Spyware / Malware / Virus Removal

Win32/Small.CA virus [Closed]

27 min read

Looking for the outcome? Ask AI

fulladd Topic Starter

Post #1January 9, 2013, 8:32 AM UTC

Hi guys,

My computer turn into blue screen several times because of this "Win32/Small.CA".
I'm suspected this based on the message from Windows action centre asking me to "Remove the Win32/Small.CA virus"
It's also slow down my internet connection badly.

please help.

below info from HijackThis.exe;

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:29:27 AM, on 09-01-13
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16457)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe
C:\Windows\Integrator.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Chinyee\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Advanced SystemCare Browser Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\PROGRA~2\IObit\ADVANC~1\BROWER~1\ASCPLU~1.DLL
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Advanced SystemCare 6] "C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe" /AutoStart
O4 - Startup: AntiCrash.lnk = C:\Program Files (x86)\Dachshund Software\AntiCrash\AntiCrash.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Advanced SystemCare Service 6 (AdvancedSystemCareService6) - IObit - C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: DWA-123_PBC_WPS Service (DWA-123_PBC_WPS) - Unknown owner - C:\Program Files (x86)\D-Link\DWA-123\ALPBCSVC.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel® Capability Licensing Service Interface - Intel® Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel® Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NitroPDFReaderDriverCreatorReadSpool3 (NitroReaderDriverReadSpool3) - Nitro PDF Software - C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 7367 bytes

OCD

Post #2January 9, 2013, 3:33 PM UTC

Hello fulladd,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice, this will be a team effort. This may cause a delay, but I will do my best to keep it as short as possible. Please bear with me, I will post back to you as soon as I can.

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Important Note for Vista and Windows 7 users:

These tools MUST be run from the executable.(.exe) every time you run them with Admin Rights (Right click, choose "Run as Administrator")

Please stay with this topic until I let you know that your system appears to be "All Clear"

OCD

Post #3January 9, 2013, 9:44 PM UTC

Hi fulladd,

Download OTL to your desktop.

Right click and select "Run as Administrator".

Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
services.exe
/md5stop
DRIVES
CREATERESTOREPOINT
BASESERVICES
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Next

Download aswMBR.exe and save it to your desktop.

Right click and select "Run as Administrator".

When asked if you want to download Avast's virus definitions please select Yes.
Click Scan
Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

In your next post please provide the following:
OTL.txt
Extras.txt
aswMBR log

fulladd

Post #4January 11, 2013, 1:51 AM UTC

Hi, OCD.
Thanks for reply.
At the 1st time after i install OTL and run it as administrator, my computer turn into blue screen.
when I try to run it again attached error came out.
📎OTL_Application_error.jpg

Thus I perfrom window restore and I run again the OTL as per instruction, with only OTL.Txt come out without Extras.txt file.

Below is the OTL.Txt result;

OTL logfile created on: 10-01-13 9:32:08 PM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Chinyee\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MM-yy

7.70 Gb Total Physical Memory | 6.33 Gb Available Physical Memory | 82.29% Memory free
15.39 Gb Paging File | 13.93 Gb Available in Paging File | 90.49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 234.38 Gb Total Space | 195.34 Gb Free Space | 83.34% Space Free | Partition Type: NTFS
Drive D: | 231.28 Gb Total Space | 92.46 Gb Free Space | 39.98% Space Free | Partition Type: NTFS

Computer Name: CHINYEE-PC | User Name: Chinyee | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe (IObit)
PRC - C:\Program Files (x86)\IObit\Advanced SystemCare 6\Monitor.exe (IObit)
PRC - C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe (IObit)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)
PRC - C:\Program Files (x86)\D-Link\DWA-123\ALPBCSVC.exe ()
PRC - C:\Users\Chinyee\Desktop\OTL.exe (OldTimer Tools)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\IObit\Advanced SystemCare 6\madexcept_.bpl ()
MOD - C:\Program Files (x86)\IObit\Advanced SystemCare 6\maddisAsm_.bpl ()
MOD - C:\Program Files (x86)\IObit\Advanced SystemCare 6\madbasic_.bpl ()

========== Services (SafeList) ==========

SRV:64bit: - (NitroReaderDriverReadSpool3) – C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe (Nitro PDF Software)
SRV:64bit: - (NisSrv) – c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (Intel® – C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel® Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdvancedSystemCareService6) – C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe (IObit)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (jhi_service) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)
SRV - (cphs) – C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (DWA-123_PBC_WPS) – C:\Program Files (x86)\D-Link\DWA-123\ALPBCSVC.exe ()
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (anodlwf) – C:\Windows\SysNative\drivers\anodlwfx.sys ()
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (SmartDefragDriver) – C:\Windows\SysNative\drivers\SmartDefragDriver.sys ()
DRV:64bit: - (dmvsc) – C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (netr28ux) – C:\Windows\SysNative\drivers\Dnetr28ux.sys (Ralink Technology Corp.)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.my/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9E 2D 76 5D E9 D1 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {541609E3-A869-4B55-8BB2-02677498B745}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{541609E3-A869-4B55-8BB2-02677498B745}: "URL" = http://www.google.com/search?q={searchTerm…utputEncoding?}
IE - HKCU\..\SearchScopes\{8371A062-B09A-4C1F-A244-04FB083A8999}: "URL" = http://www.bing.com/search?FORM=BDKTDF&…rc=IE-SearchBox
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com.my/"
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.5
FF - prefs.js..extensions.enabledAddons: SkipScreen%40SkipScreen:0.7.0
FF - prefs.js..extensions.enabledAddons: %7B3d7eb24f-2740-49df-8937-200b1cc08f8a%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7B4DC70064-89E2-4a55-8FC6-E8CDEAE3618C%7D:0.7.7
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20120926
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.5
FF - prefs.js..extensions.enabledAddons: %7Be001c731-5e37-4538-a5cb-8168736a2360%7D:0.9.9.119
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012-12-31 15:25:09 | 000,000,000 | —D | M]

