What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

win32/small.ca [Solved]

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
as the topic says, Windows has informed me of the win32/small.ca virus, which would explain my recent issues with my computer and accounts getting hacked. The weirdest thing that's happened recently is that any program that streams images or videos (be it a web browser or internet connected program like Steam) quite often has trouble loading the stuff. Images are fragmented and streamed videos stop after 10 or so seconds of playing.

Thanks in advance for any and all help you can provide!

Here's my Hijackthis log:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:17:49 AM, on 3/23/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16521)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
C:\Users\Smoses\AppData\Local\Google\Update\1.3.21.135\GoogleCrashHandler.exe
C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Programs\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe
C:\Users\Smoses\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Games\Steam\steam.exe
C:\Users\Smoses\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Smoses\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Smoses\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Smoses\Desktop\Bitches\HiJackThis.exe
C:\Users\Smoses\AppData\Local\Google\Chrome\Application\chrome.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=c:\windows\syswow64\userinit.exe,
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Programs\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Programs\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [PSUNMain] "C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programs\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Spyware Doctor with AntiVirus] C:\Users\Smoses\Desktop\sdasetup_revwire207.exe -min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Users\Smoses\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://*.att.net
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O15 - Trusted IP range: http://192.168.0.1
O15 - ESC Trusted IP range: http://192.168.0.1
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: ASKService - Unknown owner - C:\Program Files (x86)\AskBarDis\bar\bin\AskService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files (x86)\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: Desura Install Service - Desura Pty Ltd - C:\Program Files (x86)\Common Files\Desura\desura_service.exe
O23 - Service: DirMngr - Unknown owner - C:\Programs\PGP\GnuPG\dirmngr.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: FABS - Helping agent for MAGIX media database (Fabs) - MAGIX AG - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files (x86)\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - G:\Games\Tribes Ascend\HiPatchService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: mental ray 3.8 Satellite for Autodesk 3ds Max 2011 32-bit 32-bit (mi-raysat_3dsmax2011_32) - Unknown owner - C:\Program Files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe
O23 - Service: mental ray 3.8 Satellite for Autodesk 3ds Max 2011 64-bit 64-bit (mi-raysat_3dsmax2011_64) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_64server.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Panda Cloud Antivirus Service (NanoServiceMain) - Panda Security, S.L. - C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe
O23 - Service: NBService - Nero AG - C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O24 - Desktop Component 0: (no name) - http://content.ytmnd.com/content/0/6/c/06c…2afb6ec5dfa.gif
O24 - Desktop Component 1: (no name) - http://content.ytmnd.com/content/8/a/7/8a7…5d13de2bfff.gif

–
End of file - 15475 bytes
Post #2
Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
  • Please be sure to subscribe to the topic if you have not already done so.
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your operating system and losing all your programs and data.

Having said that…. [external image: Posted Image] Let's get going!!
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your Desktop.
  • Disable any script blocking protection
  • Right-click and Run as Administrator dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

[external image: Posted Image] Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • If you are asked to update the Avast Virus database please allow it to do so.
  • When it finishes, press the save log button, save the logfile to your desktop and attach its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it

