TechSpot

Explorer.exe is hogging memory

By electrophile888
Aug 13, 2011
  1. This problem has been taxing my brain for many a day now!

    Hello all, I'm a new poster to these boards, but please bear with me. My life has taken a turn recently, and I'm trying to get good with computers as a possible way of making a living in the future. As such, I have sworn to myself that I will solve this problem out without using a professional, which is why I am here. I'm OK with computers but no expert. I am willing to learn!

    A few weeks ago, I noticed that my laptop seemed a bit more sluggish, although I didn't really pay it a whole lot of attention at the time. I've had some more time on my hands recently, and I've been using the computer a lot. I've noticed that one particular process (explorer.exe) seems to be consuming an awful lot of memory. The process boots up at about 20MB, which seems reasonable enough, but the process quickly mushrooms to between 250-420MB, which does seem an awful lot.

    I have googled the hell out of this problem, to no avail. I've tried a number of different things all to no avail. Here are the things that I have done:

    -Kill the process and restart it. It stops using memory for a while but very quickly mushrooms to previous levels.

    -Uninstall anything that I have installed in the past year.

    -Clean the registry with Registry Mechanic. Lots of issues found, but still doesn't solve the problem!

    -Tried some software for examining shell extensions, which apparently affect the explorer.exe process. The software was difficult to use, and I couldn't see any new shell extensions that had been installed.

    -Try the method here:
    http://www.techspot.com/vb/topic158695.html
    It's a really detailed and helpful reply, but I can't get it to work.The Combifix software doesn't run properly, and besides, I'm not sure that I can get McCafee to disable fully.

    My laptop is still usable at this memory level, but that is not the point. This doesn't appear normal to me and I damn well want to fix it!

    Can anybody help?

    Gareth
     
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Welcome to TechSpot!

    You should never follow directions given to another member. While it may sound like the same problem, the cause can be very different. explore.exe can be a valid process- or malware can be hiding under that name. Do not shut it down as the legitimate entry need to run..

    If you would like us to check the system for malware, please follow the steps in the Preliminary Virus and Malware Removal thread HERE.

    NOTE: If you already have any of the scanning programs on the computer, please remove them and download the versions in these links.

    When you have finished, leave the logs for review in your next reply .
    NOTE: Logs must be pasted in the replies. Attached logs will not be reviewed.

    Please do not use any other cleaning programs or scans while I'm helping you, unless I direct you to. Do not use a Registry cleaner or make any changes in the Registry.
    ============================================
    My Guidelines: please read and follow:
    • Be patient. Malware cleaning takes time and I am also working with other members while I am helping you.
    • Read my instructions carefully. If you don't understand or have a problem, ask me.
    • If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
    • Follow the order of the tasks I give you. Order is crucial in cleaning process.
    • File sharing programs should be uninstalled or disabled during the cleaning process..
    • Observe these:
      [o] Don't use any other cleaning programs or scans while I'm helping you.
      [o] Don't use a Registry cleaner or make any changes in the Registry.
      [o] Don't download and install new programs- except those I give you.
    • Please let me know if there is any change in the system.

    If I don't get a reply from you in 5 days, the thread will be closed. If your problem persist, you can send a PM to reopen it.
    =====================================
    Please note not to use a Registry leaner or make any Registry changes while I'm helping you. Advise you uninstall Registry Mechanic. We don't not advise anyone to use a registry cleaner.
     
  3. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    Thanks for the quick reply. I will get the logs and post them tomorrow.

    Gareth
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    That's fine. I'm getting ready to shut down. If you want me to help though, please don't do anything else to try and solve the problem. Usually random tries like that cause more problems!
     
  5. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    Mbam Log File:

    Malwarebytes' Anti-Malware 1.51.1.1800
    www.malwarebytes.org

    Database version: 7467

    Windows 6.1.7601 Service Pack 1
    Internet Explorer 8.0.7601.17514

    14/08/2011 20:58:38
    mbam-log-2011-08-14 (20-58-38).txt

    Scan type: Quick scan
    Objects scanned: 169136
    Time elapsed: 7 minute(s), 40 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 1
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
  6. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    Gmer.log