[2012-12-04 18:01:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Extensions
[2013-01-09 05:22:25 | 000,000,000 | —D | M] (No name found) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions
[2012-12-20 14:39:07 | 000,000,000 | —D | M] (WOT) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013-01-09 05:22:25 | 000,000,000 | —D | M] (Bitdefender QuickScan) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2012-12-21 21:15:42 | 000,000,000 | —D | M] (Advanced SystemCare Surfing Protection) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions\[removed]
[2012-12-20 16:29:34 | 000,124,993 | —- | M] () (No name found) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions\[removed]
[2012-12-20 14:43:03 | 000,021,861 | —- | M] () (No name found) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions\[removed]
[2012-12-20 14:39:07 | 000,071,037 | —- | M] () (No name found) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions\[removed]
[2012-12-20 16:33:54 | 000,097,169 | —- | M] () (No name found) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}.xpi
[2012-12-20 14:43:03 | 000,013,345 | —- | M] () (No name found) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi
[2012-12-28 12:14:04 | 000,533,036 | —- | M] () (No name found) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012-12-20 16:32:34 | 000,804,627 | —- | M] () (No name found) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012-12-20 14:39:07 | 000,243,496 | —- | M] () (No name found) – C:\Users\Chinyee\AppData\Roaming\Mozilla\Firefox\Profiles\rmw3pbqz.default-1355979957438\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2012-12-31 15:25:09 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012-11-29 16:27:51 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012-11-29 16:27:12 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012-11-29 16:27:12 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.google.com.my/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms}&sugkey;={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com.my/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\Chinyee\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Webmail Ad Blocker = C:\Users\Chinyee\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbhfdchmklhpcngcgjmpdbjakdggkkjp\3.2_0\
CHR - Extension: Adblock Plus = C:\Users\Chinyee\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.3.4_1\
CHR - Extension: Google Search = C:\Users\Chinyee\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: AdBlock = C:\Users\Chinyee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.54_0\
CHR - Extension: Advanced SystemCare Surfing Protection = C:\Users\Chinyee\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd\1.0.0_0\
CHR - Extension: Gmail = C:\Users\Chinyee\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2009-01-01 16:39:38 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Advanced SystemCare Browser Protection) - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files (x86)\IObit\Advanced SystemCare 6\BrowerProtect\ASCPlugin_Protection.dll (IObit)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [Advanced SystemCare 6] C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe (IObit)
O4 - Startup: C:\Users\Chinyee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AntiCrash.lnk = C:\Program Files (x86)\Dachshund Software\AntiCrash\AntiCrash.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.200.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CBF180C6-F8AE-42FA-A0C1-51B529E688B4}: DhcpNameServer = 192.168.200.254
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013-01-07 16:28:27 | 000,000,000 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (SmartDefragBootTime.exe)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013-01-10 21:08:37 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Chinyee\Desktop\OTL.exe
[2013-01-09 06:23:12 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2013-01-09 06:23:07 | 000,492,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\win32spl.dll
[2013-01-09 06:23:06 | 000,750,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\win32spl.dll
[2013-01-09 05:33:28 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2013-01-09 05:33:28 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2013-01-09 05:33:28 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2013-01-09 05:33:28 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013-01-09 05:33:28 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013-01-09 05:33:28 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2013-01-09 05:33:28 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013-01-09 05:33:28 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013-01-09 05:33:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013-01-09 05:33:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013-01-09 05:33:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013-01-09 05:33:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013-01-09 05:33:28 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013-01-09 05:33:28 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013-01-09 05:33:28 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2013-01-09 05:33:20 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2013-01-09 05:33:20 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2013-01-09 05:33:20 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2013-01-09 05:33:20 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2013-01-09 05:33:20 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2013-01-09 05:33:20 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013-01-09 05:33:20 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013-01-09 05:33:20 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013-01-09 05:33:20 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013-01-09 05:33:20 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013-01-09 05:33:20 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013-01-09 05:33:20 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013-01-09 05:33:20 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013-01-09 05:33:20 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013-01-09 05:33:20 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013-01-09 05:33:20 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013-01-09 05:33:20 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013-01-09 05:33:19 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2013-01-09 05:33:19 | 000,424,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2013-01-09 05:33:19 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2013-01-09 05:33:19 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013-01-09 05:33:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013-01-09 05:33:19 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013-01-09 05:33:19 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013-01-09 05:33:16 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskhost.exe
[2013-01-09 05:33:14 | 000,800,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\usp10.dll
[2013-01-09 05:22:36 | 000,000,000 | —D | C] – C:\Users\Chinyee\AppData\Roaming\QuickScan
[2013-01-09 04:27:15 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Chinyee\Desktop\HiJackThis.exe
[2013-01-09 03:51:27 | 000,000,000 | —D | C] – C:\Windows\temp
[2013-01-09 03:50:46 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2013-01-09 03:37:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\uTorrent
[2013-01-09 03:36:33 | 000,000,000 | —D | C] – C:\Users\Chinyee\AppData\Roaming\uTorrent
[2013-01-09 02:54:16 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2013-01-09 02:54:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013-01-09 02:53:52 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2013-01-07 13:09:47 | 000,000,000 | —D | C] – C:\Program Files\Enigma Software Group
[2013-01-04 17:36:17 | 000,000,000 | —D | C] – C:\Users\Chinyee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dachshund Software
[2013-01-04 17:36:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dachshund Software
[2013-01-04 17:36:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\Dachshund Software
[2013-01-04 13:44:50 | 000,000,000 | —D | C] – C:\found.001
[2013-01-04 09:16:25 | 000,000,000 | —D | C] – C:\Users\Chinyee\Desktop\fxdpm205f_fwhb120810wxpcien_c1f4
[2013-01-03 17:47:59 | 000,000,000 | —D | C] – C:\found.000
[2013-01-03 10:44:27 | 000,000,000 | —D | C] – C:\Windows\tasks\TaskDisabled
[2013-01-02 10:57:51 | 000,000,000 | —D | C] – C:\Users\Chinyee\AppData\Local\Programs
[2012-12-31 17:31:46 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012-12-31 17:31:46 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012-12-31 17:31:46 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012-12-31 17:31:45 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012-12-31 17:31:45 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012-12-31 17:31:45 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012-12-31 17:31:45 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012-12-31 17:31:45 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012-12-31 17:31:44 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012-12-31 17:31:44 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012-12-31 17:31:44 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012-12-31 17:31:44 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012-12-31 17:31:43 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012-12-31 17:31:43 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012-12-31 17:31:43 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012-12-28 17:18:41 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012-12-28 15:54:17 | 000,000,000 | —D | C] – C:\Users\Chinyee\AppData\Roaming\Opera
[2012-12-28 15:54:17 | 000,000,000 | —D | C] – C:\Users\Chinyee\AppData\Local\Opera
[2012-12-28 15:54:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\Opera
[2012-12-28 15:45:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free PDF to Word Doc Converter
[2012-12-28 15:45:39 | 000,000,000 | —D | C] – C:\Program Files (x86)\Free PDF to Word Doc Converter
[2012-12-28 15:38:48 | 000,000,000 | —D | C] – C:\Users\Chinyee\ISO DOCUMENT
[2012-12-26 11:13:32 | 000,032,600 | —- | C] (IObit) – C:\Windows\SysNative\SmartDefragBootTime.exe
[2012-12-26 11:12:25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Defrag 2
[2012-12-21 19:04:25 | 000,046,080 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012-12-21 19:04:25 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012-12-21 19:04:24 | 000,367,616 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012-12-21 19:04:24 | 000,295,424 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012-12-20 16:06:41 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 6
[2012-12-20 16:06:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\IObit
[2012-12-20 13:59:10 | 000,000,000 | R–D | C] – C:\Users\Chinyee\Documents\Scanned Documents
[2012-12-20 13:59:09 | 000,000,000 | —D | C] – C:\Users\Chinyee\Documents\Fax
[2012-12-20 13:47:57 | 000,000,000 | —D | C] – C:\Users\Chinyee\Documents\OneNote Notebooks
[2012-12-20 13:22:53 | 000,000,000 | —D | C] – C:\Users\Chinyee\Documents\Downloads
[2012-12-19 13:38:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012-12-19 13:38:11 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2012-12-19 13:38:11 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Silverlight
[2012-12-19 13:37:51 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2012-12-19 13:37:50 | 003,695,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2012-12-19 13:37:50 | 000,434,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2012-12-19 13:37:50 | 000,367,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2012-12-19 13:37:50 | 000,227,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieaksie.dll
[2012-12-19 13:37:50 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieakui.dll
[2012-12-19 13:37:50 | 000,162,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2012-12-19 13:37:50 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2012-12-19 13:37:50 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2012-12-19 13:37:50 | 000,130,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieakeng.dll
[2012-12-19 13:37:50 | 000,123,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2012-12-19 13:37:50 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2012-12-19 13:37:50 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2012-12-19 13:37:50 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\admparse.dll
[2012-12-19 13:37:50 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2012-12-19 13:37:50 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2012-12-19 13:37:50 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2012-12-19 13:37:50 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2012-12-19 13:37:50 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2012-12-19 13:37:50 | 000,066,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2012-12-19 13:37:50 | 000,063,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2012-12-19 13:37:50 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2012-12-19 13:37:50 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2012-12-19 13:37:50 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2012-12-19 13:37:50 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2012-12-19 13:37:50 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2012-12-19 13:37:49 | 003,695,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2012-12-19 13:37:49 | 000,534,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2012-12-19 13:37:49 | 000,452,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2012-12-19 13:37:49 | 000,448,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2012-12-19 13:37:49 | 000,282,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2012-12-19 13:37:49 | 000,267,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieaksie.dll
[2012-12-19 13:37:49 | 000,222,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2012-12-19 13:37:49 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2012-12-19 13:37:49 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieakui.dll
[2012-12-19 13:37:49 | 000,160,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieakeng.dll
[2012-12-19 13:37:49 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2012-12-19 13:37:49 | 000,145,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2012-12-19 13:37:49 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2012-12-19 13:37:49 | 000,114,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\admparse.dll
[2012-12-19 13:37:49 | 000,111,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2012-12-19 13:37:49 | 000,103,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2012-12-19 13:37:49 | 000,091,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2012-12-19 13:37:49 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2012-12-19 13:37:49 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2012-12-19 13:37:49 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2012-12-19 13:37:49 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2012-12-19 13:37:49 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2012-12-19 13:37:49 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2012-12-19 13:37:49 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2012-12-19 13:37:49 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2012-12-19 13:37:49 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2012-12-19 13:37:49 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2012-12-19 13:37:49 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2012-12-19 13:37:49 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2012-12-19 13:37:48 | 000,165,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2012-12-19 13:37:48 | 000,160,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2012-12-19 12:42:56 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RdpGroupPolicyExtension.dll
[2012-12-19 12:42:56 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll
[2012-12-19 12:42:56 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe
[2012-12-19 12:42:55 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\TsUsbGD.sys
[2012-12-19 12:42:55 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\rdpvideominiport.sys
[2012-12-19 12:42:54 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\TsUsbFlt.sys
[2012-12-19 12:42:51 | 000,384,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wksprt.exe
[2012-12-19 12:42:51 | 000,322,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\aaclient.dll
[2012-12-19 12:42:51 | 000,269,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\aaclient.dll
[2012-12-19 12:42:51 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpudd.dll
[2012-12-19 12:42:51 | 000,228,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpendp_winip.dll
[2012-12-19 12:42:51 | 000,192,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rdpendp_winip.dll
[2012-12-19 12:42:51 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TSWbPrxy.exe
[2012-12-19 12:42:51 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MsRdpWebAccess.dll
[2012-12-19 12:42:51 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MsRdpWebAccess.dll
[2012-12-19 12:42:51 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tsgqec.dll
[2012-12-19 12:42:51 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsUsbGDCoInstaller.dll
[2012-12-19 12:42:51 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tsgqec.dll
[2012-12-19 12:42:51 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wksprtPS.dll
[2012-12-19 12:42:51 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wksprtPS.dll
[2012-12-19 12:42:50 | 005,773,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2012-12-19 12:42:50 | 004,916,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2012-12-19 12:42:50 | 003,174,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorets.dll
[2012-12-19 12:42:50 | 001,123,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstsc.exe
[2012-12-19 12:42:50 | 001,048,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstsc.exe
[2012-12-19 11:07:07 | 001,448,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lsasrv.dll
[2012-12-19 11:07:06 | 000,902,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d2d1.dll
[2012-12-19 11:07:04 | 000,514,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\qdvd.dll
[2012-12-19 11:07:04 | 000,366,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\qdvd.dll
[2012-12-17 16:38:43 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012-12-17 16:38:40 | 000,025,928 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012-12-17 16:38:39 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012-12-14 13:37:51 | 000,000,000 | —D | C] – C:\Users\Chinyee\AppData\Local\ElevatedDiagnostics
[2012-12-13 10:44:02 | 000,478,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnet.dll
[2012-12-13 10:44:02 | 000,376,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnet.dll
[2012-12-12 11:48:10 | 000,000,000 | —D | C] – C:\Windows\SysWow64\Wat
[2012-12-12 11:48:10 | 000,000,000 | —D | C] – C:\Windows\SysNative\Wat
[2012-12-12 11:43:57 | 000,054,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\WdfLdr.sys
[2012-12-12 11:43:57 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\Wdfres.dll

