TechSpot

EI popups while using Firefox

By ireallyneedhelp
Mar 9, 2011
  1. Hello, I would really appreciate some help as I'm at my wits end with this issue.

    As stated in the Title, I've been experiencing annoying pop-ups from IE while using Firefox. I've run multiple scans (Malwarebytes Anti-Malware and Super Anti-Spyware) both using FULL scans and in safe mode. The first couple of times it detected some adware and deleted them but my issue is still occurring. When I run these scans again several other times, it detects that there are NO defects while in the background, a new pop-up (virus) shows up. I've read countless posts online but nothing seems to work. If anybody has experienced a similar issue and solution, I would really appreciate the help! Thank you very much.

    Note: Sorry for spelling error in title. I mean IE* popups
     
  2. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  3. ireallyneedhelp

    ireallyneedhelp TS Rookie Topic Starter

    Thank you so much for your reply! I am currently in the process of completing the 8 steps and will soon paste my logs and results for you to view.
     
  4. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Sure thing :)
     
  5. ireallyneedhelp

    ireallyneedhelp TS Rookie Topic Starter

    Just a few small notes:
    1) I did this manually and it seemed to have stopped the popups for now. I copied the website from which most of the ads were coming from and pasted the link in the Internet Explorers restricted websites. Not sure if this is a complete and safe fix but thought I would mention it anyway.
    2) When I ran the GMER scan, at the end of the scan a message came up with the following "GM hasn't found any modification." Followed by an "Ok" to click. I saved it anyway, but it was a blank log. Have I done anything wrong?

    Here are my logs for the rest.

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5996

    Windows 6.1.7601 Service Pack 1
    Internet Explorer 8.0.7601.17514

    10/03/2011 4:18:37 PM
    mbam-log-2011-03-10 (16-18-37).txt

    Scan type: Quick scan
    Objects scanned: 165764
    Time elapsed: 6 minute(s), 18 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    .
    DDS (Ver_11-03-05.01) - NTFS_AMD64
    Run by MaryAnn at 17:40:43.94 on 10/03/2011
    Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_24
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.2934.1366 [GMT -5:00]
    .
    AV: Kaspersky Anti-Virus *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
    AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Kaspersky Anti-Virus *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
    SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
    .
    ============== Running Processes ===============
    .
    C:\windows\system32\wininit.exe
    C:\windows\system32\lsm.exe
    C:\windows\system32\svchost.exe -k DcomLaunch
    C:\windows\system32\svchost.exe -k RPCSS
    C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\windows\system32\svchost.exe -k netsvcs
    C:\windows\system32\svchost.exe -k LocalService
    C:\windows\system32\svchost.exe -k NetworkService
    C:\windows\System32\spoolsv.exe
    C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
    C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
    C:\windows\system32\taskhost.exe
    C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
    C:\windows\system32\svchost.exe -k imgsvc
    C:\Windows\system32\TODDSrv.exe
    C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
    C:\Program Files\TOSHIBA\TECO\TecoService.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\windows\system32\SearchIndexer.exe
    C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
    C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\windows\system32\Dwm.exe
    C:\windows\Explorer.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\windows\system32\conhost.exe
    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
    C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
    C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
    C:\Program Files\TOSHIBA\TECO\Teco.exe
    C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe
    C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
    C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\windows\system32\igfxext.exe
    C:\windows\system32\igfxsrvc.exe
    C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 7\firefox.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe


    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_11-03-05.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 06/12/2010 5:50:15 AM
    System Uptime: 10/03/2011 4:05:12 PM (1 hours ago)
    .
    Motherboard: Intel Corp. | | Base Board Product Name
    Processor: Intel(R) Pentium(R) CPU P6100 @ 2.00GHz | CPU | 919/1066mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 286 GiB total, 250.715 GiB free.
    D: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID:
    Description: Ethernet Controller
    Device ID: PCI\VEN_1969&DEV_2060&SUBSYS_FD501179&REV_C1\4&1C2AA106&0&00E5
    Manufacturer:
    Name: Ethernet Controller
    PNP Device ID: PCI\VEN_1969&DEV_2060&SUBSYS_FD501179&REV_C1\4&1C2AA106&0&00E5
    Service:
    .
    ==== System Restore Points ===================
    .
    RP61: 09/03/2011 8:11:39 PM - Windows 7 Service Pack 1
    .
    ==== Installed Programs ======================
    .
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader X
    Adobe Shockwave Player 11.5
    Apple Application Support
    Apple Software Update
    Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
    Avira AntiVir Personal - Free Antivirus
    Best Buy pc app
    Cisco EAP-FAST Module
    Cisco LEAP Module
    Cisco PEAP Module
    D3DX10
    DivX Web Player
    ESET Online Scanner v3
    Google Chrome
    Google Toolbar for Internet Explorer
    Google Update Helper
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) Management Engine Components
    Intel(R) Rapid Storage Technology
    Java Auto Updater
    Java(TM) 6 Update 24
    Junk Mail filter update
    Kaspersky Anti-Virus 2011
     
  6. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    1. It's better not to do anything on your own, as my instructions say.
    2. You did perfectly fine :)

    Both DDS logs are incomplete. Please, repost them.
     
  7. ireallyneedhelp

    ireallyneedhelp TS Rookie Topic Starter

    I apologize my logs were not FULLY pasted. This is a re-post of the FULL logs to both

    .
    DDS (Ver_11-03-05.01) - NTFS_AMD64
    Run by MaryAnn at 17:40:43.94 on 10/03/2011
    Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_24
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.2934.1366 [GMT -5:00]
    .
    AV: Kaspersky Anti-Virus *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
    AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Kaspersky Anti-Virus *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
    SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
    .
    ============== Running Processes ===============
    .
    C:\windows\system32\wininit.exe
    C:\windows\system32\lsm.exe
    C:\windows\system32\svchost.exe -k DcomLaunch
    C:\windows\system32\svchost.exe -k RPCSS
    C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\windows\system32\svchost.exe -k netsvcs
    C:\windows\system32\svchost.exe -k LocalService
    C:\windows\system32\svchost.exe -k NetworkService
    C:\windows\System32\spoolsv.exe
    C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
    C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
    C:\windows\system32\taskhost.exe
    C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
    C:\windows\system32\svchost.exe -k imgsvc
    C:\Windows\system32\TODDSrv.exe
    C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
    C:\Program Files\TOSHIBA\TECO\TecoService.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\windows\system32\SearchIndexer.exe
    C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
    C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\windows\system32\Dwm.exe
    C:\windows\Explorer.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\windows\system32\conhost.exe
    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
    C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
    C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
    C:\Program Files\TOSHIBA\TECO\Teco.exe
    C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe
    C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
    C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\windows\system32\igfxext.exe
    C:\windows\system32\igfxsrvc.exe
    C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 7\firefox.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 7\plugin-container.exe
    C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
    C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
    C:\Program Files (x86)\Blubster\Blubster.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
    C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\windows\System32\svchost.exe -k LocalServicePeerNet
    C:\windows\system32\wbem\wmiprvse.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
    C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
    C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
    C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
    C:\windows\system32\DllHost.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    C:\windows\System32\svchost.exe -k secsvcs
    C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
    C:\Users\MaryAnn\Downloads\e70el4r7.exe
    C:\windows\system32\SearchProtocolHost.exe
    C:\windows\system32\SearchFilterHost.exe
    C:\Users\MaryAnn\Downloads\dds.scr
    C:\windows\system32\conhost.exe
    C:\windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.ca/
    uDefault_Page_URL = hxxp://www.google.com/ig?brand=TSND&bmod=TSND
    mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSND&bmod=TSND
    mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSND&bmod=TSND
    uInternet Settings,ProxyOverride = *.local;<local>
    mWinlogon: Userinit=userinit.exe,
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\ievkbd.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll
    BHO: MediaBar: {ee9a4208-64ec-11de-8440-204256d89593} - C:\PROGRA~2\SHAREA~1\MediaBar\ToolBar\ShareazaMediabarDx.dll
    BHO: TOSHIBA Media Controller Plug-in: {f3c88694-effa-4d78-b409-54b7b2535b14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    TB: MediaBar: {ee9a4208-64ec-11de-8440-204256d89593} - C:\PROGRA~2\SHAREA~1\MediaBar\ToolBar\ShareazaMediabarDx.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\yt.dll
    TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
    uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    uRun: [Speech Recognition] "C:\windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
    uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    uRun: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
    mRun: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
    mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe"
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [Blubster] C:\Program Files (x86)\Blubster\Blubster.exe SILENT
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll
    BHO-X64: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\x64\ievkbd.dll
    BHO-X64: IEVkbdBHO - No File
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
    BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg64.dll
    BHO-X64: FilterBHO Class: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\x64\klwtbbho.dll
    BHO-X64: link filter bho - No File
    TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
    TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    mRun-x64: [(Default)]
    mRun-x64: [IgfxTray] C:\windows\system32\igfxtray.exe
    mRun-x64: [HotKeysCmds] C:\windows\system32\hkcmd.exe
    mRun-x64: [Persistence] C:\windows\system32\igfxpers.exe
    mRun-x64: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
    mRun-x64: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t
    mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
    mRun-x64: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
    mRun-x64: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
    mRun-x64: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
    mRun-x64: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
    mRun-x64: [TosWaitSrv] %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
    mRun-x64: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r
    mRun-x64: [SmartFaceVWatcher] %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
    mRun-x64: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
    mRun-x64: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
    mRun-x64: [TosNC] %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe
    mRun-x64: [TosReelTimeMonitor] %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\MaryAnn\AppData\Roaming\Mozilla\Firefox\Profiles\ddga688p.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
    FF - prefs.js: keyword.URL - hxxp://search.shareazaweb.com/web?src=ffb&systemid=3&q=
    FF - prefs.js: network.proxy.type - 4
    FF - component: C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\kavlinkfilter.dll
    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
    FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60129.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 7\plugins\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: C:\Users\MaryAnn\AppData\Roaming\Mozilla\plugins\np-mswmp.dll
    FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    ============= SERVICES / DRIVERS ===============
    .
    R1 kl2;kl2;C:\Windows\System32\drivers\kl2.sys [2010-6-9 11864]
    R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2010-4-22 27736]
    R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920]
    R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
    R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-6-29 128752]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2011-3-8 135336]
    R2 AntiVirService;Avira AntiVir Guard;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2011-3-8 267944]
    R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgntflt.sys [2011-3-8 83120]
    R2 AVP;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe [2010-7-1 352976]
    R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2010-2-28 821664]
    R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-4-24 483688]
    R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2010-2-25 252928]
    R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\Windows\System32\drivers\TVALZFL.sys [2009-6-19 14472]
    R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-10-14 2320920]
    R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2009-9-17 56344]
    R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2010-2-27 158976]
    R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2009-11-2 22544]
    R3 PGEffect;Pangu effect driver;C:\Windows\System32\drivers\PGEffect.sys [2010-10-14 35008]
    R3 QIOMem;Generic IO & Memory Access;C:\Windows\System32\drivers\QIOMem.sys [2009-6-15 12800]
    R3 rtl8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\Windows\System32\drivers\rtl8192Ce.sys [2010-4-28 932384]
    R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2010-4-24 721768]
    R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2010-4-24 269672]
    R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2010-4-24 25960]
    R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2010-4-24 22376]
    R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-4-24 209768]
    R3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-10-14 51512]
    R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-2-5 137560]
    R3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2010-2-23 835952]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-9-9 136176]
    S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
    S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-10-14 239136]
    S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]
    S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]
    S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-3-9 59392]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-12-14 51712]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-12-8 1255736]
    .
    =============== Created Last 30 ================
    .
    2011-03-10 21:07:22 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{DD68F372-E51D-48A4-9828-52BA48CA987E}
    2011-03-10 01:11:52 -------- d-----w- C:\windows\System32\SPReview
    2011-03-10 01:10:50 -------- d-----w- C:\windows\System32\EventProviders
    2011-03-10 00:59:59 2314752 ----a-w- C:\windows\System32\tquery.dll
    2011-03-10 00:57:59 932352 ----a-w- C:\windows\SysWow64\printui.dll
    2011-03-10 00:56:59 856576 ----a-w- C:\windows\SysWow64\FirewallControlPanel.dll
    2011-03-10 00:55:59 878592 ----a-w- C:\windows\SysWow64\Bubbles.scr
    2011-03-10 00:54:56 3072 ----a-w- C:\windows\System32\drivers\en-US\tsusbflt.sys.mui
    2011-03-10 00:54:55 2560 ----a-w- C:\windows\System32\drivers\en-US\rdpwd.sys.mui
    2011-03-10 00:54:50 6144 ----a-w- C:\windows\System32\drivers\en-US\IPMIDrv.sys.mui
    2011-03-10 00:54:50 4608 ----a-w- C:\windows\System32\drivers\en-US\kbdclass.sys.mui
    2011-03-10 00:54:30 209920 ----a-w- C:\windows\SysWow64\PkgMgr.exe
    2011-03-10 00:54:30 189952 ----a-w- C:\windows\SysWow64\wdscore.dll
    2011-03-10 00:54:07 323072 ----a-w- C:\windows\SysWow64\drvstore.dll
    2011-03-10 00:54:06 257024 ----a-w- C:\windows\SysWow64\dpx.dll
    2011-03-10 00:53:55 606208 ----a-w- C:\windows\SysWow64\wbem\fastprox.dll
    2011-03-10 00:53:55 363008 ----a-w- C:\windows\SysWow64\wbemcomn.dll
    2011-03-10 00:46:41 529408 ----a-w- C:\windows\System32\wbemcomn.dll
    2011-03-10 00:46:41 524288 ----a-w- C:\windows\System32\wmicmiplugin.dll
    2011-03-10 00:46:41 1225216 ----a-w- C:\windows\System32\wbem\wbemcore.dll
    2011-03-10 00:46:06 933376 ----a-w- C:\windows\System32\SmiEngine.dll
    2011-03-10 00:45:46 199168 ----a-w- C:\windows\System32\PkgMgr.exe
    2011-03-10 00:43:55 422912 ----a-w- C:\windows\System32\drvstore.dll
    2011-03-10 00:43:54 399872 ----a-w- C:\windows\System32\dpx.dll
    2011-03-09 23:40:09 -------- d-----w- C:\Users\MaryAnn\AppData\Local\ElevatedDiagnostics
    2011-03-09 23:22:28 321024 ----a-w- C:\windows\System32\d3d10_1core.dll
    2011-03-09 23:22:28 219136 ----a-w- C:\windows\SysWow64\d3d10_1core.dll
    2011-03-09 23:22:28 197120 ----a-w- C:\windows\System32\d3d10_1.dll
    2011-03-09 23:22:28 161792 ----a-w- C:\windows\SysWow64\d3d10_1.dll
    2011-03-09 23:18:27 472808 ----a-w- C:\windows\SysWow64\deployJava1.dll
    2011-03-09 20:40:35 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{70A1C39E-626F-46DF-AF3B-3820319DE353}
    2011-03-09 07:28:09 -------- d-----w- C:\Program Files (x86)\ESET
    2011-03-09 06:57:00 -------- d-----w- C:\windows\pss
    2011-03-09 05:16:26 7947600 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{4B660CAD-C027-4708-99BC-FF204EDCC5BE}\mpengine.dll
    2011-03-08 23:56:53 -------- d-----w- C:\Users\MaryAnn\AppData\Roaming\Avira
    2011-03-08 23:53:23 83120 ----a-w- C:\windows\System32\drivers\avgntflt.sys
    2011-03-08 23:53:21 -------- d-----w- C:\Program Files (x86)\Avira
    2011-03-08 23:53:21 -------- d-----w- C:\PROGRA~3\Avira
    2011-03-08 23:36:15 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{66F93538-C520-4A1C-8E6F-96B0274D3D7D}
    2011-03-08 22:45:06 -------- d-----w- C:\Users\MaryAnn\AppData\Roaming\SUPERAntiSpyware.com
    2011-03-08 22:44:58 -------- d-----w- C:\Program Files\SUPERAntiSpyware
    2011-03-08 21:24:24 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{D2CC22E8-C43D-4C09-A745-0F6B454ADEC1}
    2011-03-08 20:32:24 -------- d-----w- C:\PROGRA~3\SUPERAntiSpyware.com
    2011-03-08 20:32:19 -------- d-----w- C:\PROGRA~3\!SASCORE
    2011-03-07 19:49:25 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{32E8AC55-6BE0-4BAA-A8F2-172305E2FE78}
    2011-03-07 05:29:04 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{8CF54C57-C9E9-48AA-8381-E42263E70369}
    2011-03-06 06:08:02 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{29885AF2-A004-417B-BC39-DEC94BB19436}
    2011-03-05 18:07:34 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{1D516D2B-263E-4F8C-A1A7-037FE1DEF378}
    2011-03-05 02:44:06 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{9AB6C56E-D6BF-473B-B049-982DDCAFE928}
    2011-03-04 08:01:42 -------- d-----w- C:\Users\MaryAnn\AppData\Roaming\cacaoweb
    2011-03-04 00:03:10 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{882929A7-0BC2-4E70-A727-C06FC5F9DF32}
    2011-03-02 23:51:11 -------- d-----w- C:\Users\MaryAnn\AppData\Local\Microsoft Help
    2011-03-02 21:04:30 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{0278F90F-3EB1-4C32-A2C4-FB037A549DBB}
    2011-03-02 05:58:36 -------- d-----w- C:\Users\MaryAnn\AppData\Roaming\GetRightToGo
    2011-03-02 05:34:51 -------- d-----w- C:\Users\MaryAnn\AppData\Local\DDMSettings
    2011-03-02 05:29:49 -------- d-----w- C:\PROGRA~3\DivX
    2011-03-01 22:08:09 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{8B245C40-590B-4D08-8EF1-3E6444F610A1}
    2011-03-01 06:36:06 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{C9648AFB-1079-4823-830D-73791147A698}
    2011-02-28 18:35:42 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{D9A98A79-9807-47B7-8C73-28876BB1740F}
    2011-02-27 21:24:54 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{46E9F536-F3CF-477C-84EB-978B71437312}
    2011-02-27 01:43:25 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{7DC3866C-7A24-48BA-B2A2-391C055ED4CD}
    2011-02-25 20:22:48 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{7996ED0D-6C0A-4BB6-8FAC-1F7C47E93A6E}
    2011-02-25 03:46:03 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{589A8231-A3CD-44E6-B60A-4062BAE7438A}
    2011-02-24 08:03:23 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{20C3F8B8-BB97-4A80-B65D-854856A6EE49}
    2011-02-24 07:47:45 -------- d-----w- C:\Users\MaryAnn\AppData\Local\Yahoo
    2011-02-24 07:35:40 -------- d-----w- C:\Program Files (x86)\Yahoo!
    2011-02-23 20:02:56 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{7165311D-717D-49DE-89D2-0751AB99E16B}
    2011-02-23 07:42:05 870912 ----a-w- C:\windows\SysWow64\XpsPrint.dll
    2011-02-23 07:42:05 1465344 ----a-w- C:\windows\System32\XpsPrint.dll
    2011-02-23 07:42:04 475648 ----a-w- C:\windows\System32\XpsGdiConverter.dll
    2011-02-23 07:42:04 288256 ----a-w- C:\windows\SysWow64\XpsGdiConverter.dll
    2011-02-22 21:21:20 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{578F7BA2-35D3-4814-94F3-E11C79BE43C9}
    2011-02-22 09:10:04 -------- d-----w- C:\Users\MaryAnn\AppData\Roaming\Malwarebytes
    2011-02-22 09:09:59 38224 ----a-w- C:\windows\SysWow64\drivers\mbamswissarmy.sys
    2011-02-22 09:09:58 -------- d-----w- C:\PROGRA~3\Malwarebytes
    2011-02-22 09:09:55 24152 ----a-w- C:\windows\System32\drivers\mbam.sys
    2011-02-22 09:09:55 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2011-02-22 08:59:06 -------- d-----w- C:\Users\MaryAnn\AppData\Roaming\56003FF7290644D3F111D8F4F960A231
    2011-02-22 08:01:40 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{62502933-CD50-4DE3-A375-E3FCD8F3CAB5}
    2011-02-21 20:01:14 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{764C74D7-8178-46EF-8729-F10D6D46188D}
    2011-02-21 07:57:27 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{237A60BA-05F2-4A66-8268-402F05EA79B6}
    2011-02-20 19:57:13 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{8E77C59F-C855-4D41-9DD5-99AB9EC51F5A}
    2011-02-20 07:46:43 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{74B1583F-8BE5-45D5-9F08-DD706FF491D0}
    2011-02-19 19:46:16 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{2CD9CC7B-9CC5-4964-887B-566763C12ED6}
    2011-02-19 06:16:37 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{ADE50F55-09FF-4864-8123-F33E271D35B4}
    2011-02-18 04:57:12 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{A1467C40-B3C4-483C-AEEF-C667ADC5C134}
    2011-02-17 16:56:37 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{1DF44B13-AA2B-4BD8-859D-48AF8FC9AED2}
    2011-02-17 00:29:33 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{9C9043E0-141C-450C-B4E8-9002C7DD14A5}
    2011-02-15 04:13:41 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{B3327088-8086-4A83-BE46-429012A9500F}
    2011-02-13 04:42:51 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{DE3C6886-9298-4A90-A3DA-D5496E140D80}
    2011-02-12 15:39:30 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{422AA32E-F7E4-43F5-A133-CFBB649281DD}
    2011-02-09 04:37:38 -------- d-----w- C:\Users\MaryAnn\AppData\Local\{BB402F91-F313-4134-979D-35A8DEAB04FA}
    .
    ==================== Find3M ====================
    .
    2011-03-10 01:26:51 152576 ----a-w- C:\windows\SysWow64\msclmd.dll
    2011-03-10 01:26:50 175616 ----a-w- C:\windows\System32\msclmd.dll
    2011-02-19 12:05:15 1139200 ----a-w- C:\windows\System32\FntCache.dll
    2011-02-19 12:04:37 1544192 ----a-w- C:\windows\System32\DWrite.dll
    2011-02-19 12:04:17 902656 ----a-w- C:\windows\System32\d2d1.dll
    2011-02-19 06:30:51 1076736 ----a-w- C:\windows\SysWow64\DWrite.dll
    2011-02-19 06:30:50 739840 ----a-w- C:\windows\SysWow64\d2d1.dll
    2011-02-02 22:11:20 270720 ------w- C:\windows\System32\MpSigStub.exe
    2011-01-07 12:14:11 46080 ----a-w- C:\windows\System32\atmlib.dll
    2011-01-07 09:51:01 1638912 ----a-w- C:\windows\System32\mshtml.tlb
    2011-01-07 09:20:44 366592 ----a-w- C:\windows\System32\atmfd.dll
    2011-01-07 07:45:57 34304 ----a-w- C:\windows\SysWow64\atmlib.dll
    2011-01-07 06:01:22 1638912 ----a-w- C:\windows\SysWow64\mshtml.tlb
    2011-01-07 05:43:36 294400 ----a-w- C:\windows\SysWow64\atmfd.dll
    2011-01-05 10:34:00 612864 ----a-w- C:\windows\System32\vbscript.dll
    2011-01-05 06:56:24 3129344 ----a-w- C:\windows\System32\win32k.sys
    2011-01-05 05:55:55 428032 ----a-w- C:\windows\SysWow64\vbscript.dll
    2010-12-23 10:42:53 1118720 ----a-w- C:\windows\System32\sbe.dll
    2010-12-23 10:42:51 961024 ----a-w- C:\windows\System32\CPFilters.dll
    2010-12-23 10:42:51 723968 ----a-w- C:\windows\System32\EncDec.dll
    2010-12-23 10:36:02 259072 ----a-w- C:\windows\System32\mpg2splt.ax
    2010-12-23 05:54:18 850944 ----a-w- C:\windows\SysWow64\sbe.dll
    2010-12-23 05:54:17 642048 ----a-w- C:\windows\SysWow64\CPFilters.dll
    2010-12-23 05:54:17 534528 ----a-w- C:\windows\SysWow64\EncDec.dll
    2010-12-23 05:50:23 199680 ----a-w- C:\windows\SysWow64\mpg2splt.ax
    2010-12-17 11:42:18 214016 ----a-w- C:\windows\System32\winsrv.dll
    2010-12-17 11:40:10 715776 ----a-w- C:\windows\System32\kerberos.dll
    2010-12-17 07:07:55 542208 ----a-w- C:\windows\SysWow64\kerberos.dll
    2010-12-14 23:51:20 51712 ----a-w- C:\windows\System32\drivers\usbaapl64.sys
    2010-12-14 23:51:20 4184352 ----a-w- C:\windows\System32\usbaaplrc.dll
    .
    ============= FINISH: 17:41:53.45 ===============