    <empty>
     
  7. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    dds.log


    .
    DDS (Ver_2011-06-23.01) - NTFSAMD64
    Internet Explorer: 8.0.7601.17514
    Run by Gareth at 21:43:39 on 2011-08-14
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.1973.669 [GMT 1:00]
    .
    AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\STacSV64.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Program Files\Dell\DellDock\DockLogin.exe
    C:\Windows\system32\atieclxx.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE
    C:\Windows\system32\WLANExt.exe
    C:\Windows\system32\conhost.exe
    C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Windows\system32\lxebcoms.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
    C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exe
    C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
    C:\Program Files\IDT\WDM\sttray64.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe
    C:\Program Files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe
    C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe
    C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Users\Gareth\AppData\Local\Google\Update\1.3.21.65\GoogleCrashHandler.exe
    C:\Program Files\mcafee.com\agent\mcagent.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Windows\system32\taskmgr.exe
    C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    C:\Program Files (x86)\Last.fm\LastFM.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Users\Gareth\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Gareth\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Gareth\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Gareth\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Gareth\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\Users\Gareth\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Program Files\Common Files\McAfee\Core\mchost.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20110512103709.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: LastPass Browser Helper Object: {95d9ecf5-2a4d-4550-be49-70d42f71296e} - C:\Program Files (x86)\LastPass\LPBar.dll
    BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPBar.dll
    uRun: [Google Update] "C:\Users\Gareth\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
    mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe
    mRunOnce: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe
    mRunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    StartupFolder: C:\Users\Gareth\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\7DIGIT~1.LNK - C:\Program Files (x86)\7digital Download Manager\7digital Download Manager.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: LastPass - file://C:\Program Files (x86)\LastPass\context.html?cmd=lastpass
    IE: LastPass Fill Forms - file://C:\Program Files (x86)\LastPass\context.html?cmd=fillforms
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPBar.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxp://kitchenplanner.ikea.com/gb/Core/Player/2020PlayerAX_Win32.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    TCP: DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{47FFFE72-44CE-4D58-8E1F-5C1D42F59DC3} : DhcpNameServer = 13.36.0.1 13.36.0.2
    TCP: Interfaces\{FB144808-DFB7-45E5-917E-8C9A0144FE41} : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{FB144808-DFB7-45E5-917E-8C9A0144FE41}\05C65737E6564775962756C6563737 : DhcpNameServer = 192.168.1.254
    TCP: Interfaces\{FB144808-DFB7-45E5-917E-8C9A0144FE41}\341626C65675962756C6563737 : DhcpNameServer = 10.0.0.2
    TCP: Interfaces\{FB144808-DFB7-45E5-917E-8C9A0144FE41}\4514C4B44514C4B4D2431433535414 : DhcpNameServer = 192.168.1.1 192.168.1.1
    TCP: Interfaces\{FB144808-DFB7-45E5-917E-8C9A0144FE41}\4516C6B64516C6B653534343A6 : DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{FB144808-DFB7-45E5-917E-8C9A0144FE41}\93830224C656E6865696D6022546 : DhcpNameServer = 192.168.2.1
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
    BHO-X64: Search Helper - No File
    BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20110512103709.dll
    BHO-X64: scriptproxy - No File
    BHO-X64: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: LastPass Browser Helper Object: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPBar.dll
    BHO-X64: LastPass Browser Helper Object - No File
    BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO-X64: SkypeIEPluginBHO - No File
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO-X64: Windows Live Toolbar Helper: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    TB-X64: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    TB-X64: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPBar.dll
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun-x64: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun-x64: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    mRun-x64: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
    mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun-x64: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
    mRunOnce-x64: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe
    mRunOnce-x64: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe
    mRunOnce-x64: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]
    R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]
    R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]
    R2 rimspci;rimspci;C:\Windows\system32\DRIVERS\rimspe64.sys --> C:\Windows\system32\DRIVERS\rimspe64.sys [?]
    R2 risdpcie;risdpcie;C:\Windows\system32\DRIVERS\risdpe64.sys --> C:\Windows\system32\DRIVERS\risdpe64.sys [?]
    R2 rixdpcie;rixdpcie;C:\Windows\system32\DRIVERS\rixdpe64.sys --> C:\Windows\system32\DRIVERS\rixdpe64.sys [?]
    R3 Acceler;Accelerometer Service;C:\Windows\system32\DRIVERS\Acceler.sys --> C:\Windows\system32\DRIVERS\Acceler.sys [?]
    R3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]
    R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys --> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?]
    R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
    R3 Impcd;Impcd;C:\Windows\system32\DRIVERS\Impcd.sys --> C:\Windows\system32\DRIVERS\Impcd.sys [?]
    R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]
    R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]
    .
    =============== Created Last 30 ================
    .
    2011-08-14 19:43:30 -------- d-----w- C:\Users\Gareth\AppData\Roaming\Malwarebytes
    2011-08-14 19:43:20 41272 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    2011-08-14 19:43:19 -------- d-----w- C:\ProgramData\Malwarebytes
    2011-08-14 19:43:16 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2011-08-14 19:43:16 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2011-08-13 20:27:08 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