========== Files - Modified Within 30 Days ==========

[2013-01-10 21:30:33 | 000,064,512 | -H– | M] () – C:\Users\Chinyee\AppData\Roaming\dach100.dll
[2013-01-10 21:30:31 | 000,000,896 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013-01-10 21:30:17 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013-01-10 21:30:14 | 1903,538,175 | -HS- | M] () – C:\hiberfil.sys
[2013-01-10 21:13:31 | 000,019,200 | —- | M] () – C:\Users\Chinyee\Desktop\OTL Application error.jpg
[2013-01-10 02:05:00 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013-01-09 08:17:34 | 000,021,904 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013-01-09 08:17:34 | 000,021,904 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013-01-09 08:14:43 | 000,726,316 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013-01-09 08:14:43 | 000,623,940 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013-01-09 08:14:43 | 000,106,316 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013-01-09 07:48:29 | 000,343,352 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013-01-09 04:27:21 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Chinyee\Desktop\HiJackThis.exe
[2013-01-07 16:28:27 | 000,000,000 | —- | M] () – C:\autoexec.bat
[2013-01-07 15:16:42 | 000,000,000 | -H– | M] () – C:\miniex.ant
[2013-01-04 17:40:09 | 000,000,178 | -H– | M] () – C:\Windows\winshell.dat
[2013-01-04 17:39:25 | 000,000,072 | —- | M] () – C:\Windows\anticrash.dat
[2013-01-04 17:36:17 | 000,001,163 | —- | M] () – C:\Users\Chinyee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AntiCrash.lnk
[2013-01-02 10:58:05 | 000,001,120 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012-12-31 14:49:56 | 000,007,596 | —- | M] () – C:\Users\Chinyee\AppData\Local\Resmon.ResmonCfg
[2012-12-28 15:54:16 | 000,001,864 | —- | M] () – C:\Users\Chinyee\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
[2012-12-26 11:12:25 | 000,001,181 | —- | M] () – C:\Users\Public\Desktop\Smart Defrag 2.lnk
[2012-12-20 14:24:17 | 000,000,375 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.ics
[2012-12-20 12:51:35 | 000,000,000 | -H– | M] () – C:\Users\Chinyee\Documents\Default.rdp
[2012-12-20 10:10:47 | 000,000,406 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2012-12-19 13:56:20 | 000,001,448 | —- | M] () – C:\Users\Chinyee\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012-12-19 13:37:51 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2012-12-19 13:37:50 | 003,695,416 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2012-12-19 13:37:50 | 000,434,176 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2012-12-19 13:37:50 | 000,367,104 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2012-12-19 13:37:50 | 000,227,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieaksie.dll
[2012-12-19 13:37:50 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieakui.dll
[2012-12-19 13:37:50 | 000,162,304 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2012-12-19 13:37:50 | 000,152,064 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2012-12-19 13:37:50 | 000,150,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2012-12-19 13:37:50 | 000,130,560 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieakeng.dll
[2012-12-19 13:37:50 | 000,123,392 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2012-12-19 13:37:50 | 000,118,784 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2012-12-19 13:37:50 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2012-12-19 13:37:50 | 000,101,888 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\admparse.dll
[2012-12-19 13:37:50 | 000,086,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2012-12-19 13:37:50 | 000,078,848 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2012-12-19 13:37:50 | 000,076,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2012-12-19 13:37:50 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2012-12-19 13:37:50 | 000,074,240 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2012-12-19 13:37:50 | 000,072,822 | —- | M] () – C:\Windows\SysWow64\ieuinit.inf
[2012-12-19 13:37:50 | 000,066,048 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2012-12-19 13:37:50 | 000,063,488 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2012-12-19 13:37:50 | 000,054,272 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2012-12-19 13:37:50 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2012-12-19 13:37:50 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2012-12-19 13:37:50 | 000,023,552 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2012-12-19 13:37:50 | 000,010,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2012-12-19 13:37:49 | 003,695,416 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2012-12-19 13:37:49 | 000,534,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2012-12-19 13:37:49 | 000,452,608 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2012-12-19 13:37:49 | 000,448,512 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2012-12-19 13:37:49 | 000,282,112 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2012-12-19 13:37:49 | 000,267,776 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieaksie.dll
[2012-12-19 13:37:49 | 000,222,208 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2012-12-19 13:37:49 | 000,197,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2012-12-19 13:37:49 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieakui.dll
[2012-12-19 13:37:49 | 000,160,256 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2012-12-19 13:37:49 | 000,160,256 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieakeng.dll
[2012-12-19 13:37:49 | 000,149,504 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2012-12-19 13:37:49 | 000,145,920 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2012-12-19 13:37:49 | 000,135,168 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2012-12-19 13:37:49 | 000,114,176 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\admparse.dll
[2012-12-19 13:37:49 | 000,111,616 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2012-12-19 13:37:49 | 000,103,936 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2012-12-19 13:37:49 | 000,091,648 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2012-12-19 13:37:49 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2012-12-19 13:37:49 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2012-12-19 13:37:49 | 000,085,504 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2012-12-19 13:37:49 | 000,082,432 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2012-12-19 13:37:49 | 000,076,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2012-12-19 13:37:49 | 000,072,822 | —- | M] () – C:\Windows\SysNative\ieuinit.inf
[2012-12-19 13:37:49 | 000,065,024 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2012-12-19 13:37:49 | 000,049,664 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2012-12-19 13:37:49 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2012-12-19 13:37:49 | 000,039,936 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2012-12-19 13:37:49 | 000,030,720 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2012-12-19 13:37:49 | 000,012,288 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2012-12-19 13:37:49 | 000,010,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2012-12-19 13:37:48 | 000,165,888 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2012-12-17 01:11:22 | 000,046,080 | —- | M] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012-12-16 22:45:03 | 000,367,616 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012-12-16 22:13:28 | 000,295,424 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012-12-16 22:13:20 | 000,034,304 | —- | M] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012-12-15 16:05:44 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf

========== Files Created - No Company Name ==========

[2013-01-10 21:11:02 | 000,019,200 | —- | C] () – C:\Users\Chinyee\Desktop\OTL Application error.jpg
[2013-01-07 16:28:27 | 000,000,000 | —- | C] () – C:\autoexec.bat
[2013-01-07 15:16:42 | 000,000,000 | -H– | C] () – C:\miniex.ant
[2013-01-04 17:36:19 | 000,000,178 | -H– | C] () – C:\Windows\winshell.dat
[2013-01-04 17:36:17 | 000,001,163 | —- | C] () – C:\Users\Chinyee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AntiCrash.lnk
[2012-12-28 17:00:11 | 000,000,900 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012-12-28 17:00:11 | 000,000,896 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012-12-28 15:54:16 | 000,001,864 | —- | C] () – C:\Users\Chinyee\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
[2012-12-28 15:54:16 | 000,001,852 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
[2012-12-26 11:12:26 | 000,017,720 | —- | C] () – C:\Windows\SysNative\drivers\SmartDefragDriver.sys
[2012-12-26 11:12:25 | 000,001,181 | —- | C] () – C:\Users\Public\Desktop\Smart Defrag 2.lnk
[2012-12-20 12:51:35 | 000,000,000 | -H– | C] () – C:\Users\Chinyee\Documents\Default.rdp
[2012-12-19 13:37:50 | 000,072,822 | —- | C] () – C:\Windows\SysWow64\ieuinit.inf
[2012-12-19 13:37:49 | 000,072,822 | —- | C] () – C:\Windows\SysNative\ieuinit.inf
[2012-12-19 09:41:58 | 000,007,596 | —- | C] () – C:\Users\Chinyee\AppData\Local\Resmon.ResmonCfg
[2012-12-17 16:38:43 | 000,001,120 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012-12-15 16:05:44 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012-12-12 11:43:59 | 000,000,003 | —- | C] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012-12-10 16:23:59 | 000,000,406 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2012-12-04 14:21:24 | 013,026,304 | —- | C] () – C:\Windows\SysWow64\ig7icd32.dll
[2012-12-04 14:21:24 | 000,755,572 | —- | C] () – C:\Windows\SysWow64\igkrng700.bin
[2012-12-04 14:21:24 | 000,559,972 | —- | C] () – C:\Windows\SysWow64\igfcg700m.bin
[2012-12-04 14:21:24 | 000,058,880 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2012-12-04 14:17:53 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2012-12-04 14:17:50 | 000,035,555 | —- | C] () – C:\Windows\Ascd_tmp.ini
[2012-04-20 13:59:44 | 000,001,536 | —- | C] () – C:\Windows\SysWow64\IusEventLog.dll
[2011-02-10 12:03:48 | 000,000,326 | —- | C] () – C:\Windows\primopdf.ini
[2009-01-01 16:41:25 | 000,064,512 | -H– | C] () – C:\Users\Chinyee\AppData\Roaming\dach100.dll

========== ZeroAccess Check ==========

[2009-07-14 12:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012-06-09 13:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012-06-09 12:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009-07-14 09:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010-11-21 11:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009-07-14 09:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012-12-06 10:31:06 | 000,000,000 | —D | M] – C:\Users\Chinyee\AppData\Roaming\FileOpen
[2013-01-11 13:23:06 | 000,000,000 | —D | M] – C:\Users\Chinyee\AppData\Roaming\IObit
[2012-12-28 15:43:06 | 000,000,000 | —D | M] – C:\Users\Chinyee\AppData\Roaming\Nitro
[2012-12-17 08:59:39 | 000,000,000 | —D | M] – C:\Users\Chinyee\AppData\Roaming\Nitro PDF
[2012-12-28 15:54:17 | 000,000,000 | —D | M] – C:\Users\Chinyee\AppData\Roaming\Opera
[2012-12-06 10:00:20 | 000,000,000 | —D | M] – C:\Users\Chinyee\AppData\Roaming\PrimoPDF
[2013-01-09 05:22:41 | 000,000,000 | —D | M] – C:\Users\Chinyee\AppData\Roaming\QuickScan
[2012-12-07 14:58:19 | 000,000,000 | —D | M] – C:\Users\Chinyee\AppData\Roaming\TechSmith
[2013-01-10 21:30:57 | 000,000,000 | —D | M] – C:\Users\Chinyee\AppData\Roaming\uTorrent

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011-02-26 13:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011-02-25 14:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011-02-25 14:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011-02-26 14:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010-11-21 11:24:25 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011-02-25 13:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011-02-25 13:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010-11-21 11:24:11 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: SERVICES.EXE >
[2009-07-14 09:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\SysNative\services.exe
[2009-07-14 09:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SVCHOST.EXE >
[2012-12-14 16:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009-07-14 09:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009-07-14 09:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009-07-14 09:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009-07-14 09:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010-11-21 11:23:55 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010-11-21 11:23:55 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010-11-21 11:24:28 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SysNative\userinit.exe
[2010-11-21 11:24:28 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010-11-21 11:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010-11-21 11:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2012-12-14 16:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: WDC WD5000AAKX-08ERMA0 ATA Device
Partitions: 3
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 100.00MB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 234.00GB
Starting Offset: 105906176
Hidden sectors: 0

DeviceID: Disk #0, Partition #2
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 231.00GB
Starting Offset: 251770437632
Hidden sectors: 0