[external image: Posted Image] AdwCleaner
  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • You will be prompted to restart your computer. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
Post #3
Thanks so much for your help, Jeff! I saw that the attach.txt file said I should zip and attach to the post, so that's where you'll find that. otherwise, here's my dds log: DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 10.0.9200.16521 BrowserJavaVersion: 10.17.2 Run by [removed] at 15:22:19 on 2013-03-25 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4094.2338 [GMT -4:00] . AV: Panda Cloud Antivirus *Enabled/Updated* {86971480-9989-6750-B122-681A86518D59} SP: Panda Cloud Antivirus *Enabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\atieclxx.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\AskBarDis\bar\bin\AskService.exe C:\Program Files (x86)\AskBarDis\bar\bin\ASKUpgrade.exe C:\Programs\PGP\GnuPG\dirmngr.exe C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe C:\Program Files (x86)\GIGABYTE\EnergySaver\GSvr.exe G:\Games\Tribes Ascend\HiPatchService.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskhost.exe C:\Windows\Explorer.EXE C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Program Files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe C:\Program Files\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_64server.exe C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Users\Smoses\AppData\Local\Google\Update\1.3.21.135\GoogleCrashHandler.exe C:\Users\Smoses\AppData\Local\Google\Update\1.3.21.135\GoogleCrashHandler64.exe C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\SearchProtocolHost.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wuauclt.exe C:\Users\Smoses\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Smoses\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Smoses\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Smoses\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://google.com/ uWindow Title = Windows Internet Explorer provided by Comcast uDefault_Page_URL = hxxp://www.dell4me.com/myway uProxyOverride = mWinlogon: Userinit = c:\windows\syswow64\userinit.exe, BHO: Octh Class: {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll BHO: ContributeBHO Class: {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Programs\Adobe\/Adobe Contribute CS4/contributeieplugin.dll BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll BHO: DivX Plus Web Player HTML5 : {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll TB: Contribute Toolbar: {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Programs\Adobe\/Adobe Contribute CS4/contributeieplugin.dll TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll uRun: [AdobeBridge] mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [PSUNMain] "C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" mRun: [QuickTime Task] "C:\Programs\QuickTime\QTTask.exe" -atboottime mRun: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe mRun: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:0 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableLUA = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: PromptOnSecureDesktop = dword:0 IE: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/204 IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: NameServer = 75.75.76.76 75.75.75.75 TCP: Interfaces\{08F9589A-89D0-4DF0-A54B-7097AB0EA921} : DHCPNameServer = [removed] [removed] [removed] TCP: Interfaces\{12AC9878-47CF-4575-B96F-07B06ABD8DD1} : DHCPNameServer = [removed] [removed] [removed] TCP: Interfaces\{336014A5-4D0E-4978-AF1C-5464B1D901E1} : DHCPNameServer = 75.75.76.76 75.75.75.75 TCP: Interfaces\{336014A5-4D0E-4978-AF1C-5464B1D901E1}\C696E6B6379737 : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{4170DC8E-603F-458E-9E9E-0708514924E2}\E4544574541425 : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{56AE7B6E-2C09-48AA-8D33-A9727A6F2877} : DHCPNameServer = 192.168.254.254 192.168.254.254 TCP: Interfaces\{56AE7B6E-2C09-48AA-8D33-A9727A6F2877}\3586F6274774962716666656D27657563747 : DHCPNameServer = [removed] [removed] 192.168.33.1 TCP: Interfaces\{56AE7B6E-2C09-48AA-8D33-A9727A6F2877}\E4544574541425 : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{CC165789-8CA6-4E52-AC86-95E89D667B1A} : DHCPNameServer = 192.168.254.254 192.168.254.254 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll SSODL: WebCheck - SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll x64-mWindow Title = Windows Internet Explorer provided by Comcast x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll x64-Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab x64-DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - x64-SSODL: WebCheck - . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Smoses\AppData\Roaming\Mozilla\Firefox\Profiles\gek3if1s.default\ FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: network.proxy.type - 4 FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\OnLive\Plugin\npolgdet.dll FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll FF - plugin: C:\Programs\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll FF - plugin: C:\Programs\Firefox\plugins\np_gp.dll FF - plugin: C:\Programs\QuickTime\Plugins\npqtplugin.dll FF - plugin: C:\Programs\QuickTime\Plugins\npqtplugin2.dll FF - plugin: C:\Programs\QuickTime\Plugins\npqtplugin3.dll FF - plugin: C:\Programs\QuickTime\Plugins\npqtplugin4.dll FF - plugin: C:\Programs\QuickTime\Plugins\npqtplugin5.dll FF - plugin: C:\Programs\QuickTime\Plugins\npqtplugin6.dll FF - plugin: C:\Programs\QuickTime\Plugins\npqtplugin7.dll FF - plugin: C:\Users\Smoses\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll FF - plugin: C:\Users\Smoses\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll FF - plugin: C:\Windows\SysWOW64\npmproxy.dll FF - plugin: G:\Games\Shootmania\npdd.dll . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2009-11-10 55024] R1 PSINKNC;PSINKNC;C:\Windows\System32\drivers\PSINKNC.sys [2010-5-4 149512] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-12-19 240640] R2 ASKService;ASKService;C:\Program Files (x86)\AskBarDis\bar\bin\AskService.exe [2009-12-23 464264] R2 ASKUpgrade;ASKUpgrade;C:\Program Files (x86)\AskBarDis\bar\bin\ASKUpgrade.exe [2009-12-23 234888] R2 DirMngr;DirMngr;C:\Programs\PGP\GnuPG\dirmngr.exe [2011-3-2 224256] R2 Fabs;FABS - Helping agent for MAGIX media database;C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-8-27 1253376] R2 GEST Service;GEST Service for program management.;C:\Program Files (x86)\GIGABYTE\EnergySaver\GSvr.exe [2009-11-5 68136] R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;G:\Games\Tribes Ascend\HiPatchService.exe [2012-3-9 8704] R2 LVPrcS64;Process Monitor;C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe [2009-10-7 191000] R2 mi-raysat_3dsmax2011_32;mental ray 3.8 Satellite for Autodesk 3ds Max 2011 32-bit 32-bit;C:\Program Files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe [2010-3-10 86016] R2 mi-raysat_3dsmax2011_64;mental ray 3.8 Satellite for Autodesk 3ds Max 2011 64-bit 64-bit;C:\Program Files\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_64server.exe [2010-3-10 86016] R2 NanoServiceMain;Panda Cloud Antivirus Service;C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2010-4-30 136448] R2 PSINAflt;PSINAflt;C:\Windows\System32\drivers\PSINAflt.sys [2010-5-27 158280] R2 PSINFile;PSINFile;C:\Windows\System32\drivers\PSINFile.sys [2010-4-30 114696] R2 PSINProc;PSINProc;C:\Windows\System32\drivers\PSINProc.sys [2010-4-30 121864] R2 PSINProt;PSINProt;C:\Windows\System32\drivers\PSINProt.sys [2010-5-12 126024] R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-11-6 96256] R3 LVPr2M64;Logitech LVPr2M64 Driver;C:\Windows\System32\drivers\LVPr2M64.sys [2009-10-7 30232] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-11-7 239616] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 Adobe Version Cue CS4;Adobe Version Cue CS4;C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-8-15 284016] S3 AODDriver;AODDriver;C:\Program Files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys [2009-2-23 14904] S3 atidgllk;atidgllk;C:\Program Files (x86)\GIGABYTE\ET6\atidgllk.sys [2006-7-19 12048] S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;C:\Games\Dragon Age\bin_ship\daupdatersvc.service.exe [2009-12-15 25832] S3 Desura Install Service;Desura Install Service;C:\Program Files (x86)\Common Files\Desura\desura_service.exe [2011-8-5 131400] S3 etdrv;etdrv;C:\Windows\etdrv.sys [2009-11-5 25640] S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-8-7 3276800] S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2009-11-10 1436424] S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;C:\Program Files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe [2011-2-8 129440] S3 GVTDrv64;GVTDrv64;C:\Windows\GVTDrv64.sys [2009-11-5 30528] S3 lvpepf64;Volume Adapter;C:\Windows\System32\drivers\lv302a64.sys [2010-1-15 15896] S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\System32\drivers\lvrs64.sys [2010-1-15 327576] S3 LVUSBS64;Logitech USB Monitor Filter;C:\Windows\System32\drivers\LVUSBS64.sys [2008-7-26 50072] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-3-21 19456] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-3-21 57856] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-4-6 1255736] . =============== File Associations =============== . ShellExec: dreamweaver.exe: Open="C:\Programs\Adobe\Adobe Dreamweaver CS4\dreamweaver.exe", "%1" . =============== Created Last 30 ================ . 2013-03-23 04:23:20 9311288 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5C12E2FB-A9CF-48CE-970A-112F9ACF87F3}\mpengine.dll 2013-03-21 20:43:21 95648 —-a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll 2013-03-21 04:20:32 3072 —-a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui 2013-03-21 04:17:19 458712 —-a-w- C:\Windows\System32\drivers\cng.sys 2013-03-21 04:17:19 340992 —-a-w- C:\Windows\System32\schannel.dll 2013-03-21 04:17:19 247808 —-a-w- C:\Windows\SysWow64\schannel.dll 2013-03-21 04:17:19 154480 —-a-w- C:\Windows\System32\drivers\ksecpkg.sys 2013-03-21 04:17:19 1448448 —-a-w- C:\Windows\System32\lsasrv.dll 2013-03-21 04:17:18 96768 —-a-w- C:\Windows\SysWow64\sspicli.dll 2013-03-21 04:17:18 22016 —-a-w- C:\Windows\SysWow64\secur32.dll 2013-03-21 04:17:16 19968 —-a-w- C:\Windows\System32\drivers\usb8023.sys 2013-03-14 07:32:05 24416 —-a-r- C:\Windows\System32\AdobePDFUI.dll 2013-03-03 05:23:17 ——– d—–w- C:\Program Files (x86)\AMD AVT 2013-03-03 05:23:08 ——– d—–w- C:\Program Files (x86)\AMD APP 2013-02-27 08:30:20 ——– d—–w- C:\Users\Smoses\AppData\Roaming\com.stoicstudio.TheBannerSagaFactions 2013-02-27 08:30:09 ——– d—–w- C:\Users\Smoses\tbs_logs . ==================== Find3M ==================== . 