    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_11-03-05.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 06/12/2010 5:50:15 AM
    System Uptime: 10/03/2011 4:05:12 PM (1 hours ago)
    .
    Motherboard: Intel Corp. | | Base Board Product Name
    Processor: Intel(R) Pentium(R) CPU P6100 @ 2.00GHz | CPU | 919/1066mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 286 GiB total, 250.715 GiB free.
    D: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID:
    Description: Ethernet Controller
    Device ID: PCI\VEN_1969&DEV_2060&SUBSYS_FD501179&REV_C1\4&1C2AA106&0&00E5
    Manufacturer:
    Name: Ethernet Controller
    PNP Device ID: PCI\VEN_1969&DEV_2060&SUBSYS_FD501179&REV_C1\4&1C2AA106&0&00E5
    Service:
    .
    ==== System Restore Points ===================
    .
    RP61: 09/03/2011 8:11:39 PM - Windows 7 Service Pack 1
    .
    ==== Installed Programs ======================
    .
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader X
    Adobe Shockwave Player 11.5
    Apple Application Support
    Apple Software Update
    Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
    Avira AntiVir Personal - Free Antivirus
    Best Buy pc app
    Cisco EAP-FAST Module
    Cisco LEAP Module
    Cisco PEAP Module
    D3DX10
    DivX Web Player
    ESET Online Scanner v3
    Google Chrome
    Google Toolbar for Internet Explorer
    Google Update Helper
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) Management Engine Components
    Intel(R) Rapid Storage Technology
    Java Auto Updater
    Java(TM) 6 Update 24
    Junk Mail filter update
    Kaspersky Anti-Virus 2011
    Label@Once 1.0
    Malwarebytes' Anti-Malware
    Microsoft Office 2010
    Microsoft Office Click-to-Run 2010
    Microsoft Office Starter 2010 - English
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Mozilla Firefox (3.6.13)
    Mozilla Firefox 4.0b11 (x86 en-US)
    MSVCRT
    MSVCRT_amd64
    QuickTime
    Realtek USB 2.0 Card Reader
    Realtek WLAN Driver
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Skype Toolbars
    Skype™ 5.0
    TOSHIBA Application Installer
    TOSHIBA Assist
    Toshiba Book Place
    TOSHIBA Bulletin Board
    TOSHIBA eco Utility
    TOSHIBA Face Recognition
    TOSHIBA Hardware Setup
    TOSHIBA HDD/SSD Alert
    TOSHIBA Media Controller
    TOSHIBA Media Controller Plug-in
    TOSHIBA Quality Application
    TOSHIBA ReelTime
    TOSHIBA Service Station
    TOSHIBA Supervisor Password
    TOSHIBA Value Added Package
    TOSHIBA Web Camera Application
    ToshibaRegistration
    VC80CRTRedist - 8.0.50727.762
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Mail
    Windows Live Messenger
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live Sync
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Yahoo! Messenger
    Yahoo! Software Update
    Yahoo! Toolbar
    .
    ==== Event Viewer Messages From Past Week ========
    .
    10/03/2011 4:07:13 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the IPsec Policy Agent service to connect.
    10/03/2011 4:07:13 PM, Error: Service Control Manager [7000] - The IPsec Policy Agent service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    09/03/2011 8:52:49 PM, Error: Microsoft-Windows-WMPNSS-Service [14353] - A media delivery engine with ID '0' was not initialized due to error '0x80070005' when adding the URL 'http://+:10243/WMPNSSv4/2436842975/'. Restart your computer, and then restart the WMPNetworkSvc service. If the problem persists, reinstall Windows Media Player if possible.
    09/03/2011 8:52:49 PM, Error: Microsoft-Windows-WMPNSS-Service [14349] - A new media server was not initialized because the Windows Media Delivery Engine did not initialize due to error '0x80070005'. Restart your computer, and then restart the WMPNetworkSvc service. If the problem persists, reinstall Windows Media Player if possible.
    09/03/2011 8:11:19 PM, Error: Microsoft-Windows-Service Pack Installer [6] - The Service Pack cannot be installed when the computer is running on battery power.
    09/03/2011 4:51:17 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    09/03/2011 4:20:51 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    09/03/2011 4:20:50 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    09/03/2011 4:20:50 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    09/03/2011 4:20:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    09/03/2011 4:20:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    09/03/2011 4:20:29 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avipbb discache KLIF spldr Wanarpv6
    09/03/2011 4:20:27 PM, Error: Service Control Manager [7001] - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: The dependency service or group failed to start.
    09/03/2011 2:03:41 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    09/03/2011 2:03:40 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    09/03/2011 2:03:40 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    09/03/2011 2:03:19 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD avipbb DfsC discache kl2 KLIF KLIM6 NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
    09/03/2011 2:03:18 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    09/03/2011 2:03:18 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    09/03/2011 2:03:18 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    09/03/2011 2:03:18 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    09/03/2011 2:03:18 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    09/03/2011 2:03:18 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
    09/03/2011 2:03:18 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    09/03/2011 2:03:18 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    09/03/2011 2:03:18 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    09/03/2011 2:03:18 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    08/03/2011 6:53:45 PM, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Start with the following error: Access is denied.
    07/03/2011 5:34:26 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer ERICKA-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{B5AA03B1-251B-4440-BFA9-80E635AFC147}. The master browser is stopping or an election is being forced.
    07/03/2011 5:34:24 PM, Error: NetBT [4319] - A duplicate name has been detected on the TCP network. The IP address of the computer that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.
    .
    ==== End Of File ===========================
     
  8. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    You're running two AV programs, Kaspersky and Avira.
    One of them has to go.
    Your choice.

    =====================================================================

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.