========== Base Services ==========
SRV:64bit: - [2009-07-14 09:40:01 | 000,072,192 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\aelupsvc.dll – (AeLookupSvc)
SRV:64bit: - [2010-11-21 11:24:08 | 000,070,656 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\appinfo.dll – (Appinfo)
SRV:64bit: - [2009-07-14 09:38:55 | 000,079,360 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\alg.exe – (ALG)
SRV:64bit: - [2010-11-21 11:23:51 | 000,849,920 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\qmgr.dll – (BITS)
SRV:64bit: - [2010-11-21 11:24:00 | 000,705,024 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\BFE.DLL – (BFE)
SRV:64bit: - [2011-11-17 14:33:55 | 000,031,232 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\lsass.exe – (KeyIso)
SRV:64bit: - [2009-07-14 09:40:50 | 000,402,944 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\es.dll – (EventSystem)
SRV - [2009-07-14 09:15:19 | 000,271,360 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\es.dll – (EventSystem)
SRV:64bit: - [2012-07-05 06:13:27 | 000,136,704 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\browser.dll – (Browser)
SRV:64bit: - [2012-06-02 13:41:28 | 000,184,320 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\cryptsvc.dll – (CryptSvc)
SRV - [2012-06-02 12:36:29 | 000,140,288 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\cryptsvc.dll – (CryptSvc)
SRV:64bit: - [2010-11-21 11:24:01 | 000,512,000 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\rpcss.dll – (DcomLaunch)
SRV:64bit: - [2010-11-21 11:24:00 | 000,317,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\dhcpcore.dll – (Dhcp)
SRV - [2010-11-21 11:24:09 | 000,254,464 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\dhcpcore.dll – (Dhcp)
SRV:64bit: - [2011-03-03 14:24:16 | 000,183,296 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\dnsrslvr.dll – (Dnscache)
SRV:64bit: - [2009-07-14 09:40:35 | 000,111,104 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\eapsvc.dll – (EapHost)
SRV:64bit: - [2009-07-14 09:41:00 | 000,038,912 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\hidserv.dll – (hidserv)
SRV - [2009-07-14 09:15:24 | 000,049,152 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysWOW64\hidserv.dll – (hidserv)
SRV:64bit: - [2009-07-14 09:41:10 | 000,359,424 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\SysNative\ipnathlp.dll – (SharedAccess)
SRV:64bit: - [2010-11-21 11:23:48 | 000,501,248 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\IPSECSVC.DLL – (PolicyAgent)
SRV:64bit: - [2012-09-12 21:21:48 | 000,022,072 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV:64bit: - [2012-09-12 21:21:48 | 000,368,896 | —- | M] (Microsoft Corporation) [On_Demand | Running] – c:\Program Files\Microsoft Security Client\NisSrv.exe – (NisSrv)
SRV:64bit: - [2009-07-14 09:41:54 | 000,524,288 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\swprv.dll – (swprv)
SRV:64bit: - [2009-07-14 09:41:26 | 000,067,584 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\SysNative\mmcss.dll – (MMCSS)
SRV:64bit: - [2009-07-14 09:41:52 | 000,360,448 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\netman.dll – (Netman)
SRV:64bit: - [2009-07-14 09:41:52 | 000,459,776 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\netprofm.dll – (netprofm)
SRV - [2009-07-14 09:16:03 | 000,360,448 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysWOW64\netprofm.dll – (netprofm)
SRV:64bit: - [2012-10-04 01:44:21 | 000,303,104 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\nlasvc.dll – (NlaSvc)
SRV:64bit: - [2009-07-14 09:41:53 | 000,025,600 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\nsisvc.dll – (nsi)
SRV:64bit: - [2011-05-24 19:42:55 | 000,404,480 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\umpnpmgr.dll – (PlugPlay)
SRV:64bit: - [2012-02-11 14:36:02 | 000,559,104 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\spoolsv.exe – (Spooler)
SRV:64bit: - [2011-11-17 14:33:55 | 000,031,232 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\lsass.exe – (ProtectedStorage)
No service found with a name of EMDMgmt
SRV:64bit: - [2009-07-14 09:41:53 | 000,099,328 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\rasauto.dll – (RasAuto)
SRV:64bit: - [2010-11-21 11:24:17 | 000,344,064 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\rasmans.dll – (RasMan)
SRV:64bit: - [2010-11-21 11:24:01 | 000,512,000 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\rpcss.dll – (RpcSs)
SRV:64bit: - [2010-11-21 11:24:16 | 000,030,720 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\seclogon.dll – (seclogon)
SRV:64bit: - [2011-11-17 14:33:55 | 000,031,232 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\lsass.exe – (SamSs)
SRV:64bit: - [2009-07-14 09:41:58 | 000,097,280 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wscsvc.dll – (wscsvc)
SRV:64bit: - [2010-11-21 11:23:48 | 000,236,032 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\srvsvc.dll – (LanmanServer)
SRV:64bit: - [2010-11-21 11:23:55 | 000,370,688 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\shsvcs.dll – (ShellHWDetection)
SRV - [2010-11-21 11:24:03 | 000,328,192 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\shsvcs.dll – (ShellHWDetection)
No service found with a name of slsvc
SRV:64bit: - [2010-11-21 11:24:16 | 001,110,016 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\schedsvc.dll – (Schedule)
SRV:64bit: - [2010-11-21 11:24:32 | 000,316,928 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\tapisrv.dll – (TapiSrv)
SRV - [2010-11-21 11:24:00 | 000,242,176 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysWOW64\tapisrv.dll – (TapiSrv)
SRV:64bit: - [2009-07-14 09:41:55 | 000,044,544 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\themeservice.dll – (Themes)
SRV:64bit: - [2012-05-01 13:40:20 | 000,209,920 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\profsvc.dll – (ProfSvc)
SRV:64bit: - [2010-11-21 11:23:55 | 001,600,512 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\VSSVC.exe – (VSS)
SRV:64bit: - [2010-11-21 11:24:32 | 000,679,424 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\audiosrv.dll – (AudioSrv)
SRV:64bit: - [2010-11-21 11:24:32 | 000,679,424 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\audiosrv.dll – (AudioEndpointBuilder)
SRV:64bit: - [2010-11-21 11:25:06 | 000,170,496 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\sdrsvc.dll – (SDRSVC)
SRV:64bit: - [2009-07-14 09:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2010-11-21 11:23:55 | 001,646,080 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wevtsvc.dll – (eventlog)
SRV:64bit: - [2010-11-21 11:24:28 | 000,828,416 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\MPSSVC.dll – (MpsSvc)
SRV:64bit: - [2010-11-21 11:24:48 | 000,580,096 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\wiaservc.dll – (stisvc)
SRV:64bit: - [2010-11-21 11:24:15 | 000,128,000 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\msiexec.exe – (msiserver)
SRV - [2010-11-21 11:24:28 | 000,073,216 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysWow64\msiexec.exe – (msiserver)
SRV:64bit: - [2009-07-14 09:41:56 | 000,242,688 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wbem\WMIsvc.dll – (Winmgmt)
SRV:64bit: - [2012-06-03 06:19:43 | 002,428,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wuaueng.dll – (wuauserv)
SRV:64bit: - [2010-11-21 11:24:09 | 000,252,416 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\dot3svc.dll – (dot3svc)
SRV:64bit: - [2009-07-14 09:41:56 | 000,886,784 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wlansvc.dll – (Wlansvc)
SRV:64bit: - [2010-11-21 11:24:32 | 000,118,784 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wkssvc.dll – (LanmanWorkstation)

< End of report >

fulladd

Post #5January 11, 2013, 2:03 AM UTC

Hi, OCD, FYI, I've change computer time from PM just now to AM this becasue I just notice that the time was wrong. FYI, during i download the "aswMBR.exe" file my computer one more time turn into blue screen. After restart the window below image came out; 📎Unhandle_Exception.jpg at this moment I'm download the aswMBR.exe one more time and will post the result.

fulladd

Post #6January 11, 2013, 2:33 AM UTC

hi, OCD, Attached is the MBR.zip file 📎MBR.zip Below is the result from AswMBR log; aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2013-01-10 10:07:47 —————————– 10:07:47.077 OS Version: Windows x64 6.1.7601 Service Pack 1 10:07:47.077 Number of processors: 4 586 0x3A09 10:07:47.077 ComputerName: CHINYEE-PC UserName: Chinyee 10:07:47.545 Initialize success 10:28:06.166 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 10:28:06.166 Disk 0 Vendor: WDC_WD5000AAKX-08ERMA0 19.01H19 Size: 476940MB BusType: 3 10:28:06.182 Disk 0 MBR read successfully 10:28:06.182 Disk 0 MBR scan 10:28:06.182 Disk 0 Windows 7 default MBR code 10:28:06.182 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048 10:28:06.197 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 240006 MB offset 206848 10:28:06.213 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 236831 MB offset 491739136 10:28:06.260 Disk 0 scanning C:\Windows\system32\drivers 10:28:10.269 Service scanning 10:28:20.003 Modules scanning 10:28:20.003 Disk 0 trace - called modules: 10:28:20.019 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 10:28:20.019 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80077c2060] 10:28:20.034 3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> [0xfffffa8007199580] 10:28:20.034 5 ACPI.sys[fffff88000f917a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0xfffffa800719b060] 10:28:20.050 Scan finished successfully 10:28:31.017 Disk 0 MBR has been saved successfully to "C:\Users\Chinyee\Desktop\MBR.dat" 10:28:31.017 The log file has been saved successfully to "C:\Users\Chinyee\Desktop\aswMBR.txt"

OCD

Post #7January 12, 2013, 10:02 PM UTC

Hi fulladd,

You stated that Windows Action Centre is asking you to "Remove the Win32/Small.CA virus". Can you please tell me what file it is reporting as being infected?