2013-03-25 18:50:07 25640 —-a-w- C:\Windows\gdrv.sys 2013-03-21 20:43:01 861088 —-a-w- C:\Windows\SysWow64\npdeployJava1.dll 2013-03-21 20:43:00 782240 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2013-03-14 07:46:10 280904 —-a-w- C:\Windows\SysWow64\PnkBstrB.xtr 2013-03-14 07:46:10 280904 —-a-w- C:\Windows\SysWow64\PnkBstrB.exe 2013-03-14 07:41:22 280904 —-a-w- C:\Windows\SysWow64\PnkBstrB.ex0 2013-03-13 05:49:42 73432 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2013-03-13 05:49:42 693976 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2013-02-12 05:45:24 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45:22 350208 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 05:45:22 308736 —-a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45:22 111104 —-a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 04:48:31 474112 —-a-w- C:\Windows\apppatch\AcSpecfc.dll 2013-02-12 04:48:26 2176512 —-a-w- C:\Windows\apppatch\AcGenral.dll 2013-02-07 16:42:52 333856 —-a-w- C:\Windows\System32\RaCoInstx.dll 2013-02-07 16:42:52 2201120 —-a-w- C:\Windows\System32\drivers\netr28ux.sys 2013-01-17 05:28:58 273840 ——w- C:\Windows\System32\MpSigStub.exe 2013-01-13 21:17:03 9728 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-01-13 21:17:02 2560 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-01-13 21:16:42 10752 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-01-13 21:12:46 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-01-13 21:11:21 4096 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll 2013-01-13 21:11:08 5632 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-01-13 21:11:07 5632 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-01-13 21:11:07 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll 2013-01-13 21:11:07 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-01-13 20:35:31 9728 —ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-01-13 20:35:31 2560 —ha-w- C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-01-13 20:35:18 10752 —ha-w- C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-01-13 20:32:07 3584 —ha-w- C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-01-13 20:31:48 4096 —ha-w- C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll 2013-01-13 20:31:41 5632 —ha-w- C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-01-13 20:31:40 5632 —ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-01-13 20:31:40 3072 —ha-w- C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll 2013-01-13 20:31:40 3072 —ha-w- C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-01-13 20:31:00 1247744 —-a-w- C:\Windows\SysWow64\DWrite.dll 2013-01-13 20:22:22 1988096 —-a-w- C:\Windows\SysWow64\d3d10warp.dll 2013-01-13 20:20:31 293376 —-a-w- C:\Windows\SysWow64\dxgi.dll 2013-01-13 20:09:00 249856 —-a-w- C:\Windows\SysWow64\d3d10_1core.dll 2013-01-13 20:08:43 220160 —-a-w- C:\Windows\SysWow64\d3d10core.dll 2013-01-13 20:08:35 1504768 —-a-w- C:\Windows\SysWow64\d3d11.dll 2013-01-13 19:59:04 1643520 —-a-w- C:\Windows\System32\DWrite.dll 2013-01-13 19:58:28 1175552 —-a-w- C:\Windows\System32\FntCache.dll 2013-01-13 19:54:01 604160 —-a-w- C:\Windows\SysWow64\d3d10level9.dll 2013-01-13 19:53:58 207872 —-a-w- C:\Windows\SysWow64\WindowsCodecsExt.dll 2013-01-13 19:53:14 187392 —-a-w- C:\Windows\SysWow64\UIAnimation.dll 2013-01-13 19:51:30 2565120 —-a-w- C:\Windows\System32\d3d10warp.dll 2013-01-13 19:49:17 363008 —-a-w- C:\Windows\System32\dxgi.dll 2013-01-13 19:48:47 161792 —-a-w- C:\Windows\SysWow64\d3d10_1.dll 2013-01-13 19:46:25 1080832 —-a-w- C:\Windows\SysWow64\d3d10.dll 2013-01-13 19:43:21 1230336 —-a-w- C:\Windows\SysWow64\WindowsCodecs.dll 2013-01-13 19:38:39 333312 —-a-w- C:\Windows\System32\d3d10_1core.dll 2013-01-13 19:38:32 1887232 —-a-w- C:\Windows\System32\d3d11.dll 2013-01-13 19:38:21 296960 —-a-w- C:\Windows\System32\d3d10core.dll 2013-01-13 19:37:57 3419136 —-a-w- C:\Windows\SysWow64\d2d1.dll 2013-01-13 19:25:04 245248 —-a-w- C:\Windows\System32\WindowsCodecsExt.dll 2013-01-13 19:24:33 648192 —-a-w- C:\Windows\System32\d3d10level9.dll 2013-01-13 19:24:30 221184 —-a-w- C:\Windows\System32\UIAnimation.dll 2013-01-13 19:20:42 194560 —-a-w- C:\Windows\System32\d3d10_1.dll 2013-01-13 19:20:04 1238528 —-a-w- C:\Windows\System32\d3d10.dll 2013-01-13 19:15:40 1424384 —-a-w- C:\Windows\System32\WindowsCodecs.dll 2013-01-13 19:10:36 3928064 —-a-w- C:\Windows\System32\d2d1.dll 2013-01-13 19:02:06 417792 —-a-w- C:\Windows\SysWow64\WMPhoto.dll 2013-01-13 18:34:58 364544 —-a-w- C:\Windows\SysWow64\XpsGdiConverter.dll 2013-01-13 18:32:43 465920 —-a-w- C:\Windows\System32\WMPhoto.dll 2013-01-13 18:09:52 522752 —-a-w- C:\Windows\System32\XpsGdiConverter.dll 2013-01-13 17:26:42 1158144 —-a-w- C:\Windows\SysWow64\XpsPrint.dll 2013-01-13 17:05:09 1682432 —-a-w- C:\Windows\System32\XpsPrint.dll 2013-01-05 05:53:43 5553512 —-a-w- C:\Windows\System32\ntoskrnl.exe 2013-01-05 05:00:15 3967848 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2013-01-05 05:00:11 3913064 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2013-01-04 06:11:21 2284544 —-a-w- C:\Windows\SysWow64\msmpeg2vdec.dll 2013-01-04 06:11:13 2776576 —-a-w- C:\Windows\System32\msmpeg2vdec.dll 2013-01-04 05:46:09 215040 —-a-w- C:\Windows\System32\winsrv.dll 2013-01-04 04:51:16 5120 —-a-w- C:\Windows\SysWow64\wow32.dll 2013-01-04 04:43:21 44032 —-a-w- C:\Windows\apppatch\acwow64.dll 2013-01-04 03:26:48 3153408 —-a-w- C:\Windows\System32\win32k.sys 2013-01-04 02:47:35 25600 —-a-w- C:\Windows\SysWow64\setup16.exe 2013-01-04 02:47:34 7680 —-a-w- C:\Windows\SysWow64\instnm.exe 2013-01-04 02:47:34 2048 —-a-w- C:\Windows\SysWow64\user.exe 2013-01-04 02:47:33 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll 2013-01-03 06:00:54 1913192 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2013-01-03 06:00:42 288088 —-a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS 2009-11-20 01:08:02 3749224 —-a-w- C:\Program Files (x86)\Common Files\adlmint_libFNP.dll 2009-11-20 01:08:02 2941288 —-a-w- C:\Program Files (x86)\Common Files\adlmint.dll . ============= FINISH: 15:23:49.33 =============== aswMBR log: aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software Run date: 2013-03-25 15:31:15 —————————– 15:31:15.215 OS Version: Windows x64 6.1.7601 Service Pack 1 15:31:15.215 Number of processors: 4 586 0x170A 15:31:15.216 ComputerName: SMOSES-PC UserName: Smoses 15:31:15.902 Initialize success 15:33:34.961 AVAST engine defs: 13032501 15:33:54.934 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 15:33:54.936 Disk 0 Vendor: SAMSUNG_HD502HJ 1AJ100E4 Size: 476938MB BusType: 3 15:33:54.938 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-4 15:33:54.940 Disk 1 Vendor: SAMSUNG_HD204UI 1AQ10001 Size: 1907729MB BusType: 3 15:33:54.946 Disk 0 MBR read successfully 15:33:54.948 Disk 0 MBR scan 15:33:54.953 Disk 0 Windows 7 default MBR code 15:33:54.960 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048 15:33:54.975 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476836 MB offset 206848 15:33:54.994 Disk 0 scanning C:\Windows\system32\drivers 15:34:04.754 Service scanning 15:34:25.062 Modules scanning 15:34:25.068 Disk 0 trace - called modules: 15:34:25.083 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80043022c0]< \Device\Harddisk0\DR0[0xfffffa8004a6d060] 15:34:25.091 3 CLASSPNP.SYS[fffff88001b5043f] -> nt!IofCallDriver -> [0xfffffa80047ff520] 15:34:25.095 5 ACPI.sys[fffff8800119e7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80047d8060] 15:34:25.099 \Driver\atapi[0xfffffa80047b56a0] -> IRP_MJ_CREATE -> 0xfffffa80043022c0 15:34:25.800 AVAST engine scan C:\Windows 15:34:28.165 AVAST engine scan C:\Windows\system32 15:37:34.253 AVAST engine scan C:\Windows\system32\drivers 15:37:45.539 AVAST engine scan C:\Users\Smoses 15:39:47.451 Disk 0 MBR has been saved successfully to "C:\Users\Smoses\Desktop\MBR.dat" 15:39:47.452 The log file has been saved successfully to "C:\Users\Smoses\Desktop\aswMBR.txt" aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software Run date: 2013-03-25 15:40:02 —————————– 15:40:02.224 OS Version: Windows x64 6.1.7601 Service Pack 1 15:40:02.224 Number of processors: 4 586 0x170A 15:40:02.225 ComputerName: SMOSES-PC UserName: Smoses 15:40:02.775 Initialize success 15:40:10.347 AVAST engine defs: 13032501 15:40:20.617 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 15:40:20.618 Disk 0 Vendor: SAMSUNG_HD502HJ 1AJ100E4 Size: 476938MB BusType: 3 15:40:20.620 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-4 15:40:20.622 Disk 1 Vendor: SAMSUNG_HD204UI 1AQ10001 Size: 1907729MB BusType: 3 15:40:20.641 Disk 0 MBR read successfully 15:40:20.644 Disk 0 MBR scan 15:40:20.649 Disk 0 Windows 7 default MBR code 15:40:20.655 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048 15:40:20.670 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476836 MB offset 206848 15:40:20.732 Disk 0 scanning C:\Windows\system32\drivers 15:40:31.699 Service scanning 15:40:51.903 Modules scanning 15:40:51.910 Disk 0 trace - called modules: 15:40:51.922 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80043022c0]< \Device\Harddisk0\DR0[0xfffffa8004a6d060] 15:40:51.930 3 CLASSPNP.SYS[fffff88001b5043f] -> nt!IofCallDriver -> [0xfffffa80047ff520] 15:40:51.934 5 ACPI.sys[fffff8800119e7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80047d8060] 15:40:51.938 \Driver\atapi[0xfffffa80047b56a0] -> IRP_MJ_CREATE -> 0xfffffa80043022c0 15:40:52.605 AVAST engine scan C:\Windows 15:40:56.074 AVAST engine scan C:\Windows\system32 15:44:04.653 AVAST engine scan C:\Windows\system32\drivers 15:44:15.814 AVAST engine scan C:\Users\Smoses 16:22:25.560 AVAST engine scan C:\ProgramData 16:25:19.975 Scan finished successfully 16:56:18.557 Disk 0 MBR has been saved successfully to "C:\Users\Smoses\Desktop\MBR.dat" 16:56:18.604 The log file has been saved successfully to "C:\Users\Smoses\Desktop\aswMBR.txt" AdwCleaner log: # AdwCleaner v2.115 - Logfile created 03/25/2013 at 16:58:24 # Updated 17/03/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Smoses - SMOSES-PC # Boot Mode : Normal # Running from : C:\Users\Smoses\Desktop\AdwCleaner.exe # Option [Delete] ***** [Services] ***** Stopped & Deleted : AskService Stopped & Deleted : AskUpgrade ***** [Files / Folders] ***** Folder Deleted : C:\Program Files (x86)\AskBarDis Folder Deleted : C:\Users\Smoses\AppData\LocalLow\boost_interprocess Folder Deleted : C:\Users\Smoses\AppData\Roaming\Mozilla\Firefox\Profiles\gek3if1s.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\AskBarDis Key Deleted : HKCU\Software\AskBarDis Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{201F27D4-3704-41D6-89C1-AA35E39143ED} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3041D03E-FD4B-44E0-B742-2D9B88305F98} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B0DE3308-5D5A-470D-81B9-634FC078393B} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98} Key Deleted : HKCU\Software\Softonic Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D2E5FA06-DCC7-46F9-BEFF-BFD06F69B9B2} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{0702A2B6-13AA-4090-9E01-BCDC85DD933F} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{08993A7C-E764-4172-9627-BFB5EA6897B2} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{128A6C66-AC6A-4617-8268-AB7F47B7215E} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{201F27D4-3704-41D6-89C1-AA35E39143ED} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3041D03E-FD4B-44E0-B742-2D9B88305F98} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{571715D7-3395-4DF0-B43C-784836209E60} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{622FD888-4E91-4D68-84D4-7262FD0811BF} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B0DE3308-5D5A-470D-81B9-634FC078393B} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4634804A-F0B0-4A74-A550-FC0EEF8A4362} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4C07EA4F-5F52-4222-B170-4CD9ED33BAEA} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C44FEFF4-EF0C-4CF7-83D0-92B4266A32B9} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F131923C-381D-4E4C-A472-4A17118FD742} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201F27D4-3704-41D6-89C1-AA35E39143ED} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Ask Toolbar_is1 Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4634804A-F0B0-4A74-A550-FC0EEF8A4362} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4C07EA4F-5F52-4222-B170-4CD9ED33BAEA} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C44FEFF4-EF0C-4CF7-83D0-92B4266A32B9} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F131923C-381D-4E4C-A472-4A17118FD742} Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{3041D03E-FD4B-44E0-B742-2D9B88305F98}] ***** [Internet Browsers] ***** -\\ Internet Explorer v10.0.9200.16521 [OK] Registry is clean. -\\ Mozilla Firefox v9.0.1 (en-US) File : C:\Users\Smoses\AppData\Roaming\Mozilla\Firefox\Profiles\gek3if1s.default\prefs.js Deleted : user_pref("extensions.snipit.askTbInstalled", true); File : C:\Users\Smoses\AppData\Roaming\Mozilla\Firefox\Profiles\jgjlybjv.default\prefs.js [OK] File is clean. -\\ Google Chrome v25.0.1364.172 File : C:\Users\Smoses\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[S1].txt - [4116 octets] - [25/03/2013 16:58:24] ########## EOF - C:\AdwCleaner[S1].txt - [4176 octets] ##########