    2011-08-13 20:27:08 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
    2011-08-13 20:27:08 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
    2011-08-13 20:27:08 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
    2011-08-13 20:27:08 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
    2011-08-13 20:27:08 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
    2011-08-13 20:27:08 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll
    2011-08-12 19:45:51 -------- d-----w- C:\ProgramData\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
    2011-08-12 19:29:58 208896 ----a-w- C:\Windows\MBR.exe
    2011-08-12 19:29:55 98816 ----a-w- C:\Windows\sed.exe
    2011-08-12 19:29:55 518144 ----a-w- C:\Windows\SWREG.exe
    2011-08-12 19:29:55 256000 ----a-w- C:\Windows\PEV.exe
    2011-08-12 19:29:45 -------- d-s---w- C:\ComboFix
    2011-08-12 12:01:37 -------- d-----w- C:\Program Files (x86)\Veetle
    2011-08-11 11:30:40 338432 ----a-w- C:\Windows\System32\conhost.exe
    2011-08-10 20:23:44 -------- d-----w- C:\Program Files (x86)\ESET
    2011-08-09 22:09:40 -------- d-----w- C:\Restored
    2011-08-09 21:51:43 -------- d-----w- C:\Users\Gareth\AppData\Local\PackageAware
    2011-08-09 20:25:12 -------- d-----w- C:\Users\Gareth\AppData\Roaming\Registry Mechanic
    2011-08-09 20:18:13 880640 ----a-w- C:\Windows\SysWow64\UniBox10.ocx
    2011-08-09 20:18:13 506368 ----a-w- C:\Windows\SysWow64\msxml.dll
    2011-08-09 20:18:13 40408 ----a-w- C:\Windows\System32\CleanMFT64.exe
    2011-08-09 20:18:13 212992 ----a-w- C:\Windows\SysWow64\UniBoxVB12.ocx
    2011-08-09 20:18:13 1101824 ----a-w- C:\Windows\SysWow64\UniBox210.ocx
    2011-08-09 20:18:12 658432 ----a-w- C:\Windows\SysWow64\MSCOMCT2.OCX
    2011-08-09 20:18:12 1081616 ----a-w- C:\Windows\SysWow64\MSCOMCTL.OCX
    2011-08-09 20:18:05 -------- d-----w- C:\Program Files (x86)\Common Files\PC Tools
    2011-08-09 19:51:05 -------- d-----w- C:\Users\Gareth\AppData\Roaming\Roxio Log Files
    2011-08-09 15:15:53 55384 ----a-w- C:\Windows\System32\drivers\SBREDrv.sys
    2011-08-09 13:39:15 -------- d-----w- C:\Windows\pss
    2011-08-09 12:49:53 -------- d-----w- C:\Program Files (x86)\Amazon
    2011-08-04 14:32:01 -------- d-----w- C:\Users\Gareth\AppData\Local\doubleTwist Corporation
    2011-08-04 14:31:39 60273 ----a-w- C:\Windows\SysWow64\pthreadGC2.dll
    2011-08-04 14:31:39 57344 ----a-w- C:\Windows\SysWow64\ff_vfw.dll
    2011-08-04 14:31:38 -------- d-----w- C:\Program Files (x86)\ffdshow
    2011-07-23 18:55:42 -------- d-----w- C:\Program Files\iPod
    2011-07-23 18:55:41 -------- d-----w- C:\Program Files\iTunes
    2011-07-23 18:51:13 -------- d-----w- C:\Program Files\Bonjour
    2011-07-23 18:51:13 -------- d-----w- C:\Program Files (x86)\Bonjour
    2011-07-17 12:38:30 -------- d-----w- C:\Windows\System32\SPReview
    2011-07-17 12:25:26 -------- d-----w- C:\Windows\System32\EventProviders
    .
    ==================== Find3M ====================
    .
    2011-07-22 05:22:26 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
    2011-07-22 04:54:18 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2011-07-17 12:52:35 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
    2011-07-17 12:52:32 175616 ----a-w- C:\Windows\System32\msclmd.dll
    2011-07-16 05:41:50 362496 ----a-w- C:\Windows\System32\wow64win.dll
    2011-07-16 05:41:49 243200 ----a-w- C:\Windows\System32\wow64.dll
    2011-07-16 05:41:49 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
    2011-07-16 05:39:10 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
    2011-07-16 05:37:12 421888 ----a-w- C:\Windows\System32\KernelBase.dll
    2011-07-16 04:29:19 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
    2011-07-16 04:26:00 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
    2011-07-16 04:25:37 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
    2011-07-16 04:24:23 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
    2011-07-16 04:24:22 272384 ----a-w- C:\Windows\SysWow64\KernelBase.dll
    2011-07-16 02:21:44 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
    2011-07-16 02:21:41 2048 ----a-w- C:\Windows\SysWow64\user.exe
    2011-07-16 02:17:19 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
    2011-07-16 02:17:19 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
    2011-07-16 02:17:19 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
    2011-07-16 02:17:19 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
    2011-07-12 10:34:00 96104 ----a-w- C:\Windows\System32\dns-sd.exe
    2011-07-12 10:34:00 85864 ----a-w- C:\Windows\System32\dnssd.dll
    2011-07-12 10:34:00 61288 ----a-w- C:\Windows\System32\jdns_sd.dll
    2011-07-12 10:34:00 212840 ----a-w- C:\Windows\System32\dnssdX.dll
    2011-07-12 10:20:54 83816 ----a-w- C:\Windows\SysWow64\dns-sd.exe
    2011-07-12 10:20:54 73064 ----a-w- C:\Windows\SysWow64\dnssd.dll
    2011-07-12 10:20:54 50536 ----a-w- C:\Windows\SysWow64\jdns_sd.dll
    2011-07-12 10:20:54 178536 ----a-w- C:\Windows\SysWow64\dnssdX.dll
    2011-07-09 02:46:28 288768 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
    2011-07-05 17:37:00 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
    2011-07-05 17:37:00 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts
    2011-06-24 05:34:53 214528 ----a-w- C:\Windows\System32\winsrv.dll
    2011-06-23 05:43:12 5561216 ----a-w- C:\Windows\System32\ntoskrnl.exe
    2011-06-23 04:33:57 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2011-06-23 04:33:57 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2011-06-21 06:34:00 1923968 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2011-06-21 06:20:53 1188864 ----a-w- C:\Windows\System32\wininet.dll
    2011-06-21 05:28:33 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
    2011-06-15 10:02:23 212992 ----a-w- C:\Windows\System32\odbctrac.dll
    2011-06-15 10:02:23 163840 ----a-w- C:\Windows\System32\odbccp32.dll
    2011-06-15 10:02:23 106496 ----a-w- C:\Windows\System32\odbccu32.dll
    2011-06-15 10:02:23 106496 ----a-w- C:\Windows\System32\odbccr32.dll
    2011-06-15 08:55:19 86016 ----a-w- C:\Windows\SysWow64\odbccu32.dll
    2011-06-15 08:55:19 81920 ----a-w- C:\Windows\SysWow64\odbccr32.dll
    2011-06-15 08:55:19 319488 ----a-w- C:\Windows\SysWow64\odbcjt32.dll
    2011-06-15 08:55:19 163840 ----a-w- C:\Windows\SysWow64\odbctrac.dll
    2011-06-15 08:55:19 122880 ----a-w- C:\Windows\SysWow64\odbccp32.dll
    2011-06-11 03:07:25 3137536 ----a-w- C:\Windows\System32\win32k.sys
    2011-05-24 11:42:55 404480 ----a-w- C:\Windows\System32\umpnpmgr.dll
    2011-05-24 10:40:05 64512 ----a-w- C:\Windows\SysWow64\devobj.dll
    2011-05-24 10:40:05 44544 ----a-w- C:\Windows\SysWow64\devrtl.dll
    2011-05-24 10:39:38 145920 ----a-w- C:\Windows\SysWow64\cfgmgr32.dll
    2011-05-24 10:37:54 252928 ----a-w- C:\Windows\SysWow64\drvinst.exe
    .
    ============= FINISH: 21:44:47.06 ===============
     