= = = = = = = = = = = = = = = = = = = =

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Right click GMER.exe and select "Run as Administrator" The program will begin to run.
[external image: Posted Image]
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

In your next post please provide the following:
What is the infected file name?
Gmer.txt

fulladd

Post #8January 14, 2013, 4:29 AM UTC

Hi, OCD,

1) Yes, Windows Action Centre is asking me to "Remove the Win32/Small.CA virus" as per below image.
📎Remove_the_virus_from_your_PC.jpg

Honestly I dont know what file it is reporting as being infected because nothing was detected when scan using "Malwarebytes Anti-Malware"

2) Below is the result from "Gmer.txt";

GMER 2.0.18444 - http://www.gmer.net
Rootkit scan 2013-01-14 12:24:58
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 WDC_WD5000AAKX-08ERMA0 rev.19.01H19 465.76GB
Running: gmer.exe; Driver: C:\Users\Chinyee\AppData\Local\Temp\fwriafog.sys

—- Threads - GMER 2.0 —-

Thread C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [3252:3380] 00000000722065e7
—- Processes - GMER 2.0 —-

Library ? (*** suspicious ***) @ C:\Program Files\Windows Media Player\wmpnetwk.exe [3188] 000007fef7150000
Library ? (*** suspicious ***) @ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [3252] 00000000764a0000

—- EOF - GMER 2.0 —-

OCD

Post #9January 14, 2013, 4:08 PM UTC

Hi fulladd,

I have a few questions:

When did the blue screen issue first begin?
Have you installed any new hardware recently?
Added any memory (RAM)?
Installed any new software?

= = = = = = = = = = = = = = = = = = = =

In the Windows Action Center, under the Messages Details there is an Additional Info section. Please click on that and see if there is more information about the Win32/Small.CA virus.

Next

Please delete the copy of Gmer you currently have, reboot, then download a fresh copy and run a new scan.
(refer to the instructions in previous post)

Next

Please run Eset Online Scanner

Administrator rights are required to run ESET Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.

In your next post please provide the following:
Answers to the questions presented.
Windows Action Center information about the virus
Gmer.txt
ESET's log.txt

fulladd

Post #10January 15, 2013, 1:19 AM UTC

Hi, OCD, 1) Honestly I cannot remember when the blue screen issue first begin. Believed it's almost a month now. 2) No new hardware installed recently. 3) No added any new memory (RAM). I do open and re-place RAM back previously try to solve the blue screen. 4) Yes, I've Installed lots of new software. I've notice the blue screen appears and occurs after i've installed "TuneUp Utilities 2013" with crack. Thus i've uninstall it back. Sadly the blue scrren wont disappear and Windows Action Centre keep asking me to "Remove the Win32/Small.CA virus" 5) Kindky refer below image for details from Messages Details; 📎Action_center.jpg

fulladd

Post #11January 15, 2013, 1:48 AM UTC

Hi, OCD,

Below is the result from GMER.txt

GMER 2.0.18444 - http://www.gmer.net
Rootkit scan 2013-01-15 09:46:05
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 WDC_WD5000AAKX-08ERMA0 rev.19.01H19 465.76GB
Running: gmer.exe; Driver: C:\Users\Chinyee\AppData\Local\Temp\fwriafog.sys

—- Threads - GMER 2.0 —-

Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3440:3652] 000007fefb712a7c
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3440:3776] 000007fef7805124
—- Processes - GMER 2.0 —-

Library ? (*** suspicious ***) @ C:\Program Files\Windows Media Player\wmpnetwk.exe [3440] 000007fefd0f0000
Library ? (*** suspicious ***) @ C:\Windows\system32\sppsvc.exe [2260] 000007fef15d0000

—- EOF - GMER 2.0 —-

fulladd

Post #12January 15, 2013, 8:02 AM UTC

HI, OCD, Until this moment i'm unable to scan this computer using "Eset Online Scanner". I've try so many time. Re install after restart but the same problem occur. This computer will turn to blue screen so many times and sometime the "window explorer" not working.

OCD

Post #13January 15, 2013, 5:17 PM UTC

Hi fulladd,

P2P - I see you have/had P2P software uTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections and possibly Identity Theft. It likely contributed to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

I strongly suggest you remove the following P2P program.

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

uTorrent

If you choose to not remove these programs please refrain from using them until we have finished cleaning your computer.

Aside from the dangers of using P2P programs, it is against the law to have/use cracked software that has not be obtained legally. Therefore, I must insist that you uninstall the cracked software or I will be unable to assist you further.

= = = = = = = = = = = = = = = = = = = =

3) No added any new memory (RAM). I do open and re-place RAM back previously try to solve the blue screen.

Could you please clarify this statement?

Did you mean you removed the existing RAM modules and then reinstalled the same RAM modules?
Or did you remove the existing RAM modules and replace them with different RAM modules?

Next

Please download MiniToolBox, save it to your desktop and run it.
Right click and select "Run as Administrator".

Check-mark the following check-boxes:

Flush DNS
Report IE Proxy Settings
Reset IE Proxy Settings
Report FF Proxy Settings
Reset FF Proxy Settings
List content of Hosts
List IP configuration
List Winsock Entries
List last 10 Event Viewer log
List Installed Programs
List Users, Partitions and Memory size.
List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.

In your next post please provide the following:
Reassurance that you have uninstalled the cracked software.
Clarification on the RAM question.
Result.txt

fulladd

Post #14January 16, 2013, 9:40 AM UTC last edited January 16, 2013, 9:57 AM UTC

Hi, OCD, 1) I've uninstalled crack software before, I also uninstalled all software which installed after blue screen appears. 2) Yes, I removed the existing RAM modules and then reinstalled the same RAM modules. 3) Result.txt from "MiniToolBox" MiniToolBox by Farbar Version:10-01-2013 Ran by [removed] (administrator) on 16-01-2013 at 17:56:31 Running from "C:\Users\Chinyee\Desktop" Windows 7 Professional Service Pack 1 (X64) Boot Mode: Normal *************************************************************************** ========================= Flush DNS: =================================== Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========================= IE Proxy Settings: ============================== Proxy is not enabled. No Proxy Server is set. "Reset IE Proxy Settings": IE Proxy Settings were reset. ========================= FF Proxy Settings: ============================== "Reset FF Proxy Settings": Firefox Proxy settings were reset. ========================= Hosts content: ================================= 127.0.0.1 localhost ========================= IP Configuration: ================================ D-Link DWA-123 Wireless N 150 USB Adapter = Wireless Network Connection 4 (Connected) Realtek PCIe GBE Family Controller = Local Area Connection (Media disconnected) # ———————————- # IPv4 Configuration # ———————————- pushd interface ipv4 reset set global icmpredirects=enabled popd # End of IPv4 configuration Windows IP Configuration Host Name . . . . . . . . . . . . : Chinyee-PC Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : Home Wireless LAN adapter Wireless Network Connection 4: Connection-specific DNS Suffix . : Home Description . . . . . . . . . . . : D-Link DWA-123 Wireless N 150 USB Adapter #4 Physical Address. . . . . . . . . : B8-A3-86-91-FC-C8 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::bceb:c04a:d896:2b83%18(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.200.32(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Wednesday, January 16, 2013 5:50:17 PM Lease Expires . . . . . . . . . . : Thursday, January 17, 2013 5:50:17 PM Default Gateway . . . . . . . . . : fe80::1%18 192.168.200.254 DHCP Server . . . . . . . . . . . : 192.168.200.254 DHCPv6 IAID . . . . . . . . . . . : 414753670 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-4F-4F-37-50-46-5D-64-E5-29 DNS Servers . . . . . . . . . . . : 192.168.200.254 NetBIOS over Tcpip. . . . . . . . : Enabled Ethernet adapter Local Area Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller Physical Address. . . . . . . . . : 50-46-5D-64-E5-29 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Tunnel adapter isatap.Home: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Teredo Tunneling Pseudo-Interface: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Server: Innacomm.Home Address: 192.168.200.254 Name: google.com Addresses: 2404:6800:4001:c01::71 74.125.135.100 74.125.135.139 74.125.135.138 74.125.135.102 74.125.135.113 74.125.135.101 Pinging google.com [74.125.135.100] with 32 bytes of data: Reply from 74.125.135.100: bytes=32 time=37ms TTL=53 Reply from 74.125.135.100: bytes=32 time=37ms TTL=53 Ping statistics for 74.125.135.100: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 37ms, Maximum = 37ms, Average = 37ms Server: Innacomm.Home Address: 192.168.200.254 Name: yahoo.com Addresses: 206.190.36.45 98.138.253.109 98.139.183.24 Pinging yahoo.com [206.190.36.45] with 32 bytes of data: Reply from 206.190.36.45: bytes=32 time=284ms TTL=53 Reply from 206.190.36.45: bytes=32 time=298ms TTL=53 Ping statistics for 206.190.36.45: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 284ms, Maximum = 298ms, Average = 291ms Pinging 127.0.0.1 with 32 bytes of data: Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Ping statistics for 127.0.0.1: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms =========================================================================== Interface List 18…b8 a3 86 91 fc c8 ……D-Link DWA-123 Wireless N 150 USB Adapter #4 11…50 46 5d 64 e5 29 ……Realtek PCIe GBE Family Controller 1………………………Software Loopback Interface 1 17…00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter 12…00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface =========================================================================== IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.200.254 192.168.200.32 25 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.200.0 255.255.255.0 On-link 192.168.200.32 281 192.168.200.32 255.255.255.255 On-link 192.168.200.32 281 192.168.200.255 255.255.255.255 On-link 192.168.200.32 281 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.200.32 281 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.200.32 281 =========================================================================== Persistent Routes: None IPv6 Route Table =========================================================================== Active Routes: If Metric Network Destination Gateway 18 4121 ::/0 fe80::1 1 306 ::1/128 On-link 18 281 fe80::/64 On-link 18 281 fe80::bceb:c04a:d896:2b83/128 On-link 1 306 ff00::/8 On-link 18 281 ff00::/8 On-link =========================================================================== Persistent Routes: None ========================= Winsock entries ===================================== Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [52224] (Microsoft Corporation) Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation) Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation) Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation) Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation) Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [70656] (Microsoft Corporation) x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation) x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation) x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation) x64-Catalog5 05 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog5 06 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation) x64-Catalog9 01 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 02 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 03 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 04 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 05 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 06 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 07 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 08 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 09 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 10 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) ========================= Event log errors: =============================== Application errors: ================== Error: (01/16/2013 05:56:07 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/16/2013 05:55:22 PM) (Source: Application Error) (User: ) Description: Faulting application name: Dwm.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc541 Faulting module name: uDWM.dll, version: 6.1.7600.16385, time stamp: 0x4a5be06f Exception code: 0xc0000005 Fault offset: 0x0000000000002c56 Faulting process id: 0x698 Faulting application start time: 0xDwm.exe0 Faulting application path: Dwm.exe1 Faulting module path: Dwm.exe2 Report Id: Dwm.exe3 Error: (01/16/2013 05:54:18 PM) (Source: Application Error) (User: ) Description: Faulting application name: svchost.exe_ProfSvc, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1 Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e Exception code: 0xc0000005 Fault offset: 0x00000000000532d0 Faulting process id: 0x1d8 Faulting application start time: 0xsvchost.exe_ProfSvc0 Faulting application path: svchost.exe_ProfSvc1 Faulting module path: svchost.exe_ProfSvc2 Report Id: svchost.exe_ProfSvc3 Error: (01/16/2013 05:51:50 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/16/2013 05:50:34 PM) (Source: Application Error) (User: ) Description: Faulting application name: wmpnscfg.exe, version: 12.0.7600.16385, time stamp: 0x4a5bd026 Faulting module name: wmp.dll, version: 12.0.7601.17514, time stamp: 0x4ce7ca81 Exception code: 0xc0000005 Fault offset: 0x000000000012e8d1 Faulting process id: 0xa50 Faulting application start time: 0xwmpnscfg.exe0 Faulting application path: wmpnscfg.exe1 Faulting module path: wmpnscfg.exe2 Report Id: wmpnscfg.exe3 Error: (01/16/2013 05:50:33 PM) (Source: Application Error) (User: ) Description: Faulting application name: wmpnscfg.exe, version: 12.0.7600.16385, time stamp: 0x4a5bd026 Faulting module name: wmp.dll, version: 12.0.7601.17514, time stamp: 0x4ce7ca81 Exception code: 0xc0000005 Fault offset: 0x000000000012e8d1 Faulting process id: 0xb40 Faulting application start time: 0xwmpnscfg.exe0 Faulting application path: wmpnscfg.exe1 Faulting module path: wmpnscfg.exe2 Report Id: wmpnscfg.exe3 Error: (01/16/2013 05:50:28 PM) (Source: Application Error) (User: ) Description: Faulting application name: igfxsrvc.exe, version: 8.15.10.2752, time stamp: 0x4fabced9 Faulting module name: RPCRT4.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c96e Exception code: 0x80000003 Fault offset: 0x00000000000849a3 Faulting process id: 0xaec Faulting application start time: 0xigfxsrvc.exe0 Faulting application path: igfxsrvc.exe1 Faulting module path: igfxsrvc.exe2 Report Id: igfxsrvc.exe3 Error: (01/16/2013 05:49:21 PM) (Source: Application Error) (User: ) Description: Faulting application name: igfxpers.exe, version: 8.15.10.2752, time stamp: 0x4fabcee1 Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e Exception code: 0xc0000005 Fault offset: 0x000000000002583a Faulting process id: 0x8fc Faulting application start time: 0xigfxpers.exe0 Faulting application path: igfxpers.exe1 Faulting module path: igfxpers.exe2 Report Id: igfxpers.exe3 Error: (01/16/2013 05:49:21 PM) (Source: Application Error) (User: ) Description: Faulting application name: NisSrv.exe, version: 4.1.522.0, time stamp: 0x50515c6a Faulting module name: GapaEngine.dll, version: 2.1.8904.0, time stamp: 0x5077bb69 Exception code: 0xc0000005 Fault offset: 0x0000000000060483 Faulting process id: 0xb00 Faulting application start time: 0xNisSrv.exe0 Faulting application path: NisSrv.exe1 Faulting module path: NisSrv.exe2 Report Id: NisSrv.exe3 Error: (01/16/2013 05:40:18 PM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. A component version required by the application conflicts with another component version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. System errors: ============= Error: (01/16/2013 05:56:21 PM) (Source: Service Control Manager) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Multimedia Class Scheduler service, but this action failed with the following error: %%1056 Error: (01/16/2013 05:56:21 PM) (Source: Service Control Manager) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the User Profile Service service, but this action failed with the following error: %%1056 Error: (01/16/2013 05:56:21 PM) (Source: Service Control Manager) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Computer Browser service, but this action failed with the following error: %%1056 Error: (01/16/2013 05:56:21 PM) (Source: Service Control Manager) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: %%1056 Error: (01/16/2013 05:55:21 PM) (Source: Service Control Manager) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Server service, but this action failed with the following error: %%1056 Error: (01/16/2013 05:54:21 PM) (Source: Service Control Manager) (User: ) Description: The Windows Update service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (01/16/2013 05:54:21 PM) (Source: Service Control Manager) (User: ) Description: The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. Error: (01/16/2013 05:54:21 PM) (Source: Service Control Manager) (User: ) Description: The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (01/16/2013 05:54:21 PM) (Source: Service Control Manager) (User: ) Description: The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (01/16/2013 05:54:21 PM) (Source: Service Control Manager) (User: ) Description: The System Event Notification Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. Microsoft Office Sessions: ========================= Error: (01/16/2013 05:56:07 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/16/2013 05:55:22 PM) (Source: Application Error)(User: ) Description: Dwm.exe6.1.7600.163854a5bc541uDWM.dll6.1.7600.163854a5be06fc00000050000000000002 c5669801cdf3cee2d2d34aC:\Windows\system32\Dwm.exeC:\Windows\system32\uDWM.dlld72b9464-5fc2-11e2-8a8a-50465d64e529 Error: (01/16/2013 05:54:18 PM) (Source: Application Error)(User: ) Description: svchost.exe_ProfSvc6.1.7600.163854a5bc3c1ntdll.dll6.1.7601.177254ec4aa8ec0000005 00000000000532d01d801cdf3cee2250ed6C:\Windows\system32\svchost.exeC:\Windows\SYSTEM32\ntdll.dllb117ab0c-5fc2-11e2-8a8a-50465d64e529 Error: (01/16/2013 05:51:50 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/16/2013 05:50:34 PM) (Source: Application Error)(User: ) Description: wmpnscfg.exe12.0.7600.163854a5bd026wmp.dll12.0.7601.175144ce7ca81c00000050000000 00012e8d1a5001cdf3ceed26c02eC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Windows\system32\wmp.dll2b7065e0-5fc2-11e2-8a8a-50465d64e529 Error: (01/16/2013 05:50:33 PM) (Source: Application Error)(User: ) Description: wmpnscfg.exe12.0.7600.163854a5bd026wmp.dll12.0.7601.175144ce7ca81c00000050000000 00012e8d1b4001cdf3ceed2b82efC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Windows\system32\wmp.dll2ae19350-5fc2-11e2-8a8a-50465d64e529 Error: (01/16/2013 05:50:28 PM) (Source: Application Error)(User: ) Description: igfxsrvc.exe8.15.10.27524fabced9RPCRT4.dll6.1.7601.175144ce7c96e8000000300000000 000849a3aec01cdf3cee99ee132C:\Windows\system32\igfxsrvc.exeC:\Windows\system32\RPCRT4.dll27e65467-5fc2-11e2-8a8a-50465d64e529 Error: (01/16/2013 05:49:21 PM) (Source: Application Error)(User: ) Description: igfxpers.exe8.15.10.27524fabcee1ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000 002583a8fc01cdf3cec023aceaC:\Windows\System32\igfxpers.exeC:\Windows\SYSTEM32\ntdll.dllfffae806-5fc1-11e2-8e4a-50465d64e529 Error: (01/16/2013 05:49:21 PM) (Source: Application Error)(User: ) Description: NisSrv.exe4.1.522.050515c6aGapaEngine.dll2.1.8904.05077bb69c00000050000000000060 483b0001cdf3cec13c8f4dc:\Program Files\Microsoft Security Client\NisSrv.exec:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D969F3F1-E5B4-4988-9AD5-C299903C8BBE}\GapaEngine.dllfff96166-5fc1-11e2-8e4a-50465d64e529 Error: (01/16/2013 05:40:18 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Chinyee\Downloads\esetsmartinstaller_enu.exe CodeIntegrity Errors: =================================== Date: 2013-01-09 03:48:09.027 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-01-09 03:48:09.027 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2009-01-01 16:38:26.559 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2009-01-01 16:38:26.550 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-01-08 09:33:12.106 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\PEAuth.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-01-08 09:33:12.091 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\PEAuth.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-01-02 09:46:04.229 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\srv2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-01-02 09:46:04.214 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\srv2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. =========================== Installed Programs ============================ 7-Zip 9.20 (x64 edition) (Version: 9.20.00.0) Adobe Flash Player 11 Plugin (Version: 11.5.502.110) Adobe Reader X (10.1.5) MUI (Version: 10.1.5) D-Link DWA-123 (Version: 1.00.0000) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition ESET Online Scanner v3 Free PDF to Word Doc Converter v1.1 (Version: 1.1) Google Chrome (Version: 24.0.1312.52) Google Update Helper (Version: 1.3.21.123) Intel® Management Engine Components (Version: 8.1.0.1252) Intel® OpenCL CPU Runtime Intel® Processor Graphics (Version: 8.15.10.2752) Intel® Trusted Connect Service Client (Version: 1.24.388.1) Malwarebytes Anti-Malware version 1.70.0.1100 (Version: 1.70.0.1100) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Access Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Excel MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Home and Business 2010 (Version: 14.0.6029.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000) Microsoft Office OneNote MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Outlook MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office PowerPoint MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000) Microsoft Office Proof (Spanish) 2010 (Version: 14.0.6029.1000) Microsoft Office Proofing (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Publisher MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Single Image 2010 (Version: 14.0.6029.1000) Microsoft Office Word MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Security Client (Version: 4.1.0522.0) Microsoft Security Essentials (Version: 4.1.522.0) Microsoft Silverlight (Version: 5.1.10411.0) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Mozilla Firefox 18.0 (x86 en-US) (Version: 18.0) Mozilla Maintenance Service (Version: 18.0) Nitro Reader 3 (Version: 3.0.6.3) Opera 12.12 (Version: 12.12.1707) PrimoPDF – brought to you by Nitro PDF Software (Version: 5) Realtek Ethernet Controller Driver (Version: 7.52.203.2012) Realtek High Definition Audio Driver (Version: 6.0.1.6657) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2687277) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition ========================= Memory info: =================================== Percentage of memory in use: 16% Total physical RAM: 7881.81 MB Available physical RAM: 6572.02 MB Total Pagefile: 15761.81 MB Available Pagefile: 14375.9 MB Total Virtual: 4095.88 MB Available Virtual: 3978.89 MB ========================= Partitions: ===================================== 1 Drive c: (WINDOWS) (Fixed) (Total:234.38 GB) (Free:197.69 GB) NTFS 2 Drive d: (BACKUP) (Fixed) (Total:231.28 GB) (Free:84.22 GB) NTFS ========================= Users: ======================================== User accounts for \\CHINYEE-PC Administrator Chinyee Guest ========================= Minidump Files ================================== No minidump file found **** End of log ****