Attachments:

  • [attachment removed: attach.zip]
Post #4
ComboFix

Download Combofix from the link below, and save it to your desktop.
Link

**Note: It is important that it is saved directly to your desktop**
If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
———-
Post #5
here ya go: ComboFix 13-03-26.01 - Smoses 03/26/2013 13:32:40.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4094.2494 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Panda Cloud Antivirus *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59} SP: Panda Cloud Antivirus *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\install.exe c:\users\Smoses\AppData\Roaming\Love c:\users\Smoses\AppData\Roaming\Love\mari0\options.txt c:\windows\SysWow64\URTTemp c:\windows\SysWow64\URTTemp\regtlib.exe G:\install.exe . . ((((((((((((((((((((((((( Files Created from 2013-02-26 to 2013-03-26 ))))))))))))))))))))))))))))))) . . 2013-03-26 17:24 . 2013-03-15 06:28 9311288 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F0DC47E0-342D-4A80-A02C-984D27D21475}\mpengine.dll 2013-03-21 20:43 . 2013-03-21 20:43 ——– d—–w- c:\program files (x86)\Common Files\Java 2013-03-21 20:43 . 2013-03-21 20:43 95648 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-03-21 04:20 . 2012-08-23 15:09 3072 —-a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui 2013-03-21 04:17 . 2012-08-24 18:13 154480 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2013-03-21 04:17 . 2012-08-24 18:09 458712 —-a-w- c:\windows\system32\drivers\cng.sys 2013-03-21 04:17 . 2012-08-24 18:05 340992 —-a-w- c:\windows\system32\schannel.dll 2013-03-21 04:17 . 2012-08-24 18:03 1448448 —-a-w- c:\windows\system32\lsasrv.dll 2013-03-21 04:17 . 2012-08-24 16:57 247808 —-a-w- c:\windows\SysWow64\schannel.dll 2013-03-21 04:17 . 2012-08-24 16:57 22016 —-a-w- c:\windows\SysWow64\secur32.dll 2013-03-21 04:17 . 2012-08-24 16:53 96768 —-a-w- c:\windows\SysWow64\sspicli.dll 2013-03-21 04:17 . 2013-02-12 04:12 19968 —-a-w- c:\windows\system32\drivers\usb8023.sys 2013-03-14 07:32 . 2009-08-20 03:50 24416 —-a-r- c:\windows\system32\AdobePDFUI.dll 2013-03-14 07:01 . 2013-03-14 07:01 ——– d—–w- c:\program files\Microsoft Silverlight 2013-03-03 05:23 . 2013-03-03 05:23 ——– d—–w- c:\programdata\ATI 2013-03-03 05:23 . 2013-03-03 05:23 ——– d—–w- c:\program files (x86)\AMD AVT 2013-03-03 05:23 . 2013-03-03 05:23 ——– d—–w- c:\program files (x86)\AMD APP 2013-02-27 08:30 . 2013-02-27 08:30 ——– d—–w- c:\users\Smoses\AppData\Roaming\com.stoicstudio.TheBannerSagaFactions 2013-02-27 08:30 . 2013-02-28 18:40 ——– d—–w- c:\users\Smoses\tbs_logs . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-26 17:17 . 2009-11-06 02:01 25640 —-a-w- c:\windows\gdrv.sys 2013-03-21 20:43 . 2012-07-22 03:52 861088 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2013-03-21 20:43 . 2011-04-16 22:02 782240 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-03-14 07:46 . 2010-06-04 06:11 280904 —-a-w- c:\windows\SysWow64\PnkBstrB.xtr 2013-03-14 07:46 . 2009-11-08 19:37 280904 —-a-w- c:\windows\SysWow64\PnkBstrB.exe 2013-03-14 07:41 . 2009-11-08 19:37 280904 —-a-w- c:\windows\SysWow64\PnkBstrB.ex0 2013-03-14 07:05 . 2009-11-05 23:16 72013344 —-a-w- c:\windows\system32\MRT.exe 2013-03-13 05:49 . 2012-04-05 14:04 693976 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-03-13 05:49 . 2011-05-19 16:49 73432 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-02-12 05:45 . 2013-03-14 00:38 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45 . 2013-03-14 00:38 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 05:45 . 2013-03-14 00:38 308736 —-a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45 . 2013-03-14 00:38 111104 —-a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 04:48 . 2013-03-14 00:38 474112 —-a-w- c:\windows\apppatch\AcSpecfc.dll 2013-02-12 04:48 . 2013-03-14 00:38 2176512 —-a-w- c:\windows\apppatch\AcGenral.dll 2013-02-07 16:42 . 2013-02-07 16:42 333856 —-a-w- c:\windows\system32\RaCoInstx.dll 2013-02-07 16:42 . 2013-02-07 16:42 2201120 —-a-w- c:\windows\system32\drivers\netr28ux.sys 2013-01-17 05:28 . 2009-11-05 23:05 273840 ——w- c:\windows\system32\MpSigStub.exe 2013-01-05 05:53 . 2013-02-15 07:33 5553512 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-01-05 05:00 . 2013-02-15 07:33 3967848 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2013-01-05 05:00 . 2013-02-15 07:33 3913064 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2013-01-04 05:46 . 2013-02-15 07:34 215040 —-a-w- c:\windows\system32\winsrv.dll 2013-01-04 04:51 . 2013-02-15 07:34 5120 —-a-w- c:\windows\SysWow64\wow32.dll 2013-01-04 04:43 . 2013-02-15 07:34 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2013-01-04 03:26 . 2013-02-15 07:33 3153408 —-a-w- c:\windows\system32\win32k.sys 2013-01-04 02:47 . 2013-02-15 07:34 25600 —-a-w- c:\windows\SysWow64\setup16.exe 2013-01-04 02:47 . 2013-02-15 07:34 7680 —-a-w- c:\windows\SysWow64\instnm.exe 2013-01-04 02:47 . 2013-02-15 07:34 2048 —-a-w- c:\windows\SysWow64\user.exe 2013-01-04 02:47 . 2013-02-15 07:34 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll 2013-01-03 06:00 . 2013-02-15 07:34 1913192 —-a-w- c:\windows\system32\drivers\tcpip.sys 2013-01-03 06:00 . 2013-02-15 07:34 288088 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2009-11-20 01:08 . 2009-11-20 01:08 3749224 —-a-w- c:\program files (x86)\Common Files\adlmint_libFNP.dll 2009-11-20 01:08 . 2009-11-20 01:08 2941288 —-a-w- c:\program files (x86)\Common Files\adlmint.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872] "HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-09-24 393216] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "PSUNMain"="c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2010-05-14 406848] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "QuickTime Task"="c:\programs\QuickTime\QTTask.exe" [2010-11-29 421888] "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824] "DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-01-30 450560] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-02-13 1263952] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux6"=wdmaud.drv . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 DirMngr;DirMngr;c:\programs\PGP\GnuPG\dirmngr.exe [2011-03-02 224256] R2 mi-raysat_3dsmax2011_32;mental ray 3.8 Satellite for Autodesk 3ds Max 2011 32-bit 32-bit;c:\program files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe [2010-03-10 86016] R2 mi-raysat_3dsmax2011_64;mental ray 3.8 Satellite for Autodesk 3ds Max 2011 64-bit 64-bit;c:\program files\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_64server.exe [2010-03-10 86016] R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016] R3 AODDriver;AODDriver;c:\program files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys [2009-02-23 14904] R3 atidgllk;atidgllk;c:\program files (x86)\GIGABYTE\ET6\atidgllk.sys [2006-07-19 12048] R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x] R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832] R3 Desura Install Service;Desura Install Service;c:\program files (x86)\Common Files\Desura\desura_service.exe [2011-08-05 131400] R3 etdrv;etdrv;c:\windows\etdrv.sys [2010-02-04 25640] R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-03-27 1436424] R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe [2011-01-13 129440] R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2010-02-11 30528] R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys [2009-04-30 15896] R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2009-04-30 327576] R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\DRIVERS\LVUSBS64.sys [2008-07-26 50072] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456] R3 RkPavproc1;RkPavproc1;c:\windows\system32\drivers\RkPavproc1.sys [x] R3 RkPavproc2;RkPavproc2;c:\windows\system32\drivers\RkPavproc2.sys [x] R3 RkPavproc3;RkPavproc3;c:\windows\system32\drivers\RkPavproc3.sys [x] R3 RkPavproc4;RkPavproc4;c:\windows\system32\drivers\RkPavproc4.sys [x] R3 RkPavproc5;RkPavproc5;c:\windows\system32\drivers\RkPavproc5.sys [x] R3 RkPavproc6;RkPavproc6;c:\windows\system32\drivers\RkPavproc6.sys [x] R3 RkPavproc7;RkPavproc7;c:\windows\system32\drivers\RkPavproc7.sys [x] R3 RkPavproc8;RkPavproc8;c:\windows\system32\drivers\RkPavproc8.sys [x] R3 RkPavproc9;RkPavproc9;c:\windows\system32\drivers\RkPavproc9.