  8. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    Attach.txt


    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-23.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 24/07/2010 13:28:13
    System Uptime: 14/08/2011 20:20:41 (1 hours ago)
    .
    Motherboard: Dell Inc. | | 0874P6
    Processor: Intel(R) Core(TM) i5 CPU M 520 @ 2.40GHz | U2E1 | 1176/133mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 218 GiB total, 86.509 GiB free.
    D: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP72: 26/07/2011 10:13:28 - Removed Dell DataSafe Online.
    RP73: 01/08/2011 11:22:50 - Removed 7digital Download Manager
    RP74: 09/08/2011 15:59:24 - Installed Ad-Aware
    RP75: 09/08/2011 16:00:21 - Installed Ad-Aware
    RP76: 09/08/2011 20:48:08 - Removed Ad-Aware
    RP77: 11/08/2011 18:05:25 - Windows Update
    .
    ==== Installed Programs ======================
    .
    ABBYY FineReader 6.0 Sprint
    Accelerometer
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Reader 9.3.4
    Advanced Audio FX Engine
    Amazon MP3 Downloader 1.0.9
    Apple Application Support
    Apple Software Update
    ATI Catalyst Control Center
    Audacity 1.2.6
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    ccc-core-static
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    Cisco EAP-FAST Module
    Cisco LEAP Module
    Cisco PEAP Module
    Dell DataSafe Local Backup
    Dell DataSafe Local Backup - Support Software
    Dell Dock
    Dell Getting Started Guide
    Dell Support Center (Support Software)
    Dell Webcam Central
    ESET Online Scanner v3
    ffdshow [rev 2527] [2008-12-19]
    Google Chrome
    Intel(R) Management Engine Components
    Java Auto Updater
    Java(TM) 6 Update 26
    Junk Mail filter update
    Last.fm 1.5.4.27091
    LastPass (uninstall only)
    Live! Cam Avatar Creator
    Malwarebytes' Anti-Malware version 1.51.1.1800
    McAfee SecurityCenter
    Microsoft Choice Guard
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Sync Framework Runtime Native v1.0 (x86)
    Microsoft Sync Framework Services Native v1.0 (x86)
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    MSVCRT
    QuickTime
    Registry Mechanic 10.0
    Safari
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Sid Meier's Civilization V
    Skins
    Skype Toolbars
    Skype™ 5.3
    SopCast 3.2.9
    Spotify
    Steam
    Veetle TV
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Mail
    Windows Live Messenger
    Windows Live Movie Maker
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Toolbar
    Windows Live Upload Tool
    Windows Live Writer
    WinRAR 4.01 (32-bit)
    WinZip 15.0
    .
    ==== Event Viewer Messages From Past Week ========
    .
    14/08/2011 20:30:00, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
    14/08/2011 20:21:12, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the lxebCATSCustConnectService service to connect.
    14/08/2011 20:21:12, Error: Service Control Manager [7000] - The lxebCATSCustConnectService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    13/08/2011 19:49:49, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    13/08/2011 19:49:10, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
    13/08/2011 19:49:10, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/08/2011 21:16:17, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.2.3. The computer with the IP address 192.168.2.6 did not allow the name to be claimed by this computer.
    12/08/2011 20:46:25, Error: bowser [8003] - The master browser has received a server announcement from the computer MOTHERSHIP that believes that it is the master browser for the domain on transport NetBT_Tcpip_{FB144808-DFB7-45E5-917E-8C9A0144FE41}. The master browser is stopping or an election is being forced.
    08/08/2011 21:10:15, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the mfevtp service.
    08/08/2011 19:07:07, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the PlugPlay service.
    07/08/2011 00:49:11, Error: Service Control Manager [7034] - The McAfee Scanner service terminated unexpectedly. It has done this 1 time(s).
    .
    ==== End Of File ===========================
     
  9. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    I think I've complied with all the steps that are necessary, let me know if you need anything else.
     
