456 —-a-w- c:\windows\RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-07-03 17:04 252848 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"JavaQuickStarterService"=2 (0x2)
"Bonjour Service"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"f:\\Program Files\\World of Warcraft\\Launcher.exe"=
"f:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\VentSrv\\ventrilo_srv.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\BackgroundDownloader.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\Launcher.patch.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Program Files\\World of Warcraft Public Test\\LauncherB.exe"=
"c:\\Program Files\\StarCraft II\\StarCraft II.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\Owner\\Application Data\\Spotify\\spotify.exe"=
"c:\\Program Files\\Diablo III\\Diablo III.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.EXE"=
"c:\\Documents and Settings\\All Users\\Application Data\\Battle.net\\Agent\\Agent.1267\\Agent.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Battle.net\\Agent\\Agent.1363\\Agent.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Apps\\2.0\\P76R76HL.VBN\\Z8PJ4QKH.3OY\\curs..tion_9e9e83ddf3ed3ead_0005.0001_161f1f0e4761792c\\CurseClient.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"3389:TCP"= 3389:TCP:Remote Desktop
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [4/19/2012 03:50 AM 55776]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [8/9/2012 12:56 PM 177376]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [3/16/2011 03:03 PM 35552]
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys –> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [12/23/2011 12:32 PM 179936]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [12/23/2011 12:32 PM 19936]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [1/7/2011 05:41 AM 159712]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4/4/2011 11:59 PM 164832]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [9/27/2012 02:04 PM 26984]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [10/22/2012 01:05 PM 196664]
R3 RzSynapse;Razer Driver;c:\windows\system32\drivers\RzSynapse.sys [4/4/2011 03:49 PM 103424]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys –> c:\windows\system32\DRIVERS\vmci.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [11/6/2012 07:00 PM 5814392]
S2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe –> c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.285\McCHSvc.exe [9/5/2012 07:56 AM 234776]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - JAVAQUICKSTARTERSERVICE
*Deregistered* - MBAMSwissArmy
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 04:56]
.
2012-11-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MI1933~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = [removed] [removed] [removed]
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-vProt - c:\program files\AVG Secure Search\vprot.exe
HKLM-Run-ROC_ROC_NT - c:\program files\AVG Secure Search\ROC_ROC_NT.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-17 15:41
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2012-11-17 15:42:30
ComboFix-quarantined-files.txt 2012-11-17 23:42
ComboFix2.txt 2012-11-16 21:16
ComboFix3.txt 2011-06-18 23:13
ComboFix4.txt 2011-04-29 18:13
.
Pre-Run: 653,625,843,712 bytes free
Post-Run: 653,590,814,720 bytes free
.
- - End Of File - - BB53B80799FF84FE33C5D6EC87651DEA

We just have some housekeeping to do now,

Please do the following:


You can delete the FRT, aswMBR and TDSSKiller logs and programs from your desktop.


NEXT

Follow these steps to uninstall Combofix

• Make sure your security programs are totally disabled.
• Press the WinKey +R to open a run box
• Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

• Double click on adwcleaner.exe to run the tool.
• Click on Uninstall.
• Confirm with yes.

NEXT


Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

If there are any logs/tools remaining on your desktop > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

• It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
  Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
  
  
• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  
  
• Download TFC to your desktop
  
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
  It's normal after running TFC cleaner that the PC will be slower to boot the first time.
  
  
• WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop
  WOT has an addon available for both Firefox and IE
  
  
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
  
• In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
  PC Safety and Security–What Do I Need?.
• Simple and easy ways to keep your computer safe and secure on the Internet

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.