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-06 1255736] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-31 55024] S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x] S1 PSINKNC;PSINKNC;c:\windows\system32\DRIVERS\psinknc.sys [2010-05-04 149512] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-12-19 240640] S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376] S2 GEST Service;GEST Service for program management.;c:\program files (x86)\GIGABYTE\EnergySaver\GSvr.exe [2009-02-06 68136] S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;g:\games\Tribes Ascend\HiPatchService.exe [2012-04-05 8704] S2 LVPrcS64;Process Monitor;c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-10-07 191000] S2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2010-04-30 136448] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344] S2 PSINAflt;PSINAflt;c:\windows\system32\DRIVERS\PSINAflt.sys [2010-05-27 158280] S2 PSINFile;PSINFile;c:\windows\system32\DRIVERS\PSINFile.sys [2010-04-30 114696] S2 PSINProc;PSINProc;c:\windows\system32\DRIVERS\PSINProc.sys [2010-04-30 121864] S2 PSINProt;PSINProt;c:\windows\system32\DRIVERS\PSINProt.sys [2010-05-12 126024] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-11-06 96256] S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [2009-10-07 30232] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-08-20 239616] . . Contents of the 'Scheduled Tasks' folder . 2013-03-25 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 05:49] . 2013-03-12 c:\windows\Tasks\EasyShare Registration Task.job - c:\windows\system32\rundll32.exe [2009-07-13 01:14] . 2013-03-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-28 18:17] . 2013-03-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-28 18:17] . 2013-03-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1217470350-624965823-2328496604-1000Core.job - c:\users\Smoses\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-18 19:27] . 2013-03-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1217470350-624965823-2328496604-1000UA.job - c:\users\Smoses\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-18 19:27] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-10-01 825184] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://google.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = IE: &Download by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/204 IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: Do&wnload selected by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: att.net Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: sbcglobal.net Trusted Zone: soe.com Trusted Zone: sony.com Trusted Zone: yahoo.com\clientapps TCP: DhcpNameServer = 75.75.76.76 75.75.75.75 FF - ProfilePath - c:\users\Smoses\AppData\Roaming\Mozilla\Firefox\Profiles\jgjlybjv.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKCU-Run-AdobeBridge - (no file) Wow6432Node-HKCU-Run-Spyware Doctor with AntiVirus - c:\users\Smoses\Desktop\sdasetup_revwire207.exe Wow6432Node-HKLM-Run- - (no file) HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe AddRemove-Steam App 10500 - c:\programs\Steam\steam.exe AddRemove-Steam App 107100 - c:\programs\Steam\steam.exe AddRemove-Steam App 12150 - c:\programs\Steam\steam.exe AddRemove-Steam App 12810 - c:\programs\Steam\steam.exe AddRemove-Steam App 12900 - c:\programs\Steam\steam.exe AddRemove-Steam App 13210 - c:\programs\Steam\steam.exe AddRemove-Steam App 13260 - c:\programs\Steam\steam.exe AddRemove-Steam App 17300 - c:\programs\Steam\steam.exe AddRemove-Steam App 17330 - c:\programs\Steam\steam.exe AddRemove-Steam App 17410 - c:\programs\Steam\steam.exe AddRemove-Steam App 19900 - c:\programs\Steam\steam.exe AddRemove-Steam App 20500 - c:\programs\Steam\steam.exe AddRemove-Steam App 20540 - c:\programs\Steam\steam.exe AddRemove-Steam App 20900 - c:\programs\Steam\steam.exe AddRemove-Steam App 20920 - c:\programs\Steam\steam.exe AddRemove-Steam App 20930 - c:\programs\Steam\steam.exe AddRemove-Steam App 218 - c:\programs\Steam\steam.exe AddRemove-Steam App 28050 - c:\programs\Steam\steam.exe AddRemove-Steam App 400 - c:\programs\Steam\steam.exe AddRemove-Steam App 440 - c:\programs\Steam\steam.exe AddRemove-Steam App 44320 - c:\programs\Steam\steam.exe AddRemove-Steam App 4560 - c:\programs\Steam\steam.exe AddRemove-Steam App 4760 - c:\programs\Steam\steam.exe AddRemove-Steam App 4770 - c:\programs\Steam\steam.exe AddRemove-Steam App 500 - c:\programs\Steam\steam.exe AddRemove-Steam App 50130 - c:\programs\Steam\steam.exe AddRemove-Steam App 550 - c:\programs\Steam\steam.exe AddRemove-Steam App 620 - c:\programs\Steam\steam.exe AddRemove-Steam App 9340 - c:\programs\Steam\steam.exe AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files (x86)\DivX\DivXCodecUninstall.exe AddRemove-{C9EAEE6B-741F-421D-B9CE-9FA300DA92AD}_is1 - c:\smbx\unins000.exe AddRemove-UnityWebPlayer - c:\users\Smoses\AppData\Local\Unity\WebPlayer\Uninstall.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-1217470350-624965823-2328496604-1000\Software\SecuROM\License information*] "datasecu"=hex:e2,07,c1,f6,05,89,4a,8d,e5,a1,01,e9,46,c8,b7,b6,cd,b6,db,42,7f, fb,1d,9a,6f,c5,8a,5d,62,b2,1d,61,96,40,48,16,70,64,e6,da,7c,43,06,81,a7,d1,\ "rkeysecu"=hex:26,e5,ff,1c,35,8a,db,6a,ea,d0,21,91,ca,71,b2,c0 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*] "value"="?\0a\00\02\16 \0a?" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-03-26 13:47:13 ComboFix-quarantined-files.txt 2013-03-26 17:47 . Pre-Run: 196,155,985,920 bytes free Post-Run: 203,030,700,032 bytes free . - - End Of File - - 8B8DE1EE2061A540425FC4AB71E6DEB2
Post #8
[external image: Posted Image] Malwarebytes

Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.
———-
Post #9
sorry for the slight delay… here's the malwarebytes log: Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Database version: v2013.03.26.13 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16521 Smoses :: SMOSES-PC [administrator] 3/26/2013 3:07:17 PM mbam-log-2013-03-26 (15-07-17).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 292485 Time elapsed: 3 minute(s), Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) and the eset log: C:\Program Files (x86)\Vuze\.install4j\i4j_extf_32_5p83tu.dll a variant of Win32/Bunndle application C:\Program Files (x86)\Vuze\.install4j\user\BunndleOfferManager.dll a variant of Win32/Bunndle application C:\Programs\Guitar Hero Customs\programs\CDDVDgen\cddvdgen.zip a variant of Win32/HackTool.Patcher.AL application C:\Programs\Guitar Hero Customs\programs\CDDVDgen\cddvdgen120\Cdvdg120cdpatch.zip a variant of Win32/HackTool.Patcher.AL application C:\Users\Smoses\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\3d30f927-35a3a83e multiple threats C:\Users\Smoses\Desktop\media\Portable DVD-Cloner VII 7.00 Build 991\DVD-Cloner VII.dat Win32/HackTool.Patcher.A application C:\Users\Smoses\Desktop\media\Portable DVD-Cloner VII 7.00 Build 991\Portable DVD-Cloner VII.rar Win32/HackTool.Patcher.A application C:\Users\Smoses\Downloads\Portforward-Setup-Static-IP-Address.exe a variant of Win32/Bundled.Toolbar.Ask application G:\Games\On the Rain Slick Precipice of Darkness Ep 2\On The Rain - Slick Precipice Of Darkness Episode 2.iso a variant of Win32/HackTool.Patcher.N application G:\Programs\Rosetta Stone 3.4.7\Languages\data\1c\2\1c2136a7c1675c9ff26a4bae649e01faeac67f54 SWF/Exploit.CVE-2007-0071 trojan eek…
Post #10
Not as bad as it looks… :)