  10. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Please uninstall any of the scanning/cleaning programs you ran previously. Leave DDS, GMER and Mbam.

    Please note: If you have previously run Combofix and it's still on the system, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    --------------------------------------
    Download Combofix from HERE or HERE and save to the desktop
    • Double click combofix.exe & follow the prompts.
    • ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Once installed, you should see a blue screen prompt that says:
      The Recovery Console was successfully installed.
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.

    Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    Note 2: ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    Note 3: Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    Note 4: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    Note 5: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart computer to fix the issue.
    ===================================
    Then run this online vorus scan:
    • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESETOnlineScan
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      [o] Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
      [o] Double click on the [​IMG]on your desktop.
    • Check 'Yes I accept terms of use.'
    • Click Start button
    • Accept any security warnings from your browser.
      [​IMG]
    • Uncheck 'Remove found threats'
    • Check 'Scan archives/
    • Leave remaining settings as is.
    • Press the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    • When the scan completes, press List of found threats
    • Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    • Push the Back button
    • Push Finish

    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.

    Logs in next reply please.
     
  11. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    combofix.txt


    ComboFix 11-08-18.03 - Gareth 19/08/2011 15:10:19.1.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.1973.578 [GMT 1:00]
    Running from: c:\users\Gareth\Desktop\ComboFix.exe
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-07-19 to 2011-08-19 )))))))))))))))))))))))))))))))
    .
    .
    2011-08-19 14:15 . 2011-08-19 14:15 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-08-19 14:00 . 2011-08-16 07:48 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{29E6481D-2041-446F-8952-13A7C1BB9AA2}\mpengine.dll
    2011-08-19 14:00 . 2011-05-24 18:14 270720 ------w- c:\windows\system32\MpSigStub.exe
    2011-08-14 19:43 . 2011-08-14 19:43 -------- d-----w- c:\users\Gareth\AppData\Roaming\Malwarebytes
    2011-08-14 19:43 . 2011-08-14 19:43 -------- d-----w- c:\programdata\Malwarebytes
    2011-08-14 19:43 . 2011-07-06 18:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-08-13 20:27 . 2011-08-13 20:27 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
    2011-08-13 20:27 . 2011-08-13 20:27 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
    2011-08-13 20:27 . 2011-08-13 20:27 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
    2011-08-13 20:27 . 2011-08-13 20:27 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
    2011-08-13 20:27 . 2011-08-13 20:27 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
    2011-08-13 20:27 . 2011-08-13 20:27 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
    2011-08-13 20:27 . 2011-08-13 20:27 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
    2011-08-13 20:26 . 2011-08-13 20:27 -------- d-----w- c:\program files (x86)\QuickTime
    2011-08-12 19:45 . 2011-08-12 19:45 -------- d-----w- c:\programdata\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
    2011-08-12 12:01 . 2011-08-12 12:01 -------- d-----w- c:\program files (x86)\Veetle
    2011-08-09 22:09 . 2011-08-09 22:10 -------- d-----w- C:\Restored
    2011-08-09 21:51 . 2011-08-09 21:51 -------- d-----w- c:\users\Gareth\AppData\Local\PackageAware
    2011-08-09 20:25 . 2011-08-09 20:28 -------- d-----w- c:\users\Gareth\AppData\Roaming\Registry Mechanic
    2011-08-09 19:51 . 2011-08-09 19:51 -------- d-----w- c:\users\Gareth\AppData\Roaming\Roxio Log Files
    2011-08-09 15:15 . 2011-08-09 15:15 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2011-08-09 15:01 . 2011-08-09 19:49 -------- d-----w- c:\programdata\Lavasoft
    2011-08-09 12:50 . 2011-08-09 12:50 -------- d-----w- c:\users\Gareth\AppData\Roaming\Amazon
    2011-08-09 12:49 . 2011-08-09 12:49 -------- d-----w- c:\program files (x86)\Amazon
    2011-08-04 14:32 . 2011-08-04 14:32 -------- d-----w- c:\users\Gareth\AppData\Local\doubleTwist Corporation
    2011-08-04 14:31 . 2008-12-17 18:22 57344 ----a-w- c:\windows\SysWow64\ff_vfw.dll
    2011-08-04 14:31 . 2008-12-11 12:26 60273 ----a-w- c:\windows\SysWow64\pthreadGC2.dll
    2011-08-04 14:31 . 2011-08-09 19:45 -------- d-----w- c:\program files (x86)\ffdshow
    2011-07-23 18:55 . 2011-07-23 18:55 -------- d-----w- c:\program files\iPod
    2011-07-23 18:55 . 2011-07-23 18:56 -------- d-----w- c:\program files\iTunes
    2011-07-23 18:51 . 2011-07-23 18:51 -------- d-----w- c:\program files\Bonjour
    2011-07-23 18:51 . 2011-07-23 18:51 -------- d-----w- c:\program files (x86)\Bonjour
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-07-17 12:52 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
    2011-07-17 12:52 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
    2011-07-16 04:26 . 2011-08-11 11:30 44032 ----a-w- c:\windows\apppatch\acwow64.dll
    2011-07-12 10:34 . 2011-07-12 10:34 96104 ----a-w- c:\windows\system32\dns-sd.exe
    2011-07-12 10:34 . 2011-07-12 10:34 85864 ----a-w- c:\windows\system32\dnssd.dll
    2011-07-12 10:34 . 2011-07-12 10:34 61288 ----a-w- c:\windows\system32\jdns_sd.dll
    2011-07-12 10:34 . 2011-07-12 10:34 212840 ----a-w- c:\windows\system32\dnssdX.dll
    2011-07-12 10:20 . 2011-07-12 10:20 83816 ----a-w- c:\windows\SysWow64\dns-sd.exe
    2011-07-12 10:20 . 2011-07-12 10:20 73064 ----a-w- c:\windows\SysWow64\dnssd.dll
    2011-07-12 10:20 . 2011-07-12 10:20 50536 ----a-w- c:\windows\SysWow64\jdns_sd.dll
    2011-07-12 10:20 . 2011-07-12 10:20 178536 ----a-w- c:\windows\SysWow64\dnssdX.dll
    2011-07-07 11:33 . 2010-08-25 20:40 2301208 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
    2011-07-07 11:33 . 2010-08-25 20:40 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
    2011-07-05 17:37 . 2011-07-05 17:37 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
    2011-07-05 17:37 . 2011-07-05 17:37 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
    2011-06-25 19:24 . 2010-09-24 11:40 2588952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
    2011-06-25 19:23 . 2010-09-24 11:39 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
    2011-06-11 03:07 . 2011-07-13 12:33 3137536 ----a-w- c:\windows\system32\win32k.sys
    2011-05-24 11:42 . 2011-06-29 10:26 404480 ----a-w- c:\windows\system32\umpnpmgr.dll
    2011-05-24 10:40 . 2011-06-29 10:26 64512 ----a-w- c:\windows\SysWow64\devobj.dll
    2011-05-24 10:40 . 2011-06-29 10:26 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
    2011-05-24 10:39 . 2011-06-29 10:26 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
    2011-05-24 10:37 . 2011-06-29 10:26 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-18 98304]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-07-19 421736]
    "DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
    "Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-07-05 421888]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
    "Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2010-02-11 165184]
    .
    c:\users\Gareth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    7digital Download Manager.lnk - c:\program files (x86)\7digital Download Manager\7digital Download Manager.exe [N/A]
    .
    c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-16 1324384]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux2"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 lxebCATSCustConnectService;lxebCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [2010-04-14 45736]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    S0 stdflt;Disk Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdflt.sys [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe [2009-03-02 89600]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
    S2 InstallFilterService;FF Install Filter Service;c:\program files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe [2009-06-23 60928]
    S2 lxeb_device;lxeb_device;c:\windows\system32\lxebcoms.exe [2010-04-14 1052328]
    S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe64.sys [x]
    S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys [x]
    S2 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe64.sys [x]
    S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-02-11 660800]
    S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
    S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
    S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Acceler.sys [x]
    S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
    S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
    S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-08-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1821194049-20054611-3402435326-1001Core.job
    - c:\users\Gareth\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-24 12:42]
    .
    2011-08-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1821194049-20054611-3402435326-1001UA.job
    - c:\users\Gareth\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-24 12:42]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-01-20 487424]
    "QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2010-04-02 3217056]
    "lxebmon.exe"="c:\program files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe" [2011-01-23 770728]
    "FreeFallProtection"="c:\program files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe" [2009-07-22 2384896]
    "EzPrint"="c:\program files (x86)\Lexmark Pro200-S500 Series\ezprint.exe" [2011-01-23 148280]
    "Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2009-12-16 5470208]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    IE: LastPass - file://c:\program files (x86)\LastPass\context.html?cmd=lastpass
    IE: LastPass Fill Forms - file://c:\program files (x86)\LastPass\context.html?cmd=fillforms
    TCP: DhcpNameServer = 192.168.2.1
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    Toolbar-Locked - (no file)
    ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
    AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}\bm_installer.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files (x86)\Bonjour\mDNSResponder.exe
    c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exe
    c:\program files (x86)\Dell Support Center\bin\sprtsvc.exe
    .
    **************************************************************************
    .
    Completion time: 2011-08-19 15:22:59 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-08-19 14:22
    .
    Pre-Run: 96,983,969,792 bytes free
    Post-Run: 96,822,329,344 bytes free
    .
    - - End Of File - - 769A3F5CD85E8441784161649C6F6F89
     