    =======================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  9. ireallyneedhelp

    ireallyneedhelp TS Rookie Topic Starter

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows 7 Home Premium Edition
    Windows Information: Service Pack 1 (build 7601), 64-bit
    Base Board Manufacturer: Intel Corp.
    BIOS Manufacturer: INSYDE
    System Manufacturer: TOSHIBA
    System Product Name: Satellite L655
    Logical Drives Mask: 0x0001000c

    Kernel Drivers (total 198):
    0x02A12000 \SystemRoot\system32\ntoskrnl.exe
    0x02FFC000 \SystemRoot\system32\hal.dll
    0x00BC3000 \SystemRoot\system32\kdcom.dll
    0x00C97000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
    0x00CE6000 \SystemRoot\system32\PSHED.dll
    0x00CFA000 \SystemRoot\system32\CLFS.SYS
    0x00EE0000 \SystemRoot\system32\CI.dll
    0x00E00000 \SystemRoot\system32\drivers\Wdf01000.sys
    0x00EA4000 \SystemRoot\system32\drivers\WDFLDR.SYS
    0x00FA0000 \SystemRoot\system32\drivers\ACPI.sys
    0x00FF7000 \SystemRoot\system32\drivers\WMILIB.SYS
    0x00EB3000 \SystemRoot\system32\drivers\msisadrv.sys
    0x00D58000 \SystemRoot\system32\drivers\pci.sys
    0x00EBD000 \SystemRoot\system32\drivers\vdrvroot.sys
    0x00ECA000 \SystemRoot\System32\drivers\partmgr.sys
    0x00D8B000 \SystemRoot\system32\DRIVERS\compbatt.sys
    0x00D94000 \SystemRoot\system32\DRIVERS\BATTC.SYS
    0x00DA0000 \SystemRoot\system32\drivers\volmgr.sys
    0x00C00000 \SystemRoot\System32\drivers\volmgrx.sys
    0x00C5C000 \SystemRoot\System32\drivers\mountmgr.sys
    0x00C76000 \SystemRoot\system32\drivers\pciide.sys
    0x00C7D000 \SystemRoot\system32\drivers\PCIIDEX.SYS
    0x01005000 \SystemRoot\system32\DRIVERS\iaStor.sys
    0x0120F000 \SystemRoot\system32\drivers\atapi.sys
    0x01218000 \SystemRoot\system32\drivers\ataport.SYS
    0x01242000 \SystemRoot\system32\drivers\msahci.sys
    0x0124D000 \SystemRoot\system32\drivers\amdxata.sys
    0x01258000 \SystemRoot\system32\drivers\fltmgr.sys
    0x012A4000 \SystemRoot\system32\drivers\fileinfo.sys
    0x01446000 \SystemRoot\System32\Drivers\Ntfs.sys
    0x012B8000 \SystemRoot\System32\Drivers\msrpc.sys
    0x01400000 \SystemRoot\System32\Drivers\ksecdd.sys
    0x01316000 \SystemRoot\System32\Drivers\cng.sys
    0x0141B000 \SystemRoot\System32\drivers\pcw.sys
    0x0142C000 \SystemRoot\System32\Drivers\Fs_Rec.sys
    0x01670000 \SystemRoot\system32\drivers\ndis.sys
    0x01763000 \SystemRoot\system32\drivers\NETIO.SYS
    0x017C3000 \SystemRoot\System32\Drivers\ksecpkg.sys
    0x018BC000 \SystemRoot\System32\drivers\tcpip.sys
    0x01AC0000 \SystemRoot\System32\drivers\fwpkclnt.sys
    0x01B0A000 \SystemRoot\system32\DRIVERS\wd.sys
    0x01B12000 \SystemRoot\system32\drivers\volsnap.sys
    0x01B5E000 \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
    0x01B63000 \SystemRoot\System32\Drivers\spldr.sys
    0x01B6B000 \SystemRoot\System32\drivers\rdyboost.sys
    0x01BA5000 \SystemRoot\System32\Drivers\mup.sys
    0x01C1B000 \SystemRoot\system32\DRIVERS\kl1.sys
    0x0237A000 \SystemRoot\System32\drivers\hwpolicy.sys
    0x02383000 \SystemRoot\System32\DRIVERS\fvevol.sys
    0x023BD000 \SystemRoot\system32\DRIVERS\disk.sys
    0x01BB7000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
    0x046C5000 \SystemRoot\system32\drivers\cdrom.sys
    0x046EF000 \SystemRoot\system32\DRIVERS\klif.sys
    0x04785000 \SystemRoot\System32\Drivers\Null.SYS
    0x0478E000 \SystemRoot\System32\Drivers\Beep.SYS
    0x04795000 \SystemRoot\System32\drivers\vga.sys
    0x047A3000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
    0x047C8000 \SystemRoot\System32\drivers\watchdog.sys
    0x047D8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0x047E1000 \SystemRoot\system32\drivers\rdpencdd.sys
    0x047EA000 \SystemRoot\system32\drivers\rdprefmp.sys
    0x047F3000 \SystemRoot\System32\Drivers\Msfs.SYS
    0x04400000 \SystemRoot\System32\Drivers\Npfs.SYS
    0x04411000 \SystemRoot\system32\DRIVERS\tdx.sys
    0x04433000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0x04440000 \SystemRoot\system32\DRIVERS\kl2.sys
    0x01800000 \SystemRoot\system32\drivers\afd.sys
    0x04447000 \SystemRoot\System32\DRIVERS\netbt.sys
    0x0448C000 \SystemRoot\system32\DRIVERS\wfplwf.sys
    0x01889000 \SystemRoot\system32\DRIVERS\pacer.sys
    0x023E1000 \SystemRoot\system32\DRIVERS\vwififlt.sys
    0x04495000 \SystemRoot\system32\DRIVERS\klim6.sys
    0x01C00000 \SystemRoot\system32\DRIVERS\netbios.sys
    0x01600000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0x01BE7000 \SystemRoot\system32\drivers\termdd.sys
    0x0449E000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
    0x01C0F000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
    0x0161B000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0x018AF000 \SystemRoot\system32\drivers\nsiproxy.sys
    0x017EE000 \SystemRoot\system32\drivers\mssmbios.sys
    0x01436000 \SystemRoot\System32\drivers\discache.sys
    0x01388000 \SystemRoot\System32\Drivers\dfsc.sys
    0x015E9000 \SystemRoot\system32\DRIVERS\blbdrive.sys
    0x013C8000 \SystemRoot\system32\DRIVERS\tunnel.sys
    0x05224000 \SystemRoot\system32\DRIVERS\igdkmd64.sys
    0x05C43000 \SystemRoot\System32\drivers\dxgkrnl.sys
    0x05D37000 \SystemRoot\System32\drivers\dxgmms1.sys
    0x05D7D000 \SystemRoot\system32\DRIVERS\HECIx64.sys
    0x05D8E000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0x05D9F000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0x05200000 \SystemRoot\system32\drivers\HDAudBus.sys
    0x090A8000 \SystemRoot\system32\DRIVERS\rtl8192Ce.sys
    0x091A5000 \SystemRoot\system32\DRIVERS\vwifibus.sys
    0x091B2000 \SystemRoot\system32\drivers\i8042prt.sys
    0x091D0000 \SystemRoot\system32\drivers\kbdclass.sys
    0x09000000 \SystemRoot\system32\DRIVERS\SynTP.sys
    0x09052000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0x09054000 \SystemRoot\system32\DRIVERS\klmouflt.sys
    0x0905E000 \SystemRoot\system32\drivers\mouclass.sys
    0x0906D000 \SystemRoot\system32\DRIVERS\tdcmdpst.sys
    0x09077000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
    0x00DB5000 \SystemRoot\system32\DRIVERS\Impcd.sys
    0x09084000 \SystemRoot\system32\DRIVERS\intelppm.sys
    0x0909A000 \SystemRoot\system32\DRIVERS\CmBatt.sys
    0x091DF000 \SystemRoot\system32\DRIVERS\QIOMem.sys
    0x091E9000 \SystemRoot\system32\DRIVERS\TVALZFL.sys
    0x091F0000 \SystemRoot\system32\drivers\wmiacpi.sys
    0x013EE000 \SystemRoot\system32\drivers\CompositeBus.sys
    0x00DDC000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
    0x04A93000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0x04AB7000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0x04AC3000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0x04AF2000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0x04B0D000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0x04B2E000 \SystemRoot\system32\DRIVERS\rassstp.sys
    0x04B48000 \SystemRoot\system32\drivers\swenum.sys
    0x04B4A000 \SystemRoot\system32\drivers\ks.sys
    0x04B8D000 \SystemRoot\system32\drivers\umbus.sys
    0x04B9F000 \SystemRoot\system32\drivers\usbhub.sys
    0x04A00000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0x048FD000 \SystemRoot\system32\drivers\CHDRT64.sys
    0x049B0000 \SystemRoot\system32\drivers\portcls.sys
    0x04800000 \SystemRoot\system32\drivers\drmk.sys
    0x04822000 \SystemRoot\system32\drivers\ksthunk.sys
    0x04828000 \SystemRoot\System32\Drivers\crashdmp.sys
    0x044A8000 \SystemRoot\System32\Drivers\dump_iaStor.sys
    0x04836000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
    0x000A0000 \SystemRoot\System32\win32k.sys
    0x04849000 \SystemRoot\System32\drivers\Dxapi.sys
    0x04855000 \SystemRoot\system32\drivers\usbccgp.sys
    0x04872000 \SystemRoot\System32\Drivers\usbvideo.sys
    0x048A0000 \SystemRoot\system32\DRIVERS\pgeffect.sys
    0x048E4000 \SystemRoot\system32\DRIVERS\monitor.sys
    0x004D0000 \SystemRoot\System32\TSDDD.dll
    0x00730000 \SystemRoot\System32\cdd.dll
    0x048A7000 \SystemRoot\system32\drivers\luafv.sys
    0x04A15000 \SystemRoot\system32\DRIVERS\avgntflt.sys
    0x048CA000 \SystemRoot\system32\DRIVERS\Sftvollh.sys
    0x04A32000 \SystemRoot\system32\drivers\WudfPf.sys
    0x04A53000 \SystemRoot\system32\DRIVERS\lltdio.sys
    0x02E96000 \SystemRoot\system32\DRIVERS\nwifi.sys
    0x02EE9000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0x02EFC000 \SystemRoot\system32\DRIVERS\rspndr.sys
    0x02F14000 \SystemRoot\system32\drivers\HTTP.sys
    0x02FE1000 \SystemRoot\system32\DRIVERS\bowser.sys
    0x02E00000 \SystemRoot\System32\drivers\mpsdrv.sys
    0x02E18000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0x02E45000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    0x04A68000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    0x050AB000 \SystemRoot\system32\drivers\peauth.sys
    0x05151000 \SystemRoot\System32\Drivers\secdrv.SYS
    0x05E24000 \SystemRoot\system32\DRIVERS\Sftfslh.sys
    0x05EDB000 \SystemRoot\system32\DRIVERS\Sftplaylh.sys
    0x05F28000 \SystemRoot\System32\DRIVERS\srvnet.sys
    0x05F59000 \SystemRoot\System32\drivers\tcpipreg.sys
    0x05F6B000 \SystemRoot\System32\DRIVERS\srv2.sys
    0x0515C000 \SystemRoot\System32\DRIVERS\srv.sys
    0x05FD6000 \SystemRoot\system32\DRIVERS\Sftredirlh.sys
    0x76E20000 \Windows\System32\ntdll.dll
    0x47800000 \Windows\System32\smss.exe
    0xFF140000 \Windows\System32\apisetschema.dll
    0xFFA80000 \Windows\System32\autochk.exe
    0xFF100000 \Windows\System32\imm32.dll
    0x76D20000 \Windows\System32\user32.dll
    0xFF060000 \Windows\System32\msvcrt.dll
    0xFEE00000 \Windows\System32\iertutil.dll
    0xFED90000 \Windows\System32\gdi32.dll
    0xFEC60000 \Windows\System32\rpcrt4.dll
    0xFEBC0000 \Windows\System32\comdlg32.dll
    0xFEAB0000 \Windows\System32\msctf.dll
    0x76FF0000 \Windows\System32\normaliz.dll
    0xFE9D0000 \Windows\System32\advapi32.dll
    0xFE850000 \Windows\System32\urlmon.dll
    0xFE830000 \Windows\System32\imagehlp.dll
    0xFE820000 \Windows\System32\lpk.dll
    0xFE6F0000 \Windows\System32\wininet.dll
    0xFE6E0000 \Windows\System32\nsi.dll
    0xFE600000 \Windows\System32\oleaut32.dll
    0x76FE0000 \Windows\System32\psapi.dll
    0xFE580000 \Windows\System32\difxapi.dll
    0xFE4E0000 \Windows\System32\clbcatq.dll
    0xFE460000 \Windows\System32\shlwapi.dll
    0xFE410000 \Windows\System32\ws2_32.dll
    0xFE340000 \Windows\System32\usp10.dll
    0xFE130000 \Windows\System32\ole32.dll
    0xFE0D0000 \Windows\System32\Wldap32.dll
    0xFDEF0000 \Windows\System32\setupapi.dll
    0x76C00000 \Windows\System32\kernel32.dll
    0xFD160000 \Windows\System32\shell32.dll
    0xFD140000 \Windows\System32\sechost.dll
    0xFCFD0000 \Windows\System32\crypt32.dll
    0xFCF60000 \Windows\System32\KernelBase.dll
    0xFCF40000 \Windows\System32\devobj.dll
    0xFCF00000 \Windows\System32\cfgmgr32.dll
    0xFCEC0000 \Windows\System32\wintrust.dll
    0xFCE20000 \Windows\System32\comctl32.dll
    0xFCE10000 \Windows\System32\msasn1.dll
    0x75D70000 \Windows\SysWOW64\normaliz.dll

    Processes (total 83):
    0 System Idle Process
    4 System
    356 C:\Windows\System32\smss.exe
    460 csrss.exe
    524 C:\Windows\System32\wininit.exe
    536 csrss.exe
    580 C:\Windows\System32\services.exe
    592 C:\Windows\System32\lsass.exe
    600 C:\Windows\System32\lsm.exe
    632 C:\Windows\System32\winlogon.exe
    756 C:\Windows\System32\svchost.exe
    844 C:\Windows\System32\svchost.exe
    936 C:\Windows\System32\svchost.exe
    980 C:\Windows\System32\svchost.exe
    1008 C:\Windows\System32\svchost.exe
    416 C:\Windows\System32\svchost.exe
    1132 C:\Windows\System32\svchost.exe
    1268 C:\Windows\System32\spoolsv.exe
    1436 C:\Windows\System32\svchost.exe
    1628 C:\Program Files\SUPERAntiSpyware\SASCore64.exe
    1684 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    1744 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
    1800 C:\Windows\System32\taskhost.exe
    1876 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    1912 C:\Windows\System32\svchost.exe
    1976 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    2080 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
    2104 C:\Windows\System32\svchost.exe
    2144 C:\Windows\System32\TODDSrv.exe
    2172 C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
    2260 C:\Program Files\TOSHIBA\TECO\TecoService.exe
    2296 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    2340 C:\Windows\System32\SearchIndexer.exe
    2412 C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
    2456 C:\Windows\System32\dwm.exe
    2500 C:\Windows\explorer.exe
    2556 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    2292 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
    3216 C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
    3252 C:\Windows\System32\igfxtray.exe
    3264 C:\Windows\System32\hkcmd.exe
    3280 C:\Windows\System32\igfxpers.exe
    3300 C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
    3464 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    3484 C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
    3624 C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
    3644 C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
    3720 C:\Program Files\TOSHIBA\TECO\Teco.exe
    3748 C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe
    3872 C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
    3916 C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
    3996 C:\Program Files\Windows Sidebar\sidebar.exe
    4092 C:\Windows\System32\igfxext.exe
    1204 C:\Windows\System32\igfxsrvc.exe
    3616 C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 7\firefox.exe
    4868 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    4628 C:\Program Files\Windows Media Player\wmpnetwk.exe
    2728 C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    5768 C:\Program Files (x86)\Yahoo!\Messenger\Ymsgr_tray.exe
    5868 C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 7\plugin-container.exe
    6100 C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
    4004 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
    548 C:\Program Files (x86)\Blubster\Blubster.exe
    5328 C:\Program Files (x86)\iTunes\iTunesHelper.exe
    5564 C:\Windows\System32\svchost.exe
    5700 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    4296 C:\Windows\System32\svchost.exe
    4520 C:\Program Files\iPod\bin\iPodService.exe
    2924 C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
    2376 C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
    3800 C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
    4832 C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
    4540 dllhost.exe
    3816 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    2532 C:\Windows\System32\svchost.exe
    6432 C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
    6624 C:\Windows\System32\audiodg.exe
    3776 C:\Windows\System32\SearchProtocolHost.exe
    4532 C:\Windows\System32\SearchFilterHost.exe
    4952 dllhost.exe
    6848 dllhost.exe
    4248 C:\Users\MaryAnn\Downloads\MBRCheck.exe
    6788 C:\Windows\System32\conhost.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000 (NTFS)
    \\.\Q: --> error 5

    PhysicalDrive0 Model Number: TOSHIBAMK3265GSXN, Rev: GH101M

    Size Device Name MBR Status
    --------------------------------------------
    298 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
    SHA1: BBAD517F7EAC529451E4B9586C847AE190574F61


    Done!
     