[external image: Posted Image] Download CKScanner by askey127 from Here & save it to your Desktop.
  • Right-click and Run as Administrator CKScanner.exe then click Search For Files
  • When the cursor hourglass disappears, click Save List To File
  • A message box will verify the file saved
  • Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply
———-
Post #11
CKScanner 2.1 - Additional Security Risks - These are not necessarily bad c:\program files (x86)\autodesk\maya2011\brushes\fun\cracks.mel c:\program files (x86)\autodesk\maya2011\brushes\fun\cracks.mel.icon c:\program files (x86)\autodesk\maya2011\docs\maya2011\en_us\files\uv_texture_mapping_creating_a_cracker_box_model.htm c:\program files (x86)\autodesk\maya2011\presets\nparticles\examples\crackegg.ma c:\program files (x86)\autodesk\maya2011\presets\nparticles\examples\.mayaswatches\crackegg.ma.swatch c:\program files (x86)\autodesk\maya2011\resources\l10n\ja_jp\scripts\crackshatter.res.mel c:\program files (x86)\autodesk\maya2011\scripts\others\crackshatter.mel c:\program files (x86)\autodesk\maya2011\scripts\others\crackshatter.res.mel c:\program files (x86)\six projects\six updater\tools\bin\ssh-keygen.exe c:\programs\adobe\adobe premiere pro cs4\plug-ins\en_us\vstplugins\decrackler1.dll c:\programs\adobe\adobe premiere pro cs4\plug-ins\en_us\vstplugins\decrackler2.dll c:\programs\adobe\adobe premiere pro cs4\plug-ins\en_us\vstplugins\decrackler6.dll c:\users\smoses\desktop\misc\new folder\stuff\unauthorized entry and physical security\safecracking for the computer scientist.pdf c:\users\smoses\desktop\misc\new folder\stuff\unauthorized entry and physical security\techniques of safecracking - wayne yeager - loompanics.pdf c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrack.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackalphatest.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackalphatestlightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackalphatestlightmappointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackalphatestlightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackalphatestlightmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackalphatestpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackalphatestpointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackalphatestshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackalphatesttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmapalphatest.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmapalphatestlightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmapalphatestlightmappointlighttitaninterior.cf x c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmapalphatestlightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmapalphatestlightmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmapalphatestpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmapalphatestpointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmapalphatestshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmapalphatesttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmaplightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmaplightmappointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmaplightmappointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmaplightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmaplightmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmappointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmappointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackenvmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcracklightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcracklightmappointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcracklightmappointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcracklightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcracklightmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrack.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackalphatest.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackalphatestlightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackalphatestlightmappointlighttitaninte rior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackalphatestlightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackalphatestlightmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackalphatestpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackalphatestpointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackalphatestshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackalphatesttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmapalphatest.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmapalphatestlightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmapalphatestlightmappointlighttit aninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmapalphatestlightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmapalphatestlightmaptitaninterior .cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmapalphatestpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmapalphatestpointlighttitaninteri or.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmapalphatestshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmapalphatesttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmaplightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmaplightmappointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmaplightmappointlighttitaninterio r.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmaplightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmaplightmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmappointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmappointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackenvmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncracklightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncracklightmappointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncracklightmappointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncracklightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncracklightmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetail.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailalphatest.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailalphatestlightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailalphatestlightmappoint lighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailalphatestlightmapshado w.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailalphatestlightmaptitan interior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailalphatestpointlight.cf x c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailalphatestpointlighttit aninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailalphatestshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailalphatesttitaninterior .cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetaillightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetaillightmappointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetaillightmappointlighttita ninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetaillightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetaillightmaptitaninterior. cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailpointlighttitaninterio r.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackparallaxdetailtitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackpointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncrackshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackndetailncracktitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackpointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcrackshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetailcracktitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrack.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackalphatest.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackalphatestlightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackalphatestlightmappointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackalphatestlightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackalphatestlightmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackalphatestpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackalphatestpointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackalphatestshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackalphatesttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcracklightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcracklightmappointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcracklightmappointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcracklightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcracklightmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrack.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackalphatest.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackalphatestlightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackalphatestlightmappointlighttitan interior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackalphatestlightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackalphatestlightmaptitaninterior.c fx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackalphatestpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackalphatestpointlighttitaninterior .cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackalphatestshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackalphatesttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncracklightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncracklightmappointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncracklightmappointlighttitaninterior. cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncracklightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncracklightmaptitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetail.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailalphatest.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailalphatestlightmap. cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailalphatestlightmapp ointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailalphatestlightmaps hadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailalphatestlightmapt itaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailalphatestpointligh t.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailalphatestpointligh ttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailalphatestshadow.cf x c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailalphatesttitaninte rior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetaillightmap.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetaillightmappointlight .cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetaillightmappointlight titaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetaillightmapshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetaillightmaptitaninter ior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailpointlighttitanint erior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackparallaxdetailtitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackpointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncrackshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackndetailncracktitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackpointlight.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackpointlighttitaninterior.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcrackshadow.cfx c:\users\smoses\documents\battlefield 2142\mods\bf2142\cache\{d7b71ee2-2bfe-11cf-8977-4905bec2c535}_112_3\rashaderstmbasedetaildirtcracktitaninterior.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetailcrackndetailncrack.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetailcrackndetailncrackalphatest.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetailcrackndetailncrackalphatestlightmap.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetailcrackndetailncrackalphatestlightmapshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetailcrackndetailncrackalphatestpointlight.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetailcrackndetailncrackalphatestshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetailcrackndetailncracklightmap.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetailcrackndetailncracklightmapshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetailcrackndetailncrackpointlight.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetailcrackndetailncrackshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetaildirtcrackndetailncrack.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetaildirtcrackndetailncrackalphatest.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetaildirtcrackndetailncrackalphatestlightmap.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetaildirtcrackndetailncrackalphatestlightmapshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetaildirtcrackndetailncrackalphatestpointlight.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetaildirtcrackndetailncrackalphatestshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetaildirtcrackndetailncracklightmap.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetaildirtcrackndetailncracklightmapshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetaildirtcrackndetailncrackpointlight.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_3\rashaderstmbasedetaildirtcrackndetailncrackshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetailcrackndetailncrack.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetailcrackndetailncrackalphatest.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetailcrackndetailncrackalphatestlightmap.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetailcrackndetailncrackalphatestlightmapshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetailcrackndetailncrackalphatestpointlight.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetailcrackndetailncrackalphatestshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetailcrackndetailncracklightmap.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetailcrackndetailncracklightmapshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetailcrackndetailncrackpointlight.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetailcrackndetailncrackshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetaildirtcrackndetailncrack.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetaildirtcrackndetailncrackalphatest.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetaildirtcrackndetailncrackalphatestlightmap.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetaildirtcrackndetailncrackalphatestlightmapshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetaildirtcrackndetailncrackalphatestpointlight.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetaildirtcrackndetailncrackalphatestshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetaildirtcrackndetailncracklightmap.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetaildirtcrackndetailncracklightmapshadow.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetaildirtcrackndetailncrackpointlight.cfx c:\users\smoses\documents\battlefield play4free\mods\main\cache\{d7b71ee2-2bfe-11cf-9b77-4905bec2c535}_222418_4\rashaderstmbasedetaildirtcrackndetailncrackshadow.cfx c:\users\smoses\documents\wolfire\overgrowth\data\textures\terrain\detailtextures\cracked_ground.tga_avg_color_cache scanner sequence 3.ZZ.11.LACPJB —– EOF —–
Post #12
ComboFix
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:


    ClearJavaCache::

    File::
    C:\Program Files (x86)\Vuze\.install4j\i4j_extf_32_5p83tu.dll
    C:\Program Files (x86)\Vuze\.install4j\user\BunndleOfferManager.dll
    C:\Programs\Guitar Hero Customs\programs\CDDVDgen\cddvdgen.zip
    C:\Programs\Guitar Hero Customs\programs\CDDVDgen\cddvdgen120\Cdvdg120cdpatch.zip
    C:\Users\Smoses\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\3d30f927-35a3a83e
    C:\Users\Smoses\Desktop\media\Portable DVD-Cloner VII 7.00 Build 991\DVD-Cloner VII.dat
    C:\Users\Smoses\Desktop\media\Portable DVD-Cloner VII 7.00 Build 991\Portable DVD-Cloner VII.rar
    C:\Users\Smoses\Downloads\Portforward-Setup-Static-IP-Address.exe
    G:\Games\On the Rain Slick Precipice of Darkness Ep 2\On The Rain - Slick Precipice Of Darkness Episode 2.iso
    G:\Programs\Rosetta Stone 3.4.7\Languages\data\1c\2\1c2136a7c1675c9ff26a4bae649e01faeac67f54