  12. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    ESETScan.txt


    C:\Users\Gareth\Downloads\registryboosterplc.exe Win32/RegistryBooster application
     
  13. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    I recommend that you uninstall and stop using registry cleaners like Registry Mechanic and Registry Booster. We don't recommend these cleaners to anyone and more harm can be done removing processes than any benefit gained'

    For the Eset entry:
    Please download OTMovit by Old Timer and save to your desktop.
    • Double-click OTMoveIt3.exe to run it. (Vista users, please right click on OTMoveit3.exe and select "Run as an Administrator")
    • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
      Code:
      :
      :Files 
      C:\Users\Gareth\Downloads\registryboosterplc.exe
      :Commands
      [purity]
      [emptytemp]
      [start explorer]
      [Reboot]
    • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window and choose Paste.
    • Click the red Moveit! button.
    • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
    • Close OTMoveIt3
    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
    ======================================
    About Windows Explorer:
    • Windows Explorer is a file manager application.
    • It provides a graphical user interface for accessing the file systems.
    • It's the component of the operating system that presents many user interface items on the monitor such as the taskbar and desktop.
    • Controlling the computer is possible without Windows Explorer running
      it is sometimes referred to as the Windows Shell

    While malware can hide behind the name of almost any file, deleting an entry wehn you don't know if it's the legitimate entry or malware is not recommended.
    ========================================
    You had already noticed the computer had been 'sluggish' for several weeks, yet you added these:
    And you also installed new programs:
    All of the following are running now:
    None of the above need to be running unless you are actively using them.
    =================================
    None of the following need to start on boot and run in the background:
    Most of the above are auto-updaters.
    =====================================
    Using the msconfig utility to stop processes from starting on boot.
    • Click on the Windows 7 start icon in the bottom left corner of your screen.
    • Type MSCONFIG in the search box> press enter or double-click on the MSCONFIG program that appears in the search results.
      [​IMG]
    • Click on Selective Startup
    • Click on the Startup tab. You will now see the System Msconfig Utility
      [​IMG]

      Windows 7 loads almost all of Windows' essential programs are loaded through Windows Services. So most of the startup items you see here are optional and can be turned off.
      Important! When in doubt, leave it on-or- use a Startup database to identify a process you are not sure of.
    • Uncheck any process you don't want to start on boot.
    • When finished> click on OK
      Reboot the computer.
    • When you see this message come up: Check 'don't show this message again'> then Restart.
    [​IMG]
    Images courtesy NetSquirrel

    The only processes that need to start on boot are the antivirus program, third party firewall if you have one, touchpad if on laptop and network processes if using third party software for network. Any other entries in this section can be Unchecked.

    This does not remove a process or program- it can still be accessed when needed through All Programs. And you can go back at a later time and reset the default programs if needed.
     
  14. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    OTM Log:


    All processes killed
    Error: Unable to interpret <:> in the current context!
    ========== FILES ==========
    C:\Users\Gareth\Downloads\registryboosterplc.exe moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 56468 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Gareth
    ->Temp folder emptied: 112673167 bytes
    ->Temporary Internet Files folder emptied: 9755974 bytes
    ->Java cache emptied: 1150396 bytes
    ->Google Chrome cache emptied: 369951020 bytes
    ->Flash cache emptied: 78009 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 1544 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50467 bytes
    RecycleBin emptied: 477046611 bytes

    Total Files Cleaned = 926.00 mb


    OTM by OldTimer - Version 3.1.18.0 log created on 08202011_200951

    Files moved on Reboot...
    C:\Users\Gareth\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
    C:\Windows\temp\FXSAPIDebugLogFile.txt moved successfully.
    C:\Windows\temp\FXSTIFFDebugLogFile.txt moved successfully.