  10. ireallyneedhelp

    ireallyneedhelp TS Rookie Topic Starter

    ComboFix 11-03-10.01 - MaryAnn 10/03/2011 18:28:48.1.2 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.2934.1484 [GMT -5:00]
    Running from: c:\users\MaryAnn\Downloads\ComboFix.exe
    AV: Kaspersky Anti-Virus *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
    SP: Kaspersky Anti-Virus *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\MaryAnn\AppData\Roaming\Adobe\plugs
    c:\users\MaryAnn\AppData\Roaming\cacaoweb
    c:\users\MaryAnn\AppData\Roaming\cacaoweb\adstorage.db
    c:\users\MaryAnn\AppData\Roaming\cacaoweb\megavideo1CI9JUKL997425977.cacao
    c:\users\MaryAnn\AppData\Roaming\cacaoweb\megavideoL1NHSW49785197291.cacao
    c:\users\MaryAnn\AppData\Roaming\cacaoweb\storage.db
    c:\windows\system32\Thumbs.db
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-02-10 to 2011-03-10 )))))))))))))))))))))))))))))))
    .
    .
    2011-03-10 23:35 . 2011-03-10 23:35 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-03-10 21:07 . 2011-03-10 21:07 -------- d-----w- c:\users\MaryAnn\AppData\Local\{DD68F372-E51D-48A4-9828-52BA48CA987E}
    2011-03-10 01:11 . 2011-03-10 01:11 -------- d-----w- c:\windows\system32\SPReview
    2011-03-10 01:10 . 2011-03-10 01:10 -------- d-----w- c:\windows\system32\EventProviders
    2011-03-10 00:59 . 2010-11-20 13:27 2314752 ----a-w- c:\windows\system32\tquery.dll
    2011-03-10 00:57 . 2010-11-20 13:25 158720 ----a-w- c:\windows\system32\aaclient.dll
    2011-03-10 00:56 . 2010-11-20 13:27 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
    2011-03-10 00:55 . 2010-11-20 13:27 228864 ----a-w- c:\windows\system32\wbem\wmiprov.dll
    2011-03-10 00:54 . 2010-11-20 12:57 3072 ----a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui
    2011-03-10 00:54 . 2010-11-20 13:01 2560 ----a-w- c:\windows\system32\drivers\en-US\rdpwd.sys.mui
    2011-03-10 00:54 . 2010-11-20 13:11 6144 ----a-w- c:\windows\system32\drivers\en-US\IPMIDrv.sys.mui
    2011-03-10 00:54 . 2010-11-20 13:10 4608 ----a-w- c:\windows\system32\drivers\en-US\kbdclass.sys.mui
    2011-03-10 00:54 . 2010-11-20 12:21 189952 ----a-w- c:\windows\SysWow64\wdscore.dll
    2011-03-10 00:54 . 2010-11-20 12:17 209920 ----a-w- c:\windows\SysWow64\PkgMgr.exe
    2011-03-10 00:54 . 2010-11-20 12:18 323072 ----a-w- c:\windows\SysWow64\drvstore.dll
    2011-03-10 00:54 . 2010-11-20 12:18 257024 ----a-w- c:\windows\SysWow64\dpx.dll
    2011-03-10 00:53 . 2010-11-20 12:21 363008 ----a-w- c:\windows\SysWow64\wbemcomn.dll
    2011-03-10 00:53 . 2010-11-20 12:19 606208 ----a-w- c:\windows\SysWow64\wbem\fastprox.dll
    2011-03-10 00:46 . 2010-11-20 13:27 524288 ----a-w- c:\windows\system32\wmicmiplugin.dll
    2011-03-10 00:46 . 2010-11-20 13:27 529408 ----a-w- c:\windows\system32\wbemcomn.dll
    2011-03-10 00:46 . 2010-11-20 13:27 1225216 ----a-w- c:\windows\system32\wbem\wbemcore.dll
    2011-03-10 00:46 . 2010-11-20 13:27 933376 ----a-w- c:\windows\system32\SmiEngine.dll
    2011-03-10 00:45 . 2010-11-20 13:25 199168 ----a-w- c:\windows\system32\PkgMgr.exe
    2011-03-10 00:43 . 2010-11-20 13:26 422912 ----a-w- c:\windows\system32\drvstore.dll
    2011-03-10 00:43 . 2010-11-20 13:26 399872 ----a-w- c:\windows\system32\dpx.dll
    2011-03-09 23:40 . 2011-03-09 23:40 -------- d-----w- c:\users\MaryAnn\AppData\Local\ElevatedDiagnostics
    2011-03-09 23:22 . 2011-01-17 11:09 197120 ----a-w- c:\windows\system32\d3d10_1.dll
    2011-03-09 23:22 . 2011-01-17 05:47 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
    2011-03-09 23:22 . 2010-11-20 13:26 321024 ----a-w- c:\windows\system32\d3d10_1core.dll
    2011-03-09 23:22 . 2010-11-20 12:18 219136 ----a-w- c:\windows\SysWow64\d3d10_1core.dll
    2011-03-09 23:18 . 2011-03-09 23:18 -------- d-----w- c:\program files (x86)\Common Files\Java
    2011-03-09 23:18 . 2011-02-03 02:40 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2011-03-09 23:16 . 2011-03-09 23:16 -------- d-----w- c:\programdata\McAfee
    2011-03-09 23:15 . 2011-03-09 23:15 -------- d-----w- c:\program files (x86)\Common Files\Adobe
    2011-03-09 20:40 . 2011-03-09 20:41 -------- d-----w- c:\users\MaryAnn\AppData\Local\{70A1C39E-626F-46DF-AF3B-3820319DE353}
    2011-03-09 07:28 . 2011-03-09 07:28 -------- d-----w- c:\program files (x86)\ESET
    2011-03-09 05:16 . 2011-02-23 14:34 7947600 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4B660CAD-C027-4708-99BC-FF204EDCC5BE}\mpengine.dll
    2011-03-08 23:53 . 2011-03-08 23:53 -------- d-----w- c:\program files (x86)\Avira
    2011-03-08 23:36 . 2011-03-08 23:36 -------- d-----w- c:\users\MaryAnn\AppData\Local\{66F93538-C520-4A1C-8E6F-96B0274D3D7D}
    2011-03-08 22:45 . 2011-03-08 22:45 -------- d-----w- c:\users\MaryAnn\AppData\Roaming\SUPERAntiSpyware.com
    2011-03-08 22:44 . 2011-03-09 22:02 -------- d-----w- c:\program files\SUPERAntiSpyware
    2011-03-08 21:24 . 2011-03-08 21:24 -------- d-----w- c:\users\MaryAnn\AppData\Local\{D2CC22E8-C43D-4C09-A745-0F6B454ADEC1}
    2011-03-08 20:32 . 2011-03-08 20:32 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
    2011-03-08 20:32 . 2011-03-08 20:32 -------- d-----w- c:\programdata\!SASCORE
    2011-03-07 19:49 . 2011-03-07 19:49 -------- d-----w- c:\users\MaryAnn\AppData\Local\{32E8AC55-6BE0-4BAA-A8F2-172305E2FE78}
    2011-03-07 05:29 . 2011-03-07 05:29 -------- d-----w- c:\users\MaryAnn\AppData\Local\{8CF54C57-C9E9-48AA-8381-E42263E70369}
    2011-03-06 06:08 . 2011-03-06 06:08 -------- d-----w- c:\users\MaryAnn\AppData\Local\{29885AF2-A004-417B-BC39-DEC94BB19436}
    2011-03-05 18:07 . 2011-03-05 18:07 -------- d-----w- c:\users\MaryAnn\AppData\Local\{1D516D2B-263E-4F8C-A1A7-037FE1DEF378}
    2011-03-05 02:44 . 2011-03-05 02:44 -------- d-----w- c:\users\MaryAnn\AppData\Local\{9AB6C56E-D6BF-473B-B049-982DDCAFE928}
    2011-03-04 00:03 . 2011-03-04 00:03 -------- d-----w- c:\users\MaryAnn\AppData\Local\{882929A7-0BC2-4E70-A727-C06FC5F9DF32}
    2011-03-02 23:51 . 2011-03-02 23:51 -------- d-----w- c:\programdata\Microsoft Help
    2011-03-02 23:51 . 2011-03-02 23:51 -------- d-----w- c:\users\MaryAnn\AppData\Local\Microsoft Help
    2011-03-02 21:04 . 2011-03-02 21:04 -------- d-----w- c:\users\MaryAnn\AppData\Local\{0278F90F-3EB1-4C32-A2C4-FB037A549DBB}
    2011-03-02 05:58 . 2011-03-02 05:59 -------- d-----w- c:\users\MaryAnn\AppData\Roaming\GetRightToGo
    2011-03-02 05:34 . 2011-03-02 05:34 -------- d-----w- c:\users\MaryAnn\AppData\Local\DDMSettings
    2011-03-02 05:33 . 2011-03-02 05:33 -------- d-----w- c:\users\MaryAnn\AppData\Roaming\DivX
    2011-03-02 05:29 . 2011-03-08 23:33 -------- d-----w- c:\programdata\DivX
    2011-03-01 22:08 . 2011-03-01 22:08 -------- d-----w- c:\users\MaryAnn\AppData\Local\{8B245C40-590B-4D08-8EF1-3E6444F610A1}
    2011-03-01 06:36 . 2011-03-01 06:36 -------- d-----w- c:\users\MaryAnn\AppData\Local\{C9648AFB-1079-4823-830D-73791147A698}
    2011-02-28 18:35 . 2011-02-28 18:36 -------- d-----w- c:\users\MaryAnn\AppData\Local\{D9A98A79-9807-47B7-8C73-28876BB1740F}
    2011-02-27 21:24 . 2011-02-27 21:25 -------- d-----w- c:\users\MaryAnn\AppData\Local\{46E9F536-F3CF-477C-84EB-978B71437312}
    2011-02-27 01:43 . 2011-02-27 01:43 -------- d-----w- c:\users\MaryAnn\AppData\Local\{7DC3866C-7A24-48BA-B2A2-391C055ED4CD}
    2011-02-25 20:22 . 2011-02-25 20:23 -------- d-----w- c:\users\MaryAnn\AppData\Local\{7996ED0D-6C0A-4BB6-8FAC-1F7C47E93A6E}
    2011-02-25 03:46 . 2011-02-25 03:46 -------- d-----w- c:\users\MaryAnn\AppData\Local\{589A8231-A3CD-44E6-B60A-4062BAE7438A}
    2011-02-24 21:46 . 2011-03-08 23:32 -------- d-----r- C:\MSOCache
    2011-02-24 08:03 . 2011-02-24 08:03 -------- d-----w- c:\users\MaryAnn\AppData\Local\{20C3F8B8-BB97-4A80-B65D-854856A6EE49}
    2011-02-24 07:47 . 2011-02-24 07:47 -------- d-----w- c:\users\MaryAnn\AppData\Local\Yahoo
    2011-02-24 07:38 . 2011-03-08 23:33 -------- d-----w- c:\programdata\Yahoo! Companion
    2011-02-24 07:38 . 2011-03-08 23:33 -------- d-----w- c:\users\MaryAnn\AppData\Roaming\Yahoo!
    2011-02-24 07:37 . 2011-02-24 07:38 -------- d-----w- c:\programdata\Yahoo!
    2011-02-24 07:35 . 2011-03-08 23:33 -------- d-----w- c:\program files (x86)\Yahoo!
    2011-02-23 20:02 . 2011-02-23 20:03 -------- d-----w- c:\users\MaryAnn\AppData\Local\{7165311D-717D-49DE-89D2-0751AB99E16B}
    2011-02-23 07:42 . 2011-01-07 12:17 1465344 ----a-w- c:\windows\system32\XpsPrint.dll
    2011-02-23 07:42 . 2011-01-07 07:46 870912 ----a-w- c:\windows\SysWow64\XpsPrint.dll
    2011-02-23 07:42 . 2011-01-07 12:17 475648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-02-23 07:42 . 2011-01-07 07:46 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
    2011-02-22 21:21 . 2011-02-22 21:21 -------- d-----w- c:\users\MaryAnn\AppData\Local\{578F7BA2-35D3-4814-94F3-E11C79BE43C9}
    2011-02-22 09:10 . 2011-02-22 09:10 -------- d-----w- c:\users\MaryAnn\AppData\Roaming\Malwarebytes
    2011-02-22 09:09 . 2010-12-20 23:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
    2011-02-22 09:09 . 2011-03-08 23:33 -------- d-----w- c:\programdata\Malwarebytes
    2011-02-22 09:09 . 2011-03-09 06:55 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2011-02-22 09:09 . 2010-12-20 23:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-02-22 08:59 . 2011-03-08 23:33 -------- d-----w- c:\users\MaryAnn\AppData\Roaming\56003FF7290644D3F111D8F4F960A231
    2011-02-22 08:01 . 2011-02-22 08:02 -------- d-----w- c:\users\MaryAnn\AppData\Local\{62502933-CD50-4DE3-A375-E3FCD8F3CAB5}
    2011-02-21 20:01 . 2011-02-21 20:01 -------- d-----w- c:\users\MaryAnn\AppData\Local\{764C74D7-8178-46EF-8729-F10D6D46188D}
    2011-02-21 07:57 . 2011-02-21 07:57 -------- d-----w- c:\users\MaryAnn\AppData\Local\{237A60BA-05F2-4A66-8268-402F05EA79B6}
    2011-02-20 19:57 . 2011-02-20 19:57 -------- d-----w- c:\users\MaryAnn\AppData\Local\{8E77C59F-C855-4D41-9DD5-99AB9EC51F5A}
    2011-02-20 07:46 . 2011-02-20 07:47 -------- d-----w- c:\users\MaryAnn\AppData\Local\{74B1583F-8BE5-45D5-9F08-DD706FF491D0}
    2011-02-19 19:46 . 2011-02-19 19:46 -------- d-----w- c:\users\MaryAnn\AppData\Local\{2CD9CC7B-9CC5-4964-887B-566763C12ED6}
    2011-02-19 06:16 . 2011-02-19 06:16 -------- d-----w- c:\users\MaryAnn\AppData\Local\{ADE50F55-09FF-4864-8123-F33E271D35B4}
    2011-02-18 04:57 . 2011-02-18 04:57 -------- d-----w- c:\users\MaryAnn\AppData\Local\{A1467C40-B3C4-483C-AEEF-C667ADC5C134}
    2011-02-17 16:56 . 2011-02-17 16:56 -------- d-----w- c:\users\MaryAnn\AppData\Local\{1DF44B13-AA2B-4BD8-859D-48AF8FC9AED2}
    2011-02-17 00:29 . 2011-02-17 00:29 -------- d-----w- c:\users\MaryAnn\AppData\Local\{9C9043E0-141C-450C-B4E8-9002C7DD14A5}
    2011-02-15 04:13 . 2011-02-15 04:13 -------- d-----w- c:\users\MaryAnn\AppData\Local\{B3327088-8086-4A83-BE46-429012A9500F}
    2011-02-13 04:42 . 2011-02-13 04:43 -------- d-----w- c:\users\MaryAnn\AppData\Local\{DE3C6886-9298-4A90-A3DA-D5496E140D80}
    2011-02-12 15:39 . 2011-02-12 15:39 -------- d-----w- c:\users\MaryAnn\AppData\Local\{422AA32E-F7E4-43F5-A133-CFBB649281DD}
    2011-02-09 04:37 . 2011-02-09 04:37 -------- d-----w- c:\users\MaryAnn\AppData\Local\{BB402F91-F313-4134-979D-35A8DEAB04FA}
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-03-10 01:26 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
    2011-03-10 01:26 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
    2011-02-02 22:11 . 2010-12-06 11:09 270720 ------w- c:\windows\system32\MpSigStub.exe
    2010-12-14 23:51 . 2010-12-14 23:51 51712 ----a-w- c:\windows\system32\drivers\usbaapl64.sys
    2010-12-14 23:51 . 2010-12-14 23:51 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SharingPrivate]
    @="{08244EE6-92F0-47f2-9FC9-929BAA2E7235}"
    [HKEY_CLASSES_ROOT\CLSID\{08244EE6-92F0-47f2-9FC9-929BAA2E7235}]
    2010-11-20 12:20 442880 ----a-w- c:\windows\System32\ntshrui.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
    "Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 44544]
    "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-09-10 39408]
    "Messenger (Yahoo!)"="c:\progra~2\Yahoo!\Messenger\YahooMessenger.exe" [2010-06-01 5252408]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-02-18 2987976]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
    "TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2010-02-24 2454840]
    "AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe" [2010-12-07 352976]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
    "Blubster"="c:\program files (x86)\Blubster\Blubster.exe" [2009-11-27 2866176]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-01-25 421160]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
    .
    c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Best Buy pc app.lnk - c:\programdata\Best Buy pc app\ClickOnceSetup.exe [2010-6-24 9216]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=c:\progra~2\KASPER~1\KASPER~1\mzvkbd3.dll
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
    @="Driver"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
    @="Driver"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
    @="IEEE 1394 Bus host controllers"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
    @="SBP2 IEEE 1394 Devices"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
    @="SecurityDevices"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-10 136176]
    R2 sppsvc;Software Protection;c:\windows\system32\sppsvc.exe [x]
    R3 1394ohci;1394 OHCI Compliant Host Controller;c:\windows\system32\drivers\1394ohci.sys [x]
    R3 AcpiPmi;ACPI Power Meter Driver;c:\windows\system32\drivers\acpipmi.sys [x]
    R3 adp94xx;adp94xx;c:\windows\system32\DRIVERS\adp94xx.sys [x]
    R3 adpahci;adpahci;c:\windows\system32\DRIVERS\adpahci.sys [x]
    R3 amdsata;amdsata;c:\windows\system32\drivers\amdsata.sys [x]
    R3 amdsbs;amdsbs;c:\windows\system32\DRIVERS\amdsbs.sys [x]
    R3 AppID;AppID Driver;c:\windows\system32\drivers\appid.sys [x]
    R3 AppIDSvc;Application Identity;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 arcsas;arcsas;c:\windows\system32\DRIVERS\arcsas.sys [x]
    R3 b06bdrv;Broadcom NetXtreme II VBD;c:\windows\system32\DRIVERS\bxvbda.sys [x]
    R3 b57nd60a;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60a.sys [x]
    R3 BDESVC;BitLocker Drive Encryption Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 BrFiltLo;Brother USB Mass-Storage Lower Filter Driver;c:\windows\system32\DRIVERS\BrFiltLo.sys [x]
    R3 BrFiltUp;Brother USB Mass-Storage Upper Filter Driver;c:\windows\system32\DRIVERS\BrFiltUp.sys [x]
    R3 Brserid;Brother MFC Serial Port Interface Driver (WDM);c:\windows\System32\Drivers\Brserid.sys [x]
    R3 BrSerWdm;Brother WDM Serial driver;c:\windows\System32\Drivers\BrSerWdm.sys [x]
    R3 BrUsbMdm;Brother MFC USB Fax Only Modem;c:\windows\System32\Drivers\BrUsbMdm.sys [x]
    R3 CertPropSvc;Certificate Propagation;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 circlass;Consumer IR Devices;c:\windows\system32\DRIVERS\circlass.sys [x]
    R3 defragsvc;Disk Defragmenter;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 ebdrv;Broadcom NetXtreme II 10 GigE VBD;c:\windows\system32\DRIVERS\evbda.sys [x]
    R3 elxstor;elxstor;c:\windows\system32\DRIVERS\elxstor.sys [x]
    R3 Filetrace;Filetrace;c:\windows\system32\drivers\filetrace.sys [x]
    R3 FsDepends;File System Dependency Minifilter;c:\windows\system32\drivers\FsDepends.sys [x]
    R3 hcw85cir;Hauppauge Consumer Infrared Receiver;c:\windows\system32\drivers\hcw85cir.sys [x]
    R3 HpSAMD;HpSAMD;c:\windows\system32\drivers\HpSAMD.sys [x]
    R3 iaStorV;Intel RAID Controller Windows 7;c:\windows\system32\drivers\iaStorV.sys [x]
    R3 IPBusEnum;PnP-X IP Bus Enumerator;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 IPMIDRV;IPMIDRV;c:\windows\system32\drivers\IPMIDrv.sys [x]
    R3 iScsiPrt;iScsiPort Driver;c:\windows\system32\drivers\msiscsi.sys [x]
    R3 KtmRm;KtmRm for Distributed Transaction Coordinator;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
    R3 lltdsvc;Link-Layer Topology Discovery Mapper;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 LSI_FC;LSI_FC;c:\windows\system32\DRIVERS\lsi_fc.sys [x]
    R3 LSI_SAS;LSI_SAS;c:\windows\system32\DRIVERS\lsi_sas.sys [x]
    R3 LSI_SAS2;LSI_SAS2;c:\windows\system32\DRIVERS\lsi_sas2.sys [x]
    R3 LSI_SCSI;LSI_SCSI;c:\windows\system32\DRIVERS\lsi_scsi.sys [x]
    R3 megasas;megasas;c:\windows\system32\DRIVERS\megasas.sys [x]
    R3 mpio;Microsoft Multi-Path Bus Driver;c:\windows\system32\drivers\mpio.sys [x]
    R3 msdsm;Microsoft Multi-Path Device Specific Module;c:\windows\system32\drivers\msdsm.sys [x]
    R3 mshidkmdf;Pass-through HID to KMDF Filter Driver;c:\windows\System32\drivers\mshidkmdf.sys [x]