OCD

Post #15January 16, 2013, 9:40 PM UTC

Hi fulladd,

You log indicates you may have used ComboFix prior to asking for assistance. If so, please locate the most recent log and post it in your next reply.

Log can be found : C:\ComboFix.txt

Next

System File Checker (SFC)

Click on the Start button and in the Search programs and files box type the following:
- command
Don't press Enter, just let the search results populate above.
In the search results, locate the Programs section.
Locate the Command Prompt shortcut and right-click on it.
Select Run as administrator.
Click Yes on the User Account Control window that appears.
Important: If you are see a User Account Control window but also a message that says To continue, type an administrator password, and then click Yes, then your user account must be a standard account, not an administrator account. Before you can click Yes and open an elevated command prompt, you'll need to type the password of another user on your Windows 7 computer that has administrator level privileges.
Note: You will not see this window at all if your User Account Control settings are turned all the way down. See How To Disable User Account Control in Windows 7 for more information.
An elevated Command Prompt window will appear.
- Type: sfc /scannow (There's a space between sfc and /scannow.)
Type: exit to close the command prompt window
Include the findings in your next reply

In your next post please provide the following:
ComboFix log (if available)
Findings from the SFC scan
Any change in computer's performance?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Win32/Small.CA virus [Closed]

✨ Ask AI

Ask AI