    Registry entries deleted on Reboot...
     
  15. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    OK. I removed Registry Mechanic and Registry Booster. I ran the Old timer software, the log post is the previous reply to this.

    You then state that some (processes) are running now. I assume that you mean processes. Do you mean running at the time of the scans that you are reading? I have looked in task manager, and I cannot see that any of the processes are still running.

    I have disabled a number of services from startup with the msconfig utility, although some of the ones that you suggested to disable were not on my list.

    The computer rebooted just fine, but that pesky process is still using an enormous amount of memory. I have attached a screenshot of my task manager to show you:
     

    Attached Files:

  16. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    But we have to find what's broken- if anything- and then try to fix it. If this becomes an obsession to you and you continue on the path you started trying to 'fix' this, you are going to upset the stability of the system. I agree, it does appear to be excessive memory usage.

    On the thread you mentioned you had followed, Combofix found and fixed:
    Your log did not show any of this. And that member did not complete the thread.

    So while you may both have been experiencing problems related to explorer.exe, the cause did not appear to be the same. This is a good example why you should not follow instructions given to another user.
    ===============================================
    One other thing I'd like to clarify> you are using the terms processes and Services interchangeably. They are not the same:For instance, the process, svchost.exe is an executable to starts some of the Services, When you run the msconfig utility, you are adding or removing processes from the Startup Menu. Although there is a Service tab on that screen, Services should be dealt with in the MMC Module by using:
    Start> Run> typing in services.msc> Enter and changing Startup Types there or Start or Stop Services. This makes it easier to check the Dependencies that may need to be running in order for a particular service to run.
    ======================================
    I would like to point out that OTM did this: Total Files Cleaned = 926.00 mb That is a huge amount of files. And it indicates that you might not be performing adequate or frequent enough maintenance on the system.
    ======================================
    I mentioned this previously, but you did not address it:
    Please go to Tools> Manage Addons and remove all of these. They are all for QuickTime Player and can be a virus. The following is description of one of the 7 entries.
    NPQTPLUGIN7.DLL has been seen to perform the following behavior:
    * Uses rootkit techniques to conceal its presence, interrogation or removal
    * Uses low level functions to hide itself from the user and from system/security processes
    NPQTPLUGIN7.DLL has been the subject of the following behavior
    * Created as a process on disk
    * Deleted as a process from disk
    * Created as a new Background Service on the machine
    * Executed from Temporary Folders
    Source Gratis.
    ===================================
    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap> and copy/paste the text in the code below into it:
    Code:
    File::
    FileLook::
    C:\Windows\Explorer.EXE
    C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll
    C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe
    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste into to your next reply.
    ====================
    These are the executables that are running now for each of these programs. They are files or processes whichever you prefer, for the programs.
    ====================================
    Please open the Task Manager> Processes tab> View> Set Columns> Check PID (Process Identifier). Next time you reboot, open the Task Manager> note PID for explorer.exe and tll me what it is.
     
  17. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    Hi Bobbye,

    Can I just take this opportunity to say thank you for the time that you are taking to help me with this problem; it is much appreciated.

    Please believe that I am not trying to put my system in jeopardy by obsessively trying to fix this problem. I am merely determined to fix it on my own, and without the help of others (except you) because I want to understand and become more knowledgeable about Windows 7 in the process.

    I understand now that I shouldn't have attempted to use somebody else's solution to fix my own problem; this was foolish of me. Any attempts that I made were to try and demonstrate that I used some of my own initiative in trying to solve this problem, rather than just post something here and demand help.

    When I ran Combofix (on the previous thread), Combofix didn't appear to run correctly, so I think it is safe to assume that it did not perform any actions that it did on that previous thread.

    I would say that I probably haven't been taking enough time to perform regular maintenance of this laptop. I intend that to change, and any help that you can provide me on what I should be doing on a regular basis would be greatly appreciated.

    You mention these plug-ins:

    I can see the date that is listed with the entry, but I really don't remember installing these, and I don't think I've ever personally installed QuickTime. These entries seem to relate to Internet Explorer; I never use Internet Explorer, only Chrome. In any case, I opened Internet Explorer and went into Manage Add-Ons. I can't even find the add-ons to remove them. I've attached a screen-shot to show you what I mean. If I'm being stupid somehow, I'm sorry.

    I'm extremely puzzled by this, I've just searched my entire computer for npqtplugin7.dll. It is found at the following locations:

    C:\Program Files (x86)\Internet Explorer\Plugins
    C:\Program Files (x86)\QuickTime\Plugins

    Like I say, I don't understand this. Should I continue with your next step or not? Might I add that I have never even opened Internet Explorer before today.

    Gareth
     

    Attached Files:

  18. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    I am very glad to help and your thanks is also greatly appreciated. Sometimes members expect magic for free and don't realize how time consuming a cleaning can be.

    About this:
    It is best to let someone help you with the cleaning. But it can also be a learning process for you. Some of the malware coming out now is really tough to remove and we have to find it, know what it is and what is the best way to remove it.

    You are not deficient in any way if to can't do this on your own. And in fact, malware is protective of itself and may hide even deeper if random scans are thrown at it.
    ====================================
    Thanks for checking on the QT Addons. You are not the first user to have this, nor the first who didn't intentionally load them. As of yet, I have not been able to determine the source of these addons. I'll removed them with the script you run in Combofix.

    As for QuickTime, it's a media player bundled with Apply software.
    1. And here's when you got them all:
    2011-07-23 18:55:42 -------- d-----w- C:\Program Files\iPod
    2011-07-23 18:55:41 -------- d-----w- C:\Program Files\iTunes
    2011-07-23 18:51:13 -------- d-----w- C:\Program Files\Bonjour
    2011-07-23 18:51:13 -------- d-----w- C:\Program Files (x86)\Bonjour
    2011-07-05 17:37:00 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
    2011-07-05 17:37:00 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts
    ---------------------------------
    2. It runs many processes:
    ;mRun: iTunesHelper] "C:\Program Files (x86)iTunessiTunesHelper.exe"<< auto-updater
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -at boot time<< auto-udater
    mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime<< auto-updater
    -----------------------------
    You can uninstall QUICK TIME like this: >> but you may not be able to use the processes that run it:
    1. Use msconfig to UNCHECK any QuickTime entries on Startup> Apply> OK
    2. Disable tray icon: Right-click on the icon and select QuickTime Preferences > BrowserPluginn. Clear the check box next to QuickTimee system tray icon," and then close the settings box. The icon won't appear anymore.
    3. Rename the qttask.exe file:
    Right click on Start> Explore> Programs>QuickTime directory> right click on qttask.exe> rename to qttask.exeold. <<<this is right
    DisableQuickTime:[/B]
    • OpenQuickTime.
    • Click Edit> Preferences> click QuickTime Preferences.
    • Now use the drop down box to adjust Preferences.
    • You need to disable (usually uncheck) all boxes related to Auto Updates,
      Tray Icon, other Automatic features, etc.
    • Close the window when you are done.
    • Close QuickTime.

    The processes can be stopped, the plug ins can be removed, the player can be uninstalled, but it's your choice if you still use iTuness and related products.

    Note: The Google Spell checker parsed some of the entries and added an extra letter to the end of the work. I think I've remove all, but if you see an eexe or exee, know I missed that one!
     
  19. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    Well Bobbye,

    I am in this for the long-haul, until this problem is fixed. I might learn something along the way, which will be good.

    QuickTime has added itself with something along the way, but I never use it. I don't understand the dates though, I certainly haven't installed any Apple products recently - the July date makes no sense to me at all. QuickTime is still on my machine.

    I used msconfig but none of the QuickTime entries needed unchecking, and QuickTime is NOT active in my system tray. I renamed the qttask.exe file as directed. I have now uninstalled QuickTime completely, as I never use the software.

    I have then run the CFScript file in ComboFix; the results are in the next post.
     
  20. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    ComboFix 11-08-26.04 - Gareth 26/08/2011 20:42:15.2.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.1973.597 [GMT 1:00]
    Running from: c:\users\Gareth\Desktop\ComboFix.exe
    Command switches used :: c:\users\Gareth\Desktop\CFScript.txt
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-07-26 to 2011-08-26 )))))))))))))))))))))))))))))))
    .
    .
    2011-08-19 14:00 . 2011-08-16 07:48 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{29E6481D-2041-446F-8952-13A7C1BB9AA2}\mpengine.dll
    2011-08-19 14:00 . 2011-05-24 18:14 270720 ------w- c:\windows\system32\MpSigStub.exe
    2011-08-14 19:43 . 2011-08-14 19:43 -------- d-----w- c:\users\Gareth\AppData\Roaming\Malwarebytes
    2011-08-14 19:43 . 2011-08-14 19:43 -------- d-----w- c:\programdata\Malwarebytes
    2011-08-14 19:43 . 2011-07-06 18:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-08-13 20:26 . 2011-08-26 19:13 -------- d-----w- c:\program files (x86)\QuickTime
    2011-08-12 19:45 . 2011-08-12 19:45 -------- d-----w- c:\programdata\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
    2011-08-12 12:01 . 2011-08-12 12:01 -------- d-----w- c:\program files (x86)\Veetle
    2011-08-09 22:09 . 2011-08-09 22:10 -------- d-----w- C:\Restored
    2011-08-09 21:51 . 2011-08-09 21:51 -------- d-----w- c:\users\Gareth\AppData\Local\PackageAware
    2011-08-09 20:25 . 2011-08-09 20:28 -------- d-----w- c:\users\Gareth\AppData\Roaming\Registry Mechanic
    2011-08-09 19:51 . 2011-08-09 19:51 -------- d-----w- c:\users\Gareth\AppData\Roaming\Roxio Log Files
    2011-08-09 15:15 . 2011-08-09 15:15 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2011-08-09 15:01 . 2011-08-09 19:49 -------- d-----w- c:\programdata\Lavasoft
    2011-08-09 12:50 . 2011-08-09 12:50 -------- d-----w- c:\users\Gareth\AppData\Roaming\Amazon
    2011-08-09 12:49 . 2011-08-09 12:49 -------- d-----w- c:\program files (x86)\Amazon
    2011-08-04 14:32 . 2011-08-04 14:32 -------- d-----w- c:\users\Gareth\AppData\Local\doubleTwist Corporation
    2011-08-04 14:31 . 2008-12-17 18:22 57344 ----a-w- c:\windows\SysWow64\ff_vfw.dll
    2011-08-04 14:31 . 2008-12-11 12:26 60273 ----a-w- c:\windows\SysWow64\pthreadGC2.dll
    2011-08-04 14:31 . 2011-08-09 19:45 -------- d-----w- c:\program files (x86)\ffdshow
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-07-17 12:52 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
    2011-07-17 12:52 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
    2011-07-16 04:26 . 2011-08-11 11:30 44032 ----a-w- c:\windows\apppatch\acwow64.dll
    2011-07-12 10:34 . 2011-07-12 10:34 96104 ----a-w- c:\windows\system32\dns-sd.exe
    2011-07-12 10:34 . 2011-07-12 10:34 85864 ----a-w- c:\windows\system32\dnssd.dll
    2011-07-12 10:34 . 2011-07-12 10:34 61288 ----a-w- c:\windows\system32\jdns_sd.dll
    2011-07-12 10:34 . 2011-07-12 10:34 212840 ----a-w- c:\windows\system32\dnssdX.dll
    2011-07-12 10:20 . 2011-07-12 10:20 83816 ----a-w- c:\windows\SysWow64\dns-sd.exe
    2011-07-12 10:20 . 2011-07-12 10:20 73064 ----a-w- c:\windows\SysWow64\dnssd.dll
    2011-07-12 10:20 . 2011-07-12 10:20 50536 ----a-w- c:\windows\SysWow64\jdns_sd.dll
    2011-07-12 10:20 . 2011-07-12 10:20 178536 ----a-w- c:\windows\SysWow64\dnssdX.dll
    2011-07-07 11:33 . 2010-08-25 20:40 2301208 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
    2011-07-07 11:33 . 2010-08-25 20:40 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
    2011-06-25 19:24 . 2010-09-24 11:40 2588952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
    2011-06-25 19:23 . 2010-09-24 11:39 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
    2011-06-11 03:07 . 2011-07-13 12:33 3137536 ----a-w- c:\windows\system32\win32k.sys
    .
    .
    (((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    --- c:\windows\Explorer.EXE ---
    Company: Microsoft Corporation
    File Description: Windows Explorer
    File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
    Product Name: Microsoft® Windows® Operating System
    Copyright: © Microsoft Corporation. All rights reserved.
    Original Filename: EXPLORER.EXE.MUI
    File size: 2871808
    Created time: 2011-04-28 13:47
    Modified time: 2011-02-25 06:19
    MD5: 332FEAB1435662FC6C672E25BEB37BE3
    SHA1: 5A49D7390EE87519B9D69D3E4AA66CA066CC8255
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2011-08-19_14.18.26 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-07-14 04:54 . 2011-08-26 16:34 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-07-14 04:54 . 2011-08-19 14:17 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-07-14 04:54 . 2011-08-19 14:17 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-07-14 04:54 . 2011-08-26 16:34 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2011-08-19 14:17 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:54 . 2011-08-26 16:34 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2010-07-16 02:59 . 2011-08-25 09:31 44706 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2011-08-26 16:32 30258 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2010-07-24 15:33 . 2011-08-26 16:32 10794 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1821194049-20054611-3402435326-1001_UserData.bin
    - 2009-07-14 05:30 . 2011-07-17 13:40 86016 c:\windows\system32\DriverStore\infpub.dat
    + 2009-07-14 05:30 . 2011-08-26 19:34 86016 c:\windows\system32\DriverStore\infpub.dat
    - 2010-07-24 12:25 . 2011-08-19 13:14 49152 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2010-07-24 12:25 . 2011-08-26 17:53 49152 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2010-07-24 12:25 . 2011-08-19 13:14 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2010-07-24 12:25 . 2011-08-26 17:53 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2011-08-19 13:14 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:54 . 2011-08-26 17:53 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2011-06-21 12:24 . 2010-11-20 13:25 49664 c:\windows\servicing\GC64\tzupd.exe
    + 2011-08-25 09:42 . 2011-07-09 05:29 49664 c:\windows\servicing\GC64\tzupd.exe
    - 2010-07-24 12:29 . 2011-08-19 13:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2010-07-24 12:29 . 2011-08-26 16:35 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-07-14 04:46 . 2011-08-26 16:38 91680 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
    + 2010-07-24 12:29 . 2011-08-26 16:35 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2010-07-24 12:29 . 2011-08-19 13:43 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2010-07-24 12:29 . 2011-08-26 16:35 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2010-07-24 12:29 . 2011-08-19 13:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2010-07-24 12:29 . 2011-08-26 19:08 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2010-07-24 12:29 . 2011-08-19 14:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2010-07-24 12:29 . 2011-08-26 19:08 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2010-07-24 12:29 . 2011-08-19 14:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2011-08-25 09:42 . 2011-07-09 04:29 2048 c:\windows\SysWOW64\tzres.dll
    - 2011-06-21 12:23 . 2010-11-20 12:07 2048 c:\windows\SysWOW64\tzres.dll
    + 2011-08-25 09:42 . 2011-07-09 05:26 2048 c:\windows\system32\tzres.dll
    - 2011-06-21 12:23 . 2010-11-20 13:15 2048 c:\windows\system32\tzres.dll
    + 2011-08-26 19:51 . 2011-08-26 19:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2011-08-19 14:17 . 2011-08-19 14:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2011-08-19 14:17 . 2011-08-19 14:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2011-08-26 19:51 . 2011-08-26 19:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2009-07-14 05:30 . 2011-07-17 13:40 143360 c:\windows\system32\DriverStore\infstrng.dat
    + 2009-07-14 05:30 . 2011-08-26 19:34 143360 c:\windows\system32\DriverStore\infstrng.dat
    - 2009-07-14 05:30 . 2011-07-17 13:40 143360 c:\windows\system32\DriverStore\infstor.dat
    + 2009-07-14 05:30 . 2011-08-26 19:34 143360 c:\windows\system32\DriverStore\infstor.dat
    - 2009-07-14 05:01 . 2011-08-19 14:16 228720 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2009-07-14 05:01 . 2011-08-26 19:49 228720 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    - 2009-07-14 04:45 . 2011-08-12 09:41 7114300 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
    + 2009-07-14 04:45 . 2011-08-26 16:37 7114300 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
    - 2009-07-14 02:34 . 2011-08-12 09:19 10747904 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
    + 2009-07-14 02:34 . 2011-08-25 21:40 10747904 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
    "dellsupportcenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
    "Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2010-02-11 165184]
    .
    c:\users\Gareth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    7digital Download Manager.lnk - c:\program files (x86)\7digital Download Manager\7digital Download Manager.exe [N/A]
    .
    c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-16 1324384]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux2"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    R2 0178781314376275mcinstcleanup;McAfee Application Installer Cleanup (0178781314376275);c:\windows\TEMP\017878~1.EXE [x]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 lxebCATSCustConnectService;lxebCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [2010-04-14 45736]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    S0 stdflt;Disk Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdflt.sys [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe [2009-03-02 89600]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
    S2 InstallFilterService;FF Install Filter Service;c:\program files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe [2009-06-23 60928]
    S2 lxeb_device;lxeb_device;c:\windows\system32\lxebcoms.exe [2010-04-14 1052328]
    S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\McSACore.exe [2011-02-16 101048]
    S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe64.sys [x]
    S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys [x]
    S2 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe64.sys [x]
    S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-02-11 660800]
    S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
    S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
    S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Acceler.sys [x]
    S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
    S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
    S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-08-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1821194049-20054611-3402435326-1001Core.job
    - c:\users\Gareth\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-24 12:42]
    .
    2011-08-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1821194049-20054611-3402435326-1001UA.job
    - c:\users\Gareth\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-24 12:42]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-01-20 487424]
    "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
    "lxebmon.exe"="c:\program files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe" [2011-01-23 770728]
    "FreeFallProtection"="c:\program files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe" [2009-07-22 2384896]
    "EzPrint"="c:\program files (x86)\Lexmark Pro200-S500 Series\ezprint.exe" [2011-01-23 148280]
    "Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2009-12-16 5470208]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    IE: LastPass - file://c:\program files (x86)\LastPass\context.html?cmd=lastpass
    IE: LastPass Fill Forms - file://c:\program files (x86)\LastPass\context.html?cmd=fillforms
    TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
    "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files (x86)\Bonjour\mDNSResponder.exe
    c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    c:\windows\SysWOW64\rundll32.exe
    c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exe
    c:\program files (x86)\Dell Support Center\bin\sprtsvc.exe
    .
    **************************************************************************
    .
    Completion time: 2011-08-26 20:56:10 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-08-26 19:56
    ComboFix2.txt 2011-08-19 14:23
    .
    Pre-Run: 94,304,923,648 bytes free
    Post-Run: 94,287,159,296 bytes free
    .
    - - End Of File - - 9D5EFCFF2EB2CC1B5A19BFCDC8676389
     
  21. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    PID for explorer.exe is 2656
     
  22. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    No info on it? Was the memory for it high? Was there only 1 explorer.exe running?

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2

    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      Code:
      
      :filefind
      exlorer.exe
      
      
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
     
  23. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    There is only one version of explorer.exe running. It is currently running at 210MB, but this varies, and it can run as high as 450MB. I can still use the machine at these levels, but it is definitely having an impact on performance.

    Here are the contents of the SystemLook scan:

    It doesn't look like the scan worked. Is there a 64-Bit version that I should be using?
     
  24. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    It turns out that you need QuickTime to be able to run iTunes, so I've had to re-install it.
     
  25. electrophile888

    electrophile888 TS Rookie Topic Starter Posts: 21

    Hey, I just checked task manager again, and there is another explorer.exe running (2 total). It's running at 30MB and the PID is 4532.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...