    R3 MSiSCSI;Microsoft iSCSI Initiator Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 MsRPC;MsRPC; [x]
    R3 MTConfig;Microsoft Input Configuration Driver;c:\windows\system32\DRIVERS\MTConfig.sys [x]
    R3 NdisCap;NDIS Capture LightWeight Filter;c:\windows\system32\DRIVERS\ndiscap.sys [x]
    R3 nfrd960;nfrd960;c:\windows\system32\DRIVERS\nfrd960.sys [x]
    R3 nvstor;nvstor;c:\windows\system32\drivers\nvstor.sys [x]
    R3 PerfHost;Performance Counter DLL Host;c:\windows\SysWow64\perfhost.exe [2009-07-14 20992]
    R3 pla;Performance Logs & Alerts;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 PNRPAutoReg;PNRP Machine Name Publication Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 ql2300;ql2300;c:\windows\system32\DRIVERS\ql2300.sys [x]
    R3 ql40xx;ql40xx;c:\windows\system32\DRIVERS\ql40xx.sys [x]
    R3 rdpbus;Remote Desktop Device Redirector Bus Driver;c:\windows\system32\DRIVERS\rdpbus.sys [x]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
    R3 scfilter;Smart card PnP Class Filter Driver;c:\windows\system32\DRIVERS\scfilter.sys [x]
    R3 SCPolicySvc;Smart Card Removal Policy;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 SDRSVC;Windows Backup;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 SensrSvc;Adaptive Brightness;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 SessionEnv;Remote Desktop Configuration;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 sffp_mmc;SFF Storage Protocol Driver for MMC;c:\windows\system32\drivers\sffp_mmc.sys [x]
    R3 SiSRaid4;SiSRaid4;c:\windows\system32\DRIVERS\sisraid4.sys [x]
    R3 Smb;Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session);c:\windows\system32\DRIVERS\smb.sys [x]
    R3 sppuinotify;SPP Notification Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
    R3 stexstor;stexstor;c:\windows\system32\DRIVERS\stexstor.sys [x]
    R3 TabletInputService;Tablet PC Input Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 TBS;TPM Base Services;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 THREADORDER;Thread Ordering Server;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 TrustedInstaller;Windows Modules Installer;c:\windows\servicing\TrustedInstaller.exe [2010-11-20 194048]
    R3 tssecsrv;Remote Desktop Services Security Filter Driver;c:\windows\system32\DRIVERS\tssecsrv.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 UI0Detect;Interactive Services Detection;c:\windows\system32\UI0Detect.exe [x]
    R3 uliagpkx;Uli AGP Bus Filter;c:\windows\system32\drivers\uliagpkx.sys [x]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
    R3 usbcir;eHome Infrared Receiver (USBCIR);c:\windows\system32\drivers\usbcir.sys [x]
    R3 VaultSvc;Credential Manager;c:\windows\system32\lsass.exe [x]
    R3 vhdmp;vhdmp;c:\windows\system32\drivers\vhdmp.sys [x]
    R3 vsmraid;vsmraid;c:\windows\system32\DRIVERS\vsmraid.sys [x]
    R3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\DRIVERS\wacompen.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    R3 wbengine;Block Level Backup Engine Service;c:\windows\system32\wbengine.exe [x]
    R3 WbioSrvc;Windows Biometric Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 wcncsvc;Windows Connect Now - Config Registrar;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 WcsPlugInService;Windows Color System;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 WdiSystemHost;Diagnostic System Host;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 Wecsvc;Windows Event Collector;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 wercplsupport;Problem Reports and Solutions Control Panel Support;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 WerSvc;Windows Error Reporting Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 WIMMount;WIMMount;c:\windows\system32\drivers\wimmount.sys [2009-07-14 22096]
    R3 WinRM;Windows Remote Management (WS-Management);c:\windows\System32\svchost.exe [2009-07-14 27136]
    R3 WPCSvc;Parental Controls;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 WPDBusEnum;Portable Device Enumerator Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R3 WwanSvc;WWAN AutoConfig;c:\windows\system32\svchost.exe [2009-07-14 27136]
    R4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;c:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-06-10 89920]
    R4 Mcx2Svc;Media Center Extender Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S0 amdxata;amdxata;c:\windows\system32\drivers\amdxata.sys [x]
    S0 CLFS;Common Log (CLFS);c:\windows\System32\CLFS.sys [x]
    S0 CNG;CNG;c:\windows\System32\Drivers\cng.sys [x]
    S0 FileInfo;File Information FS MiniFilter;c:\windows\system32\drivers\fileinfo.sys [x]
    S0 fvevol;Bitlocker Drive Encryption Filter Driver;c:\windows\System32\DRIVERS\fvevol.sys [x]
    S0 hwpolicy;Hardware Policy Driver;c:\windows\System32\drivers\hwpolicy.sys [x]
    S0 KSecPkg;KSecPkg;c:\windows\System32\Drivers\ksecpkg.sys [x]
    S0 msahci;msahci;c:\windows\system32\drivers\msahci.sys [x]
    S0 msisadrv;msisadrv;c:\windows\system32\drivers\msisadrv.sys [x]
    S0 pcw;Performance Counters for Windows Driver;c:\windows\System32\drivers\pcw.sys [x]
    S0 rdyboost;ReadyBoost;c:\windows\System32\drivers\rdyboost.sys [x]
    S0 spldr;Security Processor Loader Driver; [x]
    S0 vdrvroot;Microsoft Virtual Drive Enumerator Driver;c:\windows\system32\drivers\vdrvroot.sys [x]
    S0 volmgr;Volume Manager Driver;c:\windows\system32\drivers\volmgr.sys [x]
    S0 volmgrx;Dynamic Volume Manager;c:\windows\System32\drivers\volmgrx.sys [x]
    S0 Wd;Microsoft Watchdog Timer Driver;c:\windows\system32\DRIVERS\wd.sys [x]
    S1 blbdrive;blbdrive;c:\windows\system32\DRIVERS\blbdrive.sys [x]
    S1 DfsC;DFS Namespace Client Driver;c:\windows\system32\Drivers\dfsc.sys [x]
    S1 discache;System Attribute Cache;c:\windows\system32\drivers\discache.sys [x]
    S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x]
    S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
    S1 nsiproxy;NSI proxy service driver.;c:\windows\system32\drivers\nsiproxy.sys [x]
    S1 RDPENCDD;RDP Encoder Mirror Driver;c:\windows\system32\drivers\rdpencdd.sys [x]
    S1 RDPREFMP;Reflector Display Driver used to gain access to graphics data;c:\windows\system32\drivers\rdprefmp.sys [x]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
    S1 tdx;NetIO Legacy TDI Support Driver;c:\windows\system32\DRIVERS\tdx.sys [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S1 Wanarpv6;Remote Access IPv6 ARP Driver;c:\windows\system32\DRIVERS\wanarp.sys [x]
    S1 WfpLwf;WFP Lightweight Filter;c:\windows\system32\DRIVERS\wfplwf.sys [x]
    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752]
    S2 AudioEndpointBuilder;Windows Audio Endpoint Builder;c:\windows\System32\svchost.exe [2009-07-14 27136]
    S2 BFE;Base Filtering Engine;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
    S2 DPS;Diagnostic Policy Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
    S2 FDResPub;Function Discovery Resource Publication;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 gpsvc;Group Policy Client;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 IKEEXT;IKE and AuthIP IPsec Keying Modules;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 iphlpsvc;IP Helper;c:\windows\System32\svchost.exe [2009-07-14 27136]
    S2 lltdio;Link-Layer Topology Discovery Mapper I/O Driver;c:\windows\system32\DRIVERS\lltdio.sys [x]
    S2 luafv;UAC File Virtualization;c:\windows\system32\drivers\luafv.sys [x]
    S2 MMCSS;Multimedia Class Scheduler;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 MpsSvc;Windows Firewall;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 NlaSvc;Network Location Awareness;c:\windows\System32\svchost.exe [2009-07-14 27136]
    S2 nsi;Network Store Interface Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 PcaSvc;Program Compatibility Assistant Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 PEAUTH;PEAUTH;c:\windows\system32\drivers\peauth.sys [x]
    S2 Power;Power;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 ProfSvc;User Profile Service;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 RpcEptMapper;RPC Endpoint Mapper;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-04-24 483688]
    S2 SysMain;Superfetch;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S2 tcpipreg;TCP/IP Registry Compatibility;c:\windows\system32\drivers\tcpipreg.sys [x]
    S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2010-02-26 252928]
    S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
    S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-03-18 2320920]
    S2 UxSms;Desktop Window Manager Session Manager;c:\windows\System32\svchost.exe [2009-07-14 27136]
    S2 WinDefend;Windows Defender;c:\windows\System32\svchost.exe [2009-07-14 27136]
    S2 Wlansvc;WLAN AutoConfig;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S3 Appinfo;Application Information;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S3 bowser;Browser Support Driver;c:\windows\system32\DRIVERS\bowser.sys [x]
    S3 CompositeBus;Composite Bus Enumerator Driver;c:\windows\system32\drivers\CompositeBus.sys [x]
    S3 DXGKrnl;LDDM Graphics Subsystem;c:\windows\System32\drivers\dxgkrnl.sys [x]
    S3 fdPHost;Function Discovery Provider Host;c:\windows\system32\svchost.exe [2009-07-14 27136]
    S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
    S3 HomeGroupListener;HomeGroup Listener;c:\windows\System32\svchost.exe [2009-07-14 27136]
    S3 HomeGroupProvider;HomeGroup Provider;c:\windows\System32\svchost.exe [2009-07-14 27136]
    S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
    S3 KeyIso;CNG Key Isolation;c:\windows\system32\lsass.exe [x]
    S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]
    S3 monitor;Microsoft Monitor Class Function Driver Service;c:\windows\system32\DRIVERS\monitor.sys [x]
    S3 mpsdrv;Windows Firewall Authorization Driver;c:\windows\system32\drivers\mpsdrv.sys [x]
    S3 mrxsmb10;SMB 1.x MiniRedirector;c:\windows\system32\DRIVERS\mrxsmb10.sys [x]
    S3 mrxsmb20;SMB 2.0 MiniRedirector;c:\windows\system32\DRIVERS\mrxsmb20.sys [x]
    S3 NativeWifiP;NativeWiFi Filter;c:\windows\system32\DRIVERS\nwifi.sys [x]
    S3 netprofm;Network List Service;c:\windows\System32\svchost.exe [2009-07-14 27136]
    S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
    S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
    S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [x]
    S3 RasAgileVpn;WAN Miniport (IKEv2);c:\windows\system32\DRIVERS\AgileVpn.sys [x]
    S3 rtl8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [x]
    S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
    S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
    S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
    S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
    S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-24 209768]
    S3 srv2;Server SMB 2.xxx Driver;c:\windows\system32\DRIVERS\srv2.sys [x]
    S3 srvnet;srvnet;c:\windows\system32\DRIVERS\srvnet.sys [x]
    S3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
    S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-02-06 137560]
    S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-02-24 835952]
    S3 tunnel;Microsoft Tunnel Miniport Adapter Driver;c:\windows\system32\DRIVERS\tunnel.sys [x]
    S3 umbus;UMBus Enumerator Driver;c:\windows\system32\drivers\umbus.sys [x]
    S3 vwifibus;Virtual WiFi Bus Driver;c:\windows\system32\DRIVERS\vwifibus.sys [x]
    S3 WdiServiceHost;Diagnostic Service Host;c:\windows\System32\svchost.exe [2009-07-14 27136]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - avipbb
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA
    LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS QWAVE wcncsvc
    DcomLaunch REG_MULTI_SZ Power PlugPlay DcomLaunch
    wcssvc REG_MULTI_SZ WcsPlugInService
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    AeLookupSvc
    CertPropSvc
    SCPolicySvc
    lanmanserver
    gpsvc
    AudioSrv
    FastUserSwitchingCompatibility
    Nla
    NWCWorkstation
    SRService
    Wmi
    WmdmPmSp
    TermService
    wuauserv
    BITS
    ShellHWDetection
    LogonHours
    PCAudit
    helpsvc
    uploadmgr
    iphlpsvc
    msiscsi
    schedule
    SessionEnv
    winmgmt
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
    sppuinotify
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - LocalServiceNetworkRestricted
    BthHFSrv
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-10 02:09]
    .
    2011-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-10 02:09]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SharingPrivate]
    @="{08244EE6-92F0-47f2-9FC9-929BAA2E7235}"
    [HKEY_CLASSES_ROOT\CLSID\{08244EE6-92F0-47f2-9FC9-929BAA2E7235}]
    2010-11-20 13:27 509952 ----a-w- c:\windows\System32\ntshrui.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-10 161304]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-10 386584]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-10 415256]
    "cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2010-03-10 520760]
    "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-04-28 307768]
    "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
    "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-02-06 709976]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    AeLookupSvc
    CertPropSvc
    SCPolicySvc
    lanmanserver
    gpsvc
    IKEEXT
    AudioSrv
    FastUserSwitchingCompatibility
    Nla
    NWCWorkstation
    SRService
    Wmi
    WmdmPmSp
    TermService
    wuauserv
    BITS
    ShellHWDetection
    LogonHours
    PCAudit
    helpsvc
    uploadmgr
    iphlpsvc
    seclogon
    AppInfo
    msiscsi
    MMCSS
    winmgmt
    SessionEnv
    browser
    EapHost
    schedule
    hkmsvc
    wercplsupport
    ProfSvc
    Themes
    BDESVC
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalSystemNetworkRestricted
    homegrouplistener
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
    WdiServiceHost
    sppuinotify
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetworkService
    lanmanworkstation
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalServiceNetworkRestricted
    BthHFSrv
    homegroupprovider
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://www.google.ca/
    mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSND&bmod=TSND
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local;<local>
    IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
    FF - ProfilePath - c:\users\MaryAnn\AppData\Roaming\Mozilla\Firefox\Profiles\ddga688p.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
    FF - prefs.js: keyword.URL - hxxp://search.shareazaweb.com/web?src=ffb&systemid=3&q=
    FF - prefs.js: network.proxy.type - 4
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    .
    - - - - ORPHANS REMOVED - - - -
    .
    BHO-{EE9A4208-64EC-11DE-8440-204256D89593} - c:\progra~2\SHAREA~1\MediaBar\ToolBar\ShareazaMediabarDx.dll
    Toolbar-Locked - (no file)
    Toolbar-{EE9A4208-64EC-11DE-8440-204256D89593} - c:\progra~2\SHAREA~1\MediaBar\ToolBar\ShareazaMediabarDx.dll
    SafeBoot-WudfPf
    SafeBoot-WudfRd
    SafeBoot-sacsvr
    SafeBoot-vmms
    Toolbar-Locked - (no file)
    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    HKLM-Run-(Default) - (no file)
    HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
    HKLM-Run-TPwrMain - %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
    HKLM-Run-HSON - %ProgramFiles%\TOSHIBA\TBS\HSON.exe
    HKLM-Run-SmoothView - %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
    HKLM-Run-00TCrdMain - %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
    HKLM-Run-TosWaitSrv - %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
    HKLM-Run-Teco - %ProgramFiles%\TOSHIBA\TECO\Teco.exe
    HKLM-Run-SmartFaceVWatcher - %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
    HKLM-Run-TosNC - %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe
    HKLM-Run-TosReelTimeMonitor - %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
    AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-1627509945-2646500916-3742819658-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.Email.1"
    .
    [HKEY_USERS\S-1-5-21-1627509945-2646500916-3742819658-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.VCard.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2011-03-10 18:39:09
    ComboFix-quarantined-files.txt 2011-03-10 23:39
    .
    Pre-Run: 269,328,273,408 bytes free
    Post-Run: 268,975,415,296 bytes free
    .
    - - End Of File - - B8A6AC32341F59E8BD85175E73C0CE69
     
  11. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Looks good now.

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  12. ireallyneedhelp

    ireallyneedhelp TS Rookie Topic Starter

    OTL Extras logfile created on: 3/10/2011 10:21:22 PM - Run 1
    OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\MaryAnn\Downloads
    64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.7601.17514)
    Locale: 00000409 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.00% Memory free
    6.00 Gb Paging File | 4.00 Gb Available in Paging File | 72.00% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 286.29 Gb Total Space | 248.79 Gb Free Space | 86.90% Space Free | Partition Type: NTFS

    Computer Name: MARYANN-PC | User Name: MaryAnn | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)

    [HKEY_USERS\S-1-5-21-1627509945-2646500916-3742819658-1001\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 7\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %* File not found
    cmdfile [open] -- "%1" %* File not found
    comfile [open] -- "%1" %* File not found
    exefile [open] -- "%1" %* File not found
    helpfile [open] -- Reg Error: Key error.
    htmlfile [edit] -- Reg Error: Key error.
    htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
    inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
    InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
    InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %* File not found
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1" File not found
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
    scrfile [open] -- "%1" /S File not found
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    htmlfile [edit] -- Reg Error: Key error.
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
    "{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
    "{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
    "{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
    "{77B8B4A5-EE79-4907-A318-2DA86325B8D7}" = iTunes
    "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
    "{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
    "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}" = TOSHIBA PC Health Monitor
    "{A0E99122-25C1-4CA4-9063-499A2A814EB6}" = TOSHIBA ReelTime
    "{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}" = TOSHIBA eco Utility
    "{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Media Creator
    "{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
    "{C14518AF-1A0F-4D39-8011-69BAA01CD380}" = TOSHIBA Bulletin Board
    "{C4FFA951-9678-4D51-84B4-AFD15D3C45AD}" = TOSHIBA Hardware Setup
    "{CBD6B23D-41D5-4A46-8019-6208516C9712}" = TOSHIBA Supervisor Password
    "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
    "{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
    "{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
    "{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
    "{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour
    "{E5C95CA5-4565-4B9D-97ED-05088D775614}" = Apple Mobile Device Support
    "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
    "{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
    "{FBBC4667-2521-4E78-B1BD-8706F774549B}" = Best Buy pc app
    "CNXT_AUDIO_HDA" = Conexant HD Audio
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "SynTPDeinstKey" = Synaptics Pointing Device Driver

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
    "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
    "{0D795777-9D60-4692-8386-F2B3F2B5E5BF}" = Label@Once 1.0
    "{0FB630AB-7BD8-40AE-B223-60397D57C3C9}" = Realtek WLAN Driver
    "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
    "{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
    "{1B87C40B-A60B-4EF3-9A68-706CF4B69978}" = TOSHIBA Assist
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
    "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
    "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
    "{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 24
    "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
    "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
    "{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
    "{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
    "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
    "{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
    "{5AF550B4-BB67-4E7E-82F1-2C4300279050}" = ToshibaRegistration
    "{5E6F6CF3-BACC-4144-868C-E14622C658F3}" = TOSHIBA Web Camera Application
    "{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
    "{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
    "{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Anti-Virus 2011
    "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
    "{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
    "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
    "{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English
    "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
    "{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
    "{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
    "{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}" = TOSHIBA Application Installer
    "{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}" = TOSHIBA Media Controller
    "{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
    "{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
    "{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
    "{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
    "{AC6569FA-6919-442A-8552-073BE69E247A}" = TOSHIBA Service Station
    "{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X
    "{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
    "{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}" = TOSHIBA eco Utility
    "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
    "{BB51B753-9A0C-4D1D-B3EF-A1B936F55796}" = Toshiba Book Place
    "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
    "{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
    "{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
    "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
    "{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
    "{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
    "{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
    "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
    "{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
    "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
    "{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
    "{E69992ED-A7F6-406C-9280-1C156417BC49}" = TOSHIBA Quality Application
    "{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
    "{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
    "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
    "{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
    "{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}" = TOSHIBA Media Controller Plug-in
    "{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
    "ESET Online Scanner" = ESET Online Scanner v3
    "Google Chrome" = Google Chrome
    "InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
    "InstallShield_{A0E99122-25C1-4CA4-9063-499A2A814EB6}" = TOSHIBA ReelTime
    "InstallShield_{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}" = TOSHIBA eco Utility
    "InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}" = TOSHIBA Bulletin Board
    "InstallShield_{C4FFA951-9678-4D51-84B4-AFD15D3C45AD}" = TOSHIBA Hardware Setup
    "InstallShield_{CBD6B23D-41D5-4A46-8019-6208516C9712}" = TOSHIBA Supervisor Password
    "InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
    "InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
    "InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Anti-Virus 2011
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
    "Mozilla Firefox 4.0b11 (x86 en-US)" = Mozilla Firefox 4.0b11 (x86 en-US)
    "Office14.Click2Run" = Microsoft Office Click-to-Run 2010
    "WinLiveSuite" = Windows Live Essentials
    "Yahoo! Companion" = Yahoo! Toolbar
    "Yahoo! Messenger" = Yahoo! Messenger
    "Yahoo! Software Update" = Yahoo! Software Update

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-1627509945-2646500916-3742819658-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "48e4cff94f039634" = Best Buy pc app

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 3/9/2011 6:23:39 AM | Computer Name = MaryAnn-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledSPRetry 2480

    Error - 3/9/2011 6:23:41 AM | Computer Name = MaryAnn-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: Continuously busy for more than a second

    Error - 3/9/2011 6:23:41 AM | Computer Name = MaryAnn-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledEvent 4040

    Error - 3/9/2011 6:23:41 AM | Computer Name = MaryAnn-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledSPRetry 4040

    Error - 3/9/2011 6:35:06 AM | Computer Name = MaryAnn-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: Continuously busy for more than a second

    Error - 3/9/2011 6:35:06 AM | Computer Name = MaryAnn-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledEvent 689399

    Error - 3/9/2011 6:35:06 AM | Computer Name = MaryAnn-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledSPRetry 689399

    Error - 3/9/2011 6:35:08 AM | Computer Name = MaryAnn-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: Continuously busy for more than a second

    Error - 3/9/2011 6:35:08 AM | Computer Name = MaryAnn-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledEvent 690835

    Error - 3/9/2011 6:35:08 AM | Computer Name = MaryAnn-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledSPRetry 690835

    [ Media Center Events ]
    Error - 3/7/2011 4:40:26 PM | Computer Name = MaryAnn-PC | Source = MCUpdate | ID = 0
    Description = 3:40:26 PM - Error connecting to the internet. 3:40:26 PM - Unable
    to contact server..

    [ System Events ]
    Error - 2/24/2011 11:47:05 PM | Computer Name = MaryAnn-PC | Source = DCOM | ID = 10010
    Description =

    Error - 3/2/2011 2:21:05 AM | Computer Name = MaryAnn-PC | Source = EventLog | ID = 6008
    Description = The previous system shutdown at 1:20:01 AM on ?02/?03/?2011 was unexpected.

    Error - 3/7/2011 5:35:00 PM | Computer Name = MaryAnn-PC | Source = EventLog | ID = 6008
    Description = The previous system shutdown at 4:34:09 PM on ?07/?03/?2011 was unexpected.

    Error - 3/7/2011 6:34:23 PM | Computer Name = MaryAnn-PC | Source = NetBT | ID = 4319
    Description = A duplicate name has been detected on the TCP network. The IP address
    of the computer that sent the message is in the data. Use nbtstat -n in a command
    window to see which name is in the Conflict state.

    Error - 3/7/2011 6:34:24 PM | Computer Name = MaryAnn-PC | Source = NetBT | ID = 4319
    Description = A duplicate name has been detected on the TCP network. The IP address
    of the computer that sent the message is in the data. Use nbtstat -n in a command
    window to see which name is in the Conflict state.

    Error - 3/7/2011 6:34:24 PM | Computer Name = MaryAnn-PC | Source = NetBT | ID = 4319
    Description = A duplicate name has been detected on the TCP network. The IP address
    of the computer that sent the message is in the data. Use nbtstat -n in a command
    window to see which name is in the Conflict state.

    Error - 3/7/2011 6:34:26 PM | Computer Name = MaryAnn-PC | Source = bowser | ID = 8003
    Description =

    Error - 3/8/2011 12:49:49 AM | Computer Name = MaryAnn-PC | Source = EventLog | ID = 6008
    Description = The previous system shutdown at 11:49:08 PM on ?07/?03/?2011 was unexpected.

    Error - 3/8/2011 5:21:52 PM | Computer Name = MaryAnn-PC | Source = DCOM | ID = 10010
    Description =

    Error - 3/8/2011 5:23:13 PM | Computer Name = MaryAnn-PC | Source = EventLog | ID = 6008
    Description = The previous system shutdown at 4:21:57 PM on ?08/?03/?2011 was unexpected.


    < End of report >
     
  13. ireallyneedhelp

    ireallyneedhelp TS Rookie Topic Starter

    OTL logfile created on: 3/10/2011 10:21:22 PM - Run 1
    OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\MaryAnn\Downloads
    64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.7601.17514)
    Locale: 00000409 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.00% Memory free
    6.00 Gb Paging File | 4.00 Gb Available in Paging File | 72.00% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 286.29 Gb Total Space | 248.79 Gb Free Space | 86.90% Space Free | Partition Type: NTFS

    Computer Name: MARYANN-PC | User Name: MaryAnn | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/03/10 22:19:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\MaryAnn\Downloads\OTL.exe
    PRC - [2010/12/07 15:09:09 | 000,352,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
    PRC - [2010/04/24 01:10:34 | 000,209,768 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
    PRC - [2010/04/24 01:10:28 | 000,483,688 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
    PRC - [2010/03/18 14:57:02 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    PRC - [2010/03/18 14:56:56 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    PRC - [2010/02/28 02:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\OFFICEVIRT.EXE
    PRC - [2009/11/27 06:23:46 | 002,866,176 | ---- | M] (MP2P Technologies.) -- C:\Program Files (x86)\Blubster\Blubster.exe
    PRC - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe


    ========== Modules (SafeList) ==========

    MOD - [2011/03/10 22:19:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\MaryAnn\Downloads\OTL.exe
    MOD - [2010/11/20 06:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV:64bit: - [2010/06/29 12:49:27 | 000,128,752 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
    SRV:64bit: - [2010/02/25 21:00:32 | 000,252,928 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\TECO\TecoService.exe -- (TOSHIBA eco Utility Service)
    SRV:64bit: - [2010/02/23 19:57:42 | 000,835,952 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe -- (TPCHSrv)
    SRV:64bit: - [2010/02/05 19:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
    SRV:64bit: - [2009/11/06 00:05:28 | 000,489,312 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
    SRV:64bit: - [2009/07/28 17:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
    SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV - [2010/12/07 15:09:09 | 000,352,976 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe -- (AVP)
    SRV - [2010/04/24 01:10:34 | 000,209,768 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
    SRV - [2010/04/24 01:10:28 | 000,483,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
    SRV - [2010/03/18 14:57:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
    SRV - [2010/03/18 14:56:56 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
    SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
    SRV - [2009/10/06 11:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
    SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
    SRV - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)


    ========== Driver Services (SafeList) ==========

    DRV:64bit: - [2010/12/14 18:51:20 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
    DRV:64bit: - [2010/12/07 15:09:09 | 000,556,120 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF)
    DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
    DRV:64bit: - [2010/11/20 08:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
    DRV:64bit: - [2010/11/20 08:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
    DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
    DRV:64bit: - [2010/07/29 07:10:42 | 010,610,400 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
    DRV:64bit: - [2010/06/09 17:44:00 | 000,011,864 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kl2.sys -- (kl2)
    DRV:64bit: - [2010/06/09 17:43:56 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (KL1)
    DRV:64bit: - [2010/04/28 03:32:20 | 000,932,384 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192Ce.sys -- (rtl8192Ce)
    DRV:64bit: - [2010/04/24 01:10:32 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
    DRV:64bit: - [2010/04/24 01:10:28 | 000,269,672 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
    DRV:64bit: - [2010/04/24 01:10:28 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
    DRV:64bit: - [2010/04/24 01:10:20 | 000,721,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
    DRV:64bit: - [2010/04/22 19:07:36 | 000,027,736 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6)
    DRV:64bit: - [2010/03/31 01:50:16 | 000,724,536 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
    DRV:64bit: - [2010/03/24 15:55:56 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
    DRV:64bit: - [2010/03/10 20:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
    DRV:64bit: - [2010/02/27 09:32:14 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
    DRV:64bit: - [2010/02/17 13:23:05 | 000,014,920 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
    DRV:64bit: - [2010/02/17 13:23:05 | 000,012,360 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
    DRV:64bit: - [2010/02/08 23:57:22 | 000,239,136 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
    DRV:64bit: - [2009/11/02 20:27:10 | 000,022,544 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt)
    DRV:64bit: - [2009/09/17 15:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
    DRV:64bit: - [2009/07/30 22:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
    DRV:64bit: - [2009/07/14 17:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
    DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
    DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
    DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
    DRV:64bit: - [2009/06/22 19:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
    DRV:64bit: - [2009/06/19 21:15:22 | 000,014,472 | ---- | M] (TOSHIBA Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TVALZFL.sys -- (TVALZFL)
    DRV:64bit: - [2009/06/15 15:58:50 | 000,012,800 | ---- | M] (TOSHIBA) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\QIOMem.sys -- (QIOMem)
    DRV:64bit: - [2009/06/10 16:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
    DRV:64bit: - [2009/06/10 16:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
    DRV:64bit: - [2009/06/10 16:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
    DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
    DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
    DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
    DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
    DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
    DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)

    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=TSND&bmod=TSND


    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    IE - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://start.toshiba.com/g/ [binary data]
    IE - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
    IE - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    IE - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "Shareaza Web Search"
    FF - prefs.js..browser.search.order.1: "Shareaza Web Search"
    FF - prefs.js..browser.search.selectedEngine: "Google"
    FF - prefs.js..browser.search.useDBForOrder: true
    FF - prefs.js..browser.startup.homepage: "http://www.google.ca/"
    FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:11.0.1.400
    FF - prefs.js..keyword.URL: "http://search.shareazaweb.com/web?src=ffb&systemid=3&q="
    FF - prefs.js..network.proxy.type: 4


    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/01/04 23:13:01 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/03/09 18:15:39 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 4.0b11\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 7\components [2011/03/08 18:33:41 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 4.0b11\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 7\plugins [2011/03/09 18:18:27 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\THBExt [2010/12/07 14:31:00 | 000,000,000 | ---D | M]

    [2010/12/07 14:54:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MaryAnn\AppData\Roaming\Mozilla\Extensions
    [2011/03/10 22:17:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MaryAnn\AppData\Roaming\Mozilla\Firefox\Profiles\ddga688p.default\extensions
    [2011/03/08 18:33:32 | 000,000,000 | ---D | M] (cacaoweb) -- C:\Users\MaryAnn\AppData\Roaming\Mozilla\Firefox\Profiles\ddga688p.default\extensions\cacaoweb@cacaoweb.org
    [2010/08/12 03:21:06 | 000,002,510 | ---- | M] () -- C:\Users\MaryAnn\AppData\Roaming\Mozilla\Firefox\Profiles\ddga688p.default\searchplugins\ShareazaWebSearch.xml
    [2010/12/08 12:32:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
    [2010/12/08 12:32:07 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
    File not found (No name found) --
    [2011/03/09 18:18:31 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES (X86)\MOZILLA FIREFOX 4.0 BETA 7\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
    () (No name found) -- C:\USERS\MARYANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DDGA688P.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
    () (No name found) -- C:\USERS\MARYANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\DDGA688P.DEFAULT\EXTENSIONS\TESTPILOT@LABS.MOZILLA.COM.XPI

    O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
    O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\x64\ievkbd.dll (Kaspersky Lab ZAO)
    O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg64.dll (Google Inc.)
    O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
    O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
    O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\ievkbd.dll (Kaspersky Lab ZAO)
    O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
    O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
    O2 - BHO: (MediaBar) - {EE9A4208-64EC-11DE-8440-204256D89593} - File not found
    O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
    O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
    O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    O3 - HKLM\..\Toolbar: (MediaBar) - {EE9A4208-64EC-11DE-8440-204256D89593} - File not found
    O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3:64bit: - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
    O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
    O4:64bit: - HKLM..\Run: [SmartFaceVWatcher] C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
    O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe (Kaspersky Lab ZAO)
    O4 - HKLM..\Run: [Blubster] C:\Program Files (x86)\Blubster\Blubster.exe (MP2P Technologies.)
    O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
    O4 - HKLM..\Run: [TWebCamera] C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.)
    O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
    O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
    O4 - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
    O4 - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001..\Run: [Speech Recognition] C:\windows\Speech\Common\sapisvr.exe (Microsoft Corporation)
    O4 - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
    O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] File not found
    O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] File not found
    O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
    O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O8:64bit: - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
    O8 - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
    O9:64bit: - Extra Button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
    O9:64bit: - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
    O9 - Extra Button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
    O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll (Kaspersky Lab ZAO)
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.71.255.198
    O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
    O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
    O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
    O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
    O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
    O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
    O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - Reg Error: Key error. File not found
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\mzvkbd3.dll (Kaspersky Lab ZAO)
    O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
    O20:64bit: - Winlogon\Notify\klogon: DllName - Reg Error: Key error. - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO)
    O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
    O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
    O32 - HKLM CDRom: AutoRun - 1
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35:64bit: - HKLM\..comfile [open] -- "%1" %*
    O35:64bit: - HKLM\..exefile [open] -- "%1" %*
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*


    Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.)


    WILL CONTINUE THE REST OF THE LOG IN THE FOLLOWING REPLY.........
     
  14. ireallyneedhelp

    ireallyneedhelp TS Rookie Topic Starter

    CONTINUATION

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/03/10 18:27:40 | 000,161,792 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
    [2011/03/10 18:27:40 | 000,136,704 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
    [2011/03/10 18:27:40 | 000,031,232 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
    [2011/03/10 18:27:36 | 000,000,000 | ---D | C] -- C:\windows\ERDNT
    [2011/03/10 18:27:15 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/03/10 18:26:55 | 000,212,480 | ---- | C] (SteelWerX) -- C:\windows\SWXCACLS.exe
    [2011/03/10 18:26:50 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
    [2011/03/10 16:07:22 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{DD68F372-E51D-48A4-9828-52BA48CA987E}
    [2011/03/09 20:11:52 | 000,000,000 | ---D | C] -- C:\windows\SysNative\SPReview
    [2011/03/09 20:10:50 | 000,000,000 | ---D | C] -- C:\windows\SysNative\EventProviders
    [2011/03/09 19:57:21 | 000,116,224 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\windows\SysNative\fms.dll
    [2011/03/09 19:56:27 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\windows\SysWow64\fms.dll
    [2011/03/09 18:40:09 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\ElevatedDiagnostics
    [2011/03/09 18:18:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
    [2011/03/09 18:18:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
    [2011/03/09 18:16:16 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
    [2011/03/09 18:15:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
    [2011/03/09 18:15:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
    [2011/03/09 18:14:50 | 000,000,000 | ---D | C] -- C:\Config.Msi
    [2011/03/09 15:40:35 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{70A1C39E-626F-46DF-AF3B-3820319DE353}
    [2011/03/09 02:28:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
    [2011/03/09 01:57:00 | 000,000,000 | ---D | C] -- C:\windows\pss
    [2011/03/08 18:53:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
    [2011/03/08 18:36:15 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{66F93538-C520-4A1C-8E6F-96B0274D3D7D}
    [2011/03/08 17:45:06 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Roaming\SUPERAntiSpyware.com
    [2011/03/08 17:45:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
    [2011/03/08 17:44:58 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
    [2011/03/08 16:24:24 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{D2CC22E8-C43D-4C09-A745-0F6B454ADEC1}
    [2011/03/08 15:32:24 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
    [2011/03/08 15:32:19 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
    [2011/03/07 14:49:25 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{32E8AC55-6BE0-4BAA-A8F2-172305E2FE78}
    [2011/03/07 00:29:04 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{8CF54C57-C9E9-48AA-8381-E42263E70369}
    [2011/03/06 01:08:02 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{29885AF2-A004-417B-BC39-DEC94BB19436}
    [2011/03/05 13:07:34 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{1D516D2B-263E-4F8C-A1A7-037FE1DEF378}
    [2011/03/05 01:36:26 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\Documents\older.divx.web.player
    [2011/03/04 21:44:06 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{9AB6C56E-D6BF-473B-B049-982DDCAFE928}
    [2011/03/03 19:03:10 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{882929A7-0BC2-4E70-A727-C06FC5F9DF32}
    [2011/03/02 18:51:11 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\Microsoft Help
    [2011/03/02 18:51:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
    [2011/03/02 16:04:30 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{0278F90F-3EB1-4C32-A2C4-FB037A549DBB}
    [2011/03/02 00:58:36 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Roaming\GetRightToGo
    [2011/03/02 00:34:51 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\DDMSettings
    [2011/03/02 00:33:28 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Roaming\DivX
    [2011/03/02 00:32:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus
    [2011/03/02 00:29:49 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX
    [2011/03/01 17:08:09 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{8B245C40-590B-4D08-8EF1-3E6444F610A1}
    [2011/03/01 01:36:06 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{C9648AFB-1079-4823-830D-73791147A698}
    [2011/02/28 13:35:42 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{D9A98A79-9807-47B7-8C73-28876BB1740F}
    [2011/02/27 16:24:54 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{46E9F536-F3CF-477C-84EB-978B71437312}
    [2011/02/26 20:43:25 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{7DC3866C-7A24-48BA-B2A2-391C055ED4CD}
    [2011/02/25 15:22:48 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{7996ED0D-6C0A-4BB6-8FAC-1F7C47E93A6E}
    [2011/02/25 14:56:30 | 000,000,000 | R--D | C] -- C:\Users\MaryAnn\Documents\Scanned Documents
    [2011/02/25 14:56:29 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\Documents\Fax
    [2011/02/24 22:46:03 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{589A8231-A3CD-44E6-B60A-4062BAE7438A}
    [2011/02/24 16:46:48 | 000,000,000 | R--D | C] -- C:\MSOCache
    [2011/02/24 03:03:23 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{20C3F8B8-BB97-4A80-B65D-854856A6EE49}
    [2011/02/24 02:47:45 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\Yahoo
    [2011/02/24 02:38:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo! Companion
    [2011/02/24 02:38:49 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Roaming\Yahoo!
    [2011/02/24 02:37:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger
    [2011/02/24 02:37:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo!
    [2011/02/24 02:35:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Yahoo!
    [2011/02/23 15:02:56 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{7165311D-717D-49DE-89D2-0751AB99E16B}
    [2011/02/22 16:21:20 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{578F7BA2-35D3-4814-94F3-E11C79BE43C9}
    [2011/02/22 04:10:04 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Roaming\Malwarebytes
    [2011/02/22 04:09:59 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysWow64\drivers\mbamswissarmy.sys
    [2011/02/22 04:09:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/02/22 04:09:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2011/02/22 04:09:55 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
    [2011/02/22 04:09:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    [2011/02/22 03:59:06 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Roaming\56003FF7290644D3F111D8F4F960A231
    [2011/02/22 03:01:40 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{62502933-CD50-4DE3-A375-E3FCD8F3CAB5}
    [2011/02/21 15:01:14 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{764C74D7-8178-46EF-8729-F10D6D46188D}
    [2011/02/21 02:57:27 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{237A60BA-05F2-4A66-8268-402F05EA79B6}
    [2011/02/20 14:57:13 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{8E77C59F-C855-4D41-9DD5-99AB9EC51F5A}
    [2011/02/20 02:46:43 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{74B1583F-8BE5-45D5-9F08-DD706FF491D0}
    [2011/02/19 14:46:16 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{2CD9CC7B-9CC5-4964-887B-566763C12ED6}
    [2011/02/19 01:16:37 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{ADE50F55-09FF-4864-8123-F33E271D35B4}
    [2011/02/17 23:57:12 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{A1467C40-B3C4-483C-AEEF-C667ADC5C134}
    [2011/02/17 11:56:37 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{1DF44B13-AA2B-4BD8-859D-48AF8FC9AED2}
    [2011/02/16 19:29:33 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{9C9043E0-141C-450C-B4E8-9002C7DD14A5}
    [2011/02/14 23:13:41 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{B3327088-8086-4A83-BE46-429012A9500F}
    [2011/02/12 23:42:51 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{DE3C6886-9298-4A90-A3DA-D5496E140D80}
    [2011/02/12 10:39:30 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{422AA32E-F7E4-43F5-A133-CFBB649281DD}
    [2011/02/08 23:37:38 | 000,000,000 | ---D | C] -- C:\Users\MaryAnn\AppData\Local\{BB402F91-F313-4134-979D-35A8DEAB04FA}
    [1 C:\Users\MaryAnn\Documents\*.tmp files -> C:\Users\MaryAnn\Documents\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2011/03/10 22:19:00 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
    [2011/03/10 22:16:39 | 000,727,182 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
    [2011/03/10 22:16:39 | 000,628,904 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
    [2011/03/10 22:16:39 | 000,110,798 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
    [2011/03/10 22:14:08 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
    [2011/03/10 16:13:43 | 000,015,792 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    [2011/03/10 16:13:43 | 000,015,792 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    [2011/03/10 16:05:51 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
    [2011/03/10 16:05:24 | 2307,280,896 | -HS- | M] () -- C:\hiberfil.sys
    [2011/03/09 20:49:02 | 000,274,320 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
    [2011/03/09 18:15:39 | 000,002,030 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
    [2011/03/09 17:02:14 | 000,001,819 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
    [2011/03/01 17:16:16 | 000,002,264 | ---- | M] () -- C:\Users\MaryAnn\Documents\My Movie.wlmp
    [2011/02/24 02:37:51 | 000,001,176 | ---- | M] () -- C:\Users\MaryAnn\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
    [2011/02/24 02:37:51 | 000,001,152 | ---- | M] () -- C:\Users\Public\Desktop\Yahoo! Messenger.lnk
    [1 C:\Users\MaryAnn\Documents\*.tmp files -> C:\Users\MaryAnn\Documents\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011/03/10 18:27:40 | 000,256,512 | ---- | C] () -- C:\windows\PEV.exe
    [2011/03/10 18:27:40 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
    [2011/03/10 18:27:40 | 000,089,088 | ---- | C] () -- C:\windows\MBR.exe
    [2011/03/10 18:27:40 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
    [2011/03/10 18:27:40 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
    [2011/03/09 19:59:35 | 000,347,904 | ---- | C] () -- C:\windows\SysNative\systemsf.ebd
    [2011/03/09 19:55:40 | 000,010,429 | ---- | C] () -- C:\windows\SysNative\ScavengeSpace.xml
    [2011/03/09 19:55:05 | 000,105,559 | ---- | C] () -- C:\windows\SysWow64\RacRules.xml
    [2011/03/09 19:55:05 | 000,105,559 | ---- | C] () -- C:\windows\SysNative\RacRules.xml
    [2011/03/09 19:54:29 | 000,001,041 | ---- | C] () -- C:\windows\SysWow64\tcpbidi.xml
    [2011/03/09 18:15:39 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
    [2011/03/09 18:15:39 | 000,002,030 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
    [2011/03/09 17:02:14 | 000,001,819 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
    [2011/03/01 17:16:15 | 000,002,264 | ---- | C] () -- C:\Users\MaryAnn\Documents\My Movie.wlmp
    [2011/02/24 02:37:51 | 000,001,176 | ---- | C] () -- C:\Users\MaryAnn\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
    [2011/02/24 02:37:51 | 000,001,152 | ---- | C] () -- C:\Users\Public\Desktop\Yahoo! Messenger.lnk
    [2010/12/08 17:06:40 | 000,000,017 | ---- | C] () -- C:\windows\SysWow64\shortcut_ex.dat
    [2010/12/06 17:04:24 | 000,722,802 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
    [2010/12/06 17:01:21 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
    [2010/07/29 07:08:46 | 000,127,868 | ---- | C] () -- C:\windows\SysWow64\igcompkrng575.bin
    [2010/07/29 07:08:44 | 000,104,796 | ---- | C] () -- C:\windows\SysWow64\igfcg575m.bin
    [2010/07/29 07:08:42 | 000,870,560 | ---- | C] () -- C:\windows\SysWow64\igkrng575.bin
    [2010/07/29 06:14:38 | 000,208,896 | ---- | C] () -- C:\windows\SysWow64\iglhsip32.dll
    [2010/07/29 06:14:38 | 000,143,360 | ---- | C] () -- C:\windows\SysWow64\iglhcp32.dll
    [2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
    [2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- C:\windows\SysWow64\NOISE.DAT
    [2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- C:\windows\SysWow64\dssec.dat
    [2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
    [2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll
    [2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll
    [2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- C:\windows\SysWow64\mlang.dat

    ========== LOP Check ==========

    [2011/03/08 18:33:44 | 000,000,000 | ---D | M] -- C:\Users\MaryAnn\AppData\Roaming\56003FF7290644D3F111D8F4F960A231
    [2011/02/05 00:44:21 | 000,000,000 | ---D | M] -- C:\Users\MaryAnn\AppData\Roaming\FrostWire
    [2011/03/02 00:59:34 | 000,000,000 | ---D | M] -- C:\Users\MaryAnn\AppData\Roaming\GetRightToGo
    [2011/03/08 18:33:19 | 000,000,000 | ---D | M] -- C:\Users\MaryAnn\AppData\Roaming\SoftGrid Client
    [2010/12/06 14:15:12 | 000,000,000 | ---D | M] -- C:\Users\MaryAnn\AppData\Roaming\Tific
    [2011/02/09 01:38:31 | 000,000,000 | ---D | M] -- C:\Users\MaryAnn\AppData\Roaming\Toshiba
    [2010/12/06 17:05:29 | 000,000,000 | ---D | M] -- C:\Users\MaryAnn\AppData\Roaming\TP
    [2010/12/06 05:50:53 | 000,000,000 | ---D | M] -- C:\Users\MaryAnn\AppData\Roaming\WinBatch
    [2009/07/14 00:08:49 | 000,010,222 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2009/07/13 20:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
    [2010/09/10 13:17:16 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
    [2011/03/10 18:39:10 | 000,043,504 | ---- | M] () -- C:\ComboFix.txt
    [2011/03/10 16:05:24 | 2307,280,896 | -HS- | M] () -- C:\hiberfil.sys
    [2011/03/10 16:05:27 | 3076,374,528 | -HS- | M] () -- C:\pagefile.sys
    [2011/02/22 04:09:20 | 000,000,404 | ---- | M] () -- C:\rkill.log
    [2010/10/14 15:47:49 | 000,000,047 | ---- | M] () -- C:\Status.log

    < %systemroot%\Fonts\*.com >
    [2009/07/14 00:32:31 | 000,026,040 | ---- | M] () -- C:\windows\Fonts\GlobalMonospace.CompositeFont
    [2009/07/14 00:32:31 | 000,026,489 | ---- | M] () -- C:\windows\Fonts\GlobalSansSerif.CompositeFont
    [2009/07/14 00:32:31 | 000,029,779 | ---- | M] () -- C:\windows\Fonts\GlobalSerif.CompositeFont
    [2009/07/14 00:32:31 | 000,043,318 | ---- | M] () -- C:\windows\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2009/06/10 15:49:50 | 000,000,065 | ---- | M] () -- C:\windows\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2010/11/10 02:28:46 | 000,301,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2010/12/06 05:54:54 | 000,000,221 | -HS- | M] () -- C:\Users\MaryAnn\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >
    [2009/06/10 16:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\addins\FXSEXT.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >
    [2011/03/09 20:51:32 | 000,008,192 | ---- | M] () -- C:\Windows\security\database\edb.chk
    [2011/03/09 20:51:32 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edb.log
    [2011/03/09 20:51:31 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00001.jrs
    [2011/03/09 20:51:32 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00002.jrs
    [2011/03/09 20:51:31 | 000,786,432 | ---- | M] () -- C:\Windows\security\database\edbtmp.log
    [2011/03/09 20:51:32 | 001,056,768 | ---- | M] () -- C:\Windows\security\database\tmp.edb

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2011/03/09 20:54:27 | 000,000,402 | -HS- | M] () -- C:\Users\MaryAnn\Favorites\desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < End of report >
     
  15. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      IE - HKU\S-1-5-21-1627509945-2646500916-3742819658-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
      FF - prefs.js..browser.search.defaultenginename: "Shareaza Web Search"
      FF - prefs.js..browser.search.order.1: "Shareaza Web Search"
      FF - prefs.js..keyword.URL: "http://search.shareazaweb.com/web?src=ffb&systemid=3&q="
      [2010/08/12 03:21:06 | 000,002,510 | ---- | M] () -- C:\Users\MaryAnn\AppData\Roaming\Mozilla\Firefox\Profiles\ddga688p.default\ searchplugins\ShareazaWebSearch.xml
      O2 - BHO: (MediaBar) - {EE9A4208-64EC-11DE-8440-204256D89593} - File not found
      O3 - HKLM\..\Toolbar: (MediaBar) - {EE9A4208-64EC-11DE-8440-204256D89593} - File not found
      O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
      O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] File not found
      O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] File not found
      O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
      O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
      [1 C:\Users\MaryAnn\Documents\*.tmp files -> C:\Users\MaryAnn\Documents\*.tmp -> ]
      [2010/12/06 17:01:21 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
      
      
      :Services
      
      :Reg
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ======================================================================

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  16. ireallyneedhelp

    ireallyneedhelp TS Rookie Topic Starter

    All processes killed
    ========== OTL ==========
    HKU\S-1-5-21-1627509945-2646500916-3742819658-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
    Prefs.js: "Shareaza Web Search" removed from browser.search.defaultenginename
    Prefs.js: "Shareaza Web Search" removed from browser.search.order.1
    Prefs.js: "http://search.shareazaweb.com/web?src=ffb&systemid=3&q=" removed from keyword.URL
    File C:\Users\MaryAnn\AppData\Roaming\Mozilla\Firefox\Profiles\ddga688p.default\ searchplugins\ShareazaWebSearch.xml not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE9A4208-64EC-11DE-8440-204256D89593}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE9A4208-64EC-11DE-8440-204256D89593}\ deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EE9A4208-64EC-11DE-8440-204256D89593} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE9A4208-64EC-11DE-8440-204256D89593}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
    Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
    Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
    64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
    64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
    C:\Users\MaryAnn\Documents\~WRL3494.tmp deleted successfully.
    C:\ProgramData\ezsidmv.dat moved successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: MaryAnn
    ->Temp folder emptied: 841618 bytes
    ->Temporary Internet Files folder emptied: 442490 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 89881422 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 689 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 143184 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 87.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default

    User: Default User

    User: MaryAnn
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.22.3 log created on 03102011_233159

    Files\Folders moved on Reboot...
    C:\Users\MaryAnn\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
    File\Folder C:\windows\temp\klsEDE.tmp not found!

    Registry entries deleted on Reboot...




    Results of screen317's Security Check version 0.99.7
    Windows 7 (UAC is enabled)
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Enabled!
    ESET Online Scanner v3
    Kaspersky Anti-Virus 2011
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    Java(TM) 6 Update 24
    Out of date Java installed!
    Adobe Flash Player 10.2.152.26
    Adobe Reader X
    Mozilla Firefox (x86 en-US..) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Kaspersky Lab Kaspersky Anti-Virus 2011 avp.exe
    ESET ESET Online Scanner OnlineScannerApp.exe
    ``````````End of Log````````````


    ESET ONLINESCANNER RESULTS

    C:\Users\MaryAnn\AppData\Roaming\56003FF7290644D3F111D8F4F960A231\local.ini Win32/Adware.AntimalwareDoctor.AE.Gen application
     
  17. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      
      :Services
      
      :Reg
      
      :Files
      C:\Users\MaryAnn\AppData\Roaming\56003FF7290644D3F111D8F4F960A231\local.ini
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =====================================================================

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.
     
  18. ireallyneedhelp

    ireallyneedhelp TS Rookie Topic Starter

    I did something very stupid on my part!

    I ran the clean-up before pasting the logs so now they are deleted. =/ Are they still necessary for me to post and should I repeat the same steps, or does that now defeat the purpose? I'm so sorry!
     
  19. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    That's fine. No worries.

    How is computer doing?
     
  20. ireallyneedhelp

    ireallyneedhelp TS Rookie Topic Starter

    So far so good! I'm not getting any pop-ups and everything seems to be running smoothly. No complaints here.

    Thank you SO much for your help btw you saved me one less headache. :) :) :) I really appreciate the time you took following through with me with all the steps. I'll continue to run the safety scans and definitely read the article on how to prevent such issues from happening again.
     
  21. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Way to go!! [​IMG]
    Good luck and stay safe :)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...