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Post the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #13
ComboFix 13-03-28.01 - Smoses 03/29/2013 1:32.2.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4094.2184 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Smoses\Desktop\CFScript.txt AV: Panda Cloud Antivirus *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59} SP: Panda Cloud Antivirus *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . FILE :: "c:\program files (x86)\Vuze\.install4j\i4j_extf_32_5p83tu.dll" "c:\program files (x86)\Vuze\.install4j\user\BunndleOfferManager.dll" "c:\programs\Guitar Hero Customs\programs\CDDVDgen\cddvdgen.zip" "c:\programs\Guitar Hero Customs\programs\CDDVDgen\cddvdgen120\Cdvdg120cdpatch.zip" "c:\users\Smoses\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\3d30f927-35a3a83e" "c:\users\Smoses\Desktop\media\Portable DVD-Cloner VII 7.00 Build 991\DVD-Cloner VII.dat" "c:\users\Smoses\Desktop\media\Portable DVD-Cloner VII 7.00 Build 991\Portable DVD-Cloner VII.rar" "c:\users\Smoses\Downloads\Portforward-Setup-Static-IP-Address.exe" "g:\games\On the Rain Slick Precipice of Darkness Ep 2\On The Rain - Slick Precipice Of Darkness Episode 2.iso" "g:\programs\Rosetta Stone 3.4.7\Languages\data\1c\2\1c2136a7c1675c9ff26a4bae649e01faeac67f54" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Vuze\.install4j\i4j_extf_32_5p83tu.dll c:\program files (x86)\Vuze\.install4j\user\BunndleOfferManager.dll c:\programs\Guitar Hero Customs\programs\CDDVDgen\cddvdgen.zip c:\programs\Guitar Hero Customs\programs\CDDVDgen\cddvdgen120\Cdvdg120cdpatch.zip c:\users\Smoses\Desktop\media\Portable DVD-Cloner VII 7.00 Build 991\DVD-Cloner VII.dat c:\users\Smoses\Desktop\media\Portable DVD-Cloner VII 7.00 Build 991\Portable DVD-Cloner VII.rar c:\users\Smoses\Downloads\Portforward-Setup-Static-IP-Address.exe g:\games\On the Rain Slick Precipice of Darkness Ep 2\On The Rain - Slick Precipice Of Darkness Episode 2.iso g:\programs\Rosetta Stone 3.4.7\Languages\data\1c\2\1c2136a7c1675c9ff26a4bae649e01faeac67f54 . Infected copy of c:\windows\SysWow64\userinit.exe was found and disinfected Restored copy from - c:\windows\erdnt\cache86\userinit.exe . . ((((((((((((((((((((((((( Files Created from 2013-02-28 to 2013-03-29 ))))))))))))))))))))))))))))))) . . 2013-03-29 05:44 . 2013-03-29 05:44 ——– d—–w- c:\users\Mcx1-SMOSES-PC\AppData\Local\temp 2013-03-29 05:44 . 2013-03-29 05:44 ——– d—–w- c:\users\Guest\AppData\Local\temp 2013-03-29 05:44 . 2013-03-29 05:44 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-03-29 05:44 . 2013-03-29 05:44 ——– d—–w- c:\users\Administrator\AppData\Local\temp 2013-03-27 02:50 . 2013-03-27 02:50 ——– d—–w- c:\program files (x86)\ESET 2013-03-26 19:06 . 2013-03-26 19:06 ——– d—–w- c:\users\Smoses\AppData\Local\Programs 2013-03-26 17:24 . 2013-03-15 06:28 9311288 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F0DC47E0-342D-4A80-A02C-984D27D21475}\mpengine.dll 2013-03-21 20:43 . 2013-03-21 20:43 ——– d—–w- c:\program files (x86)\Common Files\Java 2013-03-21 20:43 . 2013-03-21 20:43 95648 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-03-21 04:20 . 2012-08-23 15:09 3072 —-a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui 2013-03-21 04:17 . 2012-08-24 18:13 154480 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2013-03-21 04:17 . 2012-08-24 18:09 458712 —-a-w- c:\windows\system32\drivers\cng.sys 2013-03-21 04:17 . 2012-08-24 18:05 340992 —-a-w- c:\windows\system32\schannel.dll 2013-03-21 04:17 . 2012-08-24 18:03 1448448 —-a-w- c:\windows\system32\lsasrv.dll 2013-03-21 04:17 . 2012-08-24 16:57 247808 —-a-w- c:\windows\SysWow64\schannel.dll 2013-03-21 04:17 . 2012-08-24 16:57 22016 —-a-w- c:\windows\SysWow64\secur32.dll 2013-03-21 04:17 . 2012-08-24 16:53 96768 —-a-w- c:\windows\SysWow64\sspicli.dll 2013-03-21 04:17 . 2013-02-12 04:12 19968 —-a-w- c:\windows\system32\drivers\usb8023.sys 2013-03-14 07:32 . 2009-08-20 03:50 24416 —-a-r- c:\windows\system32\AdobePDFUI.dll 2013-03-14 07:01 . 2013-03-14 07:01 ——– d—–w- c:\program files\Microsoft Silverlight 2013-03-03 05:23 . 2013-03-03 05:23 ——– d—–w- c:\programdata\ATI 2013-03-03 05:23 . 2013-03-03 05:23 ——– d—–w- c:\program files (x86)\AMD AVT 2013-03-03 05:23 . 2013-03-03 05:23 ——– d—–w- c:\program files (x86)\AMD APP 2013-02-27 08:30 . 2013-02-27 08:30 ——– d—–w- c:\users\Smoses\AppData\Roaming\com.stoicstudio.TheBannerSagaFactions 2013-02-27 08:30 . 2013-02-28 18:40 ——– d—–w- c:\users\Smoses\tbs_logs . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-29 05:46 . 2009-11-06 02:01 25640 —-a-w- c:\windows\gdrv.sys 2013-03-21 20:43 . 2012-07-22 03:52 861088 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2013-03-21 20:43 . 2011-04-16 22:02 782240 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-03-14 07:46 . 2010-06-04 06:11 280904 —-a-w- c:\windows\SysWow64\PnkBstrB.xtr 2013-03-14 07:46 . 2009-11-08 19:37 280904 —-a-w- c:\windows\SysWow64\PnkBstrB.exe 2013-03-14 07:41 . 2009-11-08 19:37 280904 —-a-w- c:\windows\SysWow64\PnkBstrB.ex0 2013-03-14 07:05 . 2009-11-05 23:16 72013344 —-a-w- c:\windows\system32\MRT.exe 2013-03-13 05:49 . 2012-04-05 14:04 693976 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-03-13 05:49 . 2011-05-19 16:49 73432 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-02-12 05:45 . 2013-03-14 00:38 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45 . 2013-03-14 00:38 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 05:45 . 2013-03-14 00:38 308736 —-a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45 . 2013-03-14 00:38 111104 —-a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 04:48 . 2013-03-14 00:38 474112 —-a-w- c:\windows\apppatch\AcSpecfc.dll 2013-02-12 04:48 . 2013-03-14 00:38 2176512 —-a-w- c:\windows\apppatch\AcGenral.dll 2013-02-07 16:42 . 2013-02-07 16:42 333856 —-a-w- c:\windows\system32\RaCoInstx.dll 2013-02-07 16:42 . 2013-02-07 16:42 2201120 —-a-w- c:\windows\system32\drivers\netr28ux.sys 2013-01-17 05:28 . 2009-11-05 23:05 273840 ——w- c:\windows\system32\MpSigStub.exe 2013-01-05 05:53 . 2013-02-15 07:33 5553512 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-01-05 05:00 . 2013-02-15 07:33 3967848 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2013-01-05 05:00 . 2013-02-15 07:33 3913064 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2013-01-04 05:46 . 2013-02-15 07:34 215040 —-a-w- c:\windows\system32\winsrv.dll 2013-01-04 04:51 . 2013-02-15 07:34 5120 —-a-w- c:\windows\SysWow64\wow32.dll 2013-01-04 04:43 . 2013-02-15 07:34 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2013-01-04 03:26 . 2013-02-15 07:33 3153408 —-a-w- c:\windows\system32\win32k.sys 2013-01-04 02:47 . 2013-02-15 07:34 25600 —-a-w- c:\windows\SysWow64\setup16.exe 2013-01-04 02:47 . 2013-02-15 07:34 7680 —-a-w- c:\windows\SysWow64\instnm.exe 2013-01-04 02:47 . 2013-02-15 07:34 2048 —-a-w- c:\windows\SysWow64\user.exe 2013-01-04 02:47 . 2013-02-15 07:34 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll 2013-01-03 06:00 . 2013-02-15 07:34 1913192 —-a-w- c:\windows\system32\drivers\tcpip.sys 2013-01-03 06:00 . 2013-02-15 07:34 288088 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2009-11-20 01:08 . 2009-11-20 01:08 3749224 —-a-w- c:\program files (x86)\Common Files\adlmint_libFNP.dll 2009-11-20 01:08 . 2009-11-20 01:08 2941288 —-a-w- c:\program files (x86)\Common Files\adlmint.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872] "HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-09-24 393216] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "PSUNMain"="c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2010-05-14 406848] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "QuickTime Task"="c:\programs\QuickTime\QTTask.exe" [2010-11-29 421888] "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824] "DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-01-30 450560] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-02-13 1263952] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux6"=wdmaud.drv . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016] R3 AODDriver;AODDriver;c:\program files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys [2009-02-23 14904] R3 atidgllk;atidgllk;c:\program files (x86)\GIGABYTE\ET6\atidgllk.sys [2006-07-19 12048] R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x] R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832] R3 Desura Install Service;Desura Install Service;c:\program files (x86)\Common Files\Desura\desura_service.exe [2011-08-05 131400] R3 etdrv;etdrv;c:\windows\etdrv.sys [2010-02-04 25640] R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-03-27 1436424] R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe [2011-01-13 129440] R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2010-02-11 30528] R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys [2009-04-30 15896] R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2009-04-30 327576] R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\DRIVERS\LVUSBS64.sys [2008-07-26 50072] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456] R3 RkPavproc1;RkPavproc1;c:\windows\system32\drivers\RkPavproc1.sys [x] R3 RkPavproc2;RkPavproc2;c:\windows\system32\drivers\RkPavproc2.sys [x] R3 RkPavproc3;RkPavproc3;c:\windows\system32\drivers\RkPavproc3.sys [x] R3 RkPavproc4;RkPavproc4;c:\windows\system32\drivers\RkPavproc4.sys [x] R3 RkPavproc5;RkPavproc5;c:\windows\system32\drivers\RkPavproc5.sys [x] R3 RkPavproc6;RkPavproc6;c:\windows\system32\drivers\RkPavproc6.sys [x] R3 RkPavproc7;RkPavproc7;c:\windows\system32\drivers\RkPavproc7.sys [x] R3 RkPavproc8;RkPavproc8;c:\windows\system32\drivers\RkPavproc8.sys [x] R3 RkPavproc9;RkPavproc9;c:\windows\system32\drivers\RkPavproc9.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-06 1255736] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-31 55024] S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x] S1 PSINKNC;PSINKNC;c:\windows\system32\DRIVERS\psinknc.sys [2010-05-04 149512] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-12-19 240640] S2 DirMngr;DirMngr;c:\programs\PGP\GnuPG\dirmngr.exe [2011-03-02 224256] S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376] S2 GEST Service;GEST Service for program management.;c:\program files (x86)\GIGABYTE\EnergySaver\GSvr.exe [2009-02-06 68136] S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;g:\games\Tribes Ascend\HiPatchService.exe [2012-04-05 8704] S2 LVPrcS64;Process Monitor;c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-10-07 191000] S2 mi-raysat_3dsmax2011_32;mental ray 3.8 Satellite for Autodesk 3ds Max 2011 32-bit 32-bit;c:\program files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe [2010-03-10 86016] S2 mi-raysat_3dsmax2011_64;mental ray 3.8 Satellite for Autodesk 3ds Max 2011 64-bit 64-bit;c:\program files\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_64server.exe [2010-03-10 86016] S2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2010-04-30 136448] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344] S2 PSINAflt;PSINAflt;c:\windows\system32\DRIVERS\PSINAflt.sys [2010-05-27 158280] S2 PSINFile;PSINFile;c:\windows\system32\DRIVERS\PSINFile.sys [2010-04-30 114696] S2 PSINProc;PSINProc;c:\windows\system32\DRIVERS\PSINProc.sys [2010-04-30 121864] S2 PSINProt;PSINProt;c:\windows\system32\DRIVERS\PSINProt.sys [2010-05-12 126024] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-11-06 96256] S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [2009-10-07 30232] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-08-20 239616] . . Contents of the 'Scheduled Tasks' folder . 2013-03-29 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 05:49] . 2013-03-26 c:\windows\Tasks\EasyShare Registration Task.job - c:\windows\system32\rundll32.exe [2009-07-13 01:14] . 2013-03-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-28 18:17] . 2013-03-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-28 18:17] . 2013-03-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1217470350-624965823-2328496604-1000Core.job - c:\users\Smoses\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-18 19:27] . 2013-03-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1217470350-624965823-2328496604-1000UA.job - c:\users\Smoses\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-18 19:27] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-10-01 825184] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://google.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = IE: &Download by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/204 IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: Do&wnload selected by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: att.net Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: sbcglobal.net Trusted Zone: soe.com Trusted Zone: sony.com Trusted Zone: yahoo.com\clientapps TCP: DhcpNameServer = 75.75.76.76 75.75.75.75 FF - ProfilePath - c:\users\Smoses\AppData\Roaming\Mozilla\Firefox\Profiles\jgjlybjv.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKLM-Run- - (no file) AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe AddRemove-Steam App 10500 - c:\programs\Steam\steam.exe AddRemove-Steam App 107100 - c:\programs\Steam\steam.exe AddRemove-Steam App 12150 - c:\programs\Steam\steam.exe AddRemove-Steam App 12810 - c:\programs\Steam\steam.exe AddRemove-Steam App 12900 - c:\programs\Steam\steam.exe AddRemove-Steam App 13210 - c:\programs\Steam\steam.exe AddRemove-Steam App 13260 - c:\programs\Steam\steam.exe AddRemove-Steam App 17300 - c:\programs\Steam\steam.exe AddRemove-Steam App 17330 - c:\programs\Steam\steam.exe AddRemove-Steam App 17410 - c:\programs\Steam\steam.exe AddRemove-Steam App 19900 - c:\programs\Steam\steam.exe AddRemove-Steam App 20500 - c:\programs\Steam\steam.exe AddRemove-Steam App 20540 - c:\programs\Steam\steam.exe AddRemove-Steam App 20900 - c:\programs\Steam\steam.exe AddRemove-Steam App 20920 - c:\programs\Steam\steam.exe AddRemove-Steam App 20930 - c:\programs\Steam\steam.exe AddRemove-Steam App 218 - c:\programs\Steam\steam.exe AddRemove-Steam App 28050 - c:\programs\Steam\steam.exe AddRemove-Steam App 400 - c:\programs\Steam\steam.exe AddRemove-Steam App 440 - c:\programs\Steam\steam.exe AddRemove-Steam App 44320 - c:\programs\Steam\steam.exe AddRemove-Steam App 4560 - c:\programs\Steam\steam.exe AddRemove-Steam App 4760 - c:\programs\Steam\steam.exe AddRemove-Steam App 4770 - c:\programs\Steam\steam.exe AddRemove-Steam App 500 - c:\programs\Steam\steam.exe AddRemove-Steam App 50130 - c:\programs\Steam\steam.exe AddRemove-Steam App 550 - c:\programs\Steam\steam.exe AddRemove-Steam App 620 - c:\programs\Steam\steam.exe AddRemove-Steam App 9340 - c:\programs\Steam\steam.exe AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files (x86)\DivX\DivXCodecUninstall.exe AddRemove-{C9EAEE6B-741F-421D-B9CE-9FA300DA92AD}_is1 - c:\smbx\unins000.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-1217470350-624965823-2328496604-1000\Software\SecuROM\License information*] "datasecu"=hex:e2,07,c1,f6,05,89,4a,8d,e5,a1,01,e9,46,c8,b7,b6,cd,b6,db,42,7f, fb,1d,9a,6f,c5,8a,5d,62,b2,1d,61,96,40,48,16,70,64,e6,da,7c,43,06,81,a7,d1,\ "rkeysecu"=hex:26,e5,ff,1c,35,8a,db,6a,ea,d0,21,91,ca,71,b2,c0 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*] "value"="?\0a\00\02\16 \0a?" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Completion time: 2013-03-29 01:55:43 - machine was rebooted ComboFix-quarantined-files.txt 2013-03-29 05:55 ComboFix2.txt 2013-03-26 17:47 . Pre-Run: 198,510,776,320 bytes free Post-Run: 197,401,739,264 bytes free . - - End Of File - - 1C8CE824066E7939BA661FD4BE3314C5
Post #15
Seems to be about the same. Fragmented images seem to be a much more rare occurrence now, though videos are still wonky. Windows action center is still showing the win32/small.ca notice.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI