TechSpot

Help with Malware removal (Followed 6 steps)

Solved
By indierinrin
Jun 6, 2011
Topic Status:
Not open for further replies.
  1. Hi!
    I have been having a hard time removing the malware on my computer. I work from home and it involves a lot of research and searching through google. When it constantly redirects to spam webpages, my work suffers and I lose the pages I tried to open.

    Your help is very much appreciated. I tried to read through all the rules and steps and I apologize if I did anything wrong.

    Here are my logs (I removed the trojan horse via Malwarebytes) :

    1. Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6763

    Windows 6.1.7600
    Internet Explorer 8.0.7600.16385

    03/06/2011 12:53:45 PM
    mbam-log-2011-06-03 (12-53-45).txt

    Scan type: Quick scan
    Objects scanned: 174074
    Time elapsed: 11 minute(s), 8 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 1
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Grusukohomaloka (Trojan.Agent.U) -> Value: Grusukohomaloka -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
    --------------------------------------
    2. GMER (I think this may not be complete but I don't know how to get the full log)

    GMER 1.0.15.15640 - http://www.gmer.net
    Rootkit scan 2011-06-06 17:02:14
    Windows 6.1.7600
    Running: 2tsp7y4f.exe


    ---- Files - GMER 1.0.15 ----

    File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00ADE.log 1048576 bytes
    File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00ADF.log 1048576 bytes
    File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00AE0.log 0 bytes

    ---- EOF - GMER 1.0.15 ----

    --------------------------------------------
    3. DDS
    .
    DDS (Ver_2011-06-03.01) - NTFSAMD64
    Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24
    Run by Corinne at 17:06:38 on 2011-06-06
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.4095.1849 [GMT -4:00]
    .
    AV: BitDefender Antivirus *Enabled/Updated* {982ADE23-275B-0766-37C5-DE01A484098E}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: BitDefender Antispyware *Enabled/Updated* {234B3FC7-0161-08E8-0D75-E573DF034333}
    FW: BitDefender Firewall *Enabled* {A0115F06-6D34-063E-1C9A-77345A574EF5}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
    C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\FBAgent.exe
    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
    C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
    C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe
    C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Windows\SysWOW64\nvSCPAPISvr.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe
    C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
    C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
    C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
    C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
    C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
    C:\Program Files\P4G\BatteryLife.exe
    C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe
    C:\Windows\SysWOW64\ACEngSvr.exe
    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
    C:\Program Files\Elantech\ETDCtrl.exe
    C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
    C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe
    C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
    C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
    C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
    C:\Program Files (x86)\iPod\bin\iPodService.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Windows\system32\DllHost.exe
    C:\Windows\AsScrPro.exe
    C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Windows\system32\spool\DRIVERS\x64\3\E_IARNGBA.EXE
    C:\Windows\system32\spool\DRIVERS\x64\3\EBAPIx32.EXE
    C:\Program Files\BitDefender\BitDefender 2010\uiscan.exe
    C:\Windows\system32\notepad.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = about:blank
    mStart Page = about:blank
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - "C:\Program Files\BitDefender\BitDefender 2010\Antispam32\IEToolbar.dll"
    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
    uRun: [soncxamerw.exe] "C:\Users\Corinne\AppData\Local\Temp\soncxamerw.exe"
    uRun: [Google Update] "C:\Users\Corinne\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    mRun: [Microsoft Pinyin IME Migration] C:\PROGRA~2\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALL
    mRun: [UpdateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
    mRun: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
    mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
    mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
    mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
    mRun: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
    mRun: [FUFAXSTM] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe"
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [<NO NAME>]
    mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
    mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}\_A1DDD39913A1970387B7B3.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SRSPRE~1.LNK - C:\Windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    TCP: DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{9201F2DC-4A81-4DD3-9F6A-0B83A201206F} : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{FEFA9ADA-DBEB-4140-945D-6DB6B4D93583} : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{FEFA9ADA-DBEB-4140-945D-6DB6B4D93583}\45567616E60216E6460235162716 : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{FEFA9ADA-DBEB-4140-945D-6DB6B4D93583}\45567616E60267370235162716 : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{FEFA9ADA-DBEB-4140-945D-6DB6B4D93583}\C6962626972716A756D6 : DhcpNameServer = 192.168.0.1
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO-X64: Search Helper - No File
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    BHO-X64: Skype Plug-In: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO-X64: SkypeIEPluginBHO - No File
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO-X64: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    BHO-X64: SmartSelect - No File
    TB-X64: BitDefender Toolbar: {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - "C:\Program Files\BitDefender\BitDefender 2010\Antispam32\IEToolbar.dll"
    TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
    mRun-x64: [Microsoft Pinyin IME Migration] C:\PROGRA~2\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALL
    mRun-x64: [UpdateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
    mRun-x64: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
    mRun-x64: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
    mRun-x64: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
    mRun-x64: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun-x64: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
    mRun-x64: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
    mRun-x64: [FUFAXSTM] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe"
    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun-x64: [(Default)]
    mRun-x64: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
    mRun-x64: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Corinne\AppData\Roaming\Mozilla\Firefox\Profiles\196v7hs0.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
    FF - component: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn\components\WCFirefoxExtn.dll
    FF - component: C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
    FF - component: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\components\bdaphff2.dll
    FF - component: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\components\bdaphff3.6.dll
    FF - component: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\components\bdaphff3.dll
    FF - component: C:\Users\Corinne\AppData\Roaming\Mozilla\Firefox\Profiles\196v7hs0.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
    FF - component: C:\Users\Corinne\AppData\Roaming\Mozilla\Firefox\Profiles\196v7hs0.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: C:\Users\Corinne\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll
    FF - plugin: C:\Users\Corinne\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
    FF - plugin: C:\Users\Corinne\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
    FF - Ext: Skype extension: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
    FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
    FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
    FF - Ext: BitDefender Antiphishing Toolbar: FFToolbar@bitdefender.com - C:\Program Files\BitDefender\BitDefender 2010\bdaphffext
    FF - Ext: Adobe Acrobat - Create PDF: web2pdfextension@web2pdf.adobedotcom - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
    FF - Ext: XULRunner: {414BE071-C180-4B12-AC24-5C6C49630909} - C:\Users\Corinne\AppData\Local\{414BE071-C180-4B12-AC24-5C6C49630909}
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;C:\Windows\system32\DRIVERS\BdfNdisf6.sys --> C:\Windows\system32\DRIVERS\BdfNdisf6.sys [?]
    R1 bdfwfpf;bdfwfpf;C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys [2010-1-4 89680]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
    R2 AFBAgent;AFBAgent;"C:\Windows\system32\FBAgent.exe" --> C:\Windows\system32\FBAgent.exe [?]
    R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]
    R2 BDVEDISK;BDVEDISK;C:\Program Files\BitDefender\BitDefender 2010\bdvedisk.sys [2009-9-22 103944]
    R2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [2011-5-13 166400]
    R2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2011-5-13 128512]
    R3 BDFM;BDFM;C:\Windows\system32\DRIVERS\bdfm.sys --> C:\Windows\system32\DRIVERS\bdfm.sys [?]
    R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\system32\DRIVERS\ETD.sys --> C:\Windows\system32\DRIVERS\ETD.sys [?]
    R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    S3 Arrakis3;BitDefender Arrakis Server;C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [2009-10-19 278224]
    S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys --> C:\Windows\system32\DRIVERS\SiSG664.sys [?]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
    .
    =============== Created Last 30 ================
    .
    2011-06-06 15:24:04 -------- d-----w- C:\Users\Corinne\AppData\Local\{BEB5018F-ED05-444D-9E55-DC46E3DDE24F}
    2011-06-03 16:41:12 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Malwarebytes
    2011-06-03 16:40:48 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    2011-06-03 16:40:46 -------- d-----w- C:\ProgramData\Malwarebytes
    2011-06-03 16:40:43 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2011-06-03 16:40:43 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2011-06-03 13:01:36 -------- d-----w- C:\Users\Corinne\AppData\Local\{3C5EDF73-F2FA-496C-AEB8-43D697C18003}
    2011-06-02 13:04:07 -------- d-----w- C:\Users\Corinne\AppData\Local\{0338694F-F134-4901-B03B-7A90307E5990}
    2011-06-01 12:41:54 -------- d-----w- C:\Users\Corinne\AppData\Local\{C1A829AD-4B80-44D6-928D-D9A8772EB614}
    2011-05-31 16:12:43 -------- d-----w- C:\Users\Corinne\AppData\Local\{BC426DAE-E278-4F7B-9897-C6C6D2777D56}
    2011-05-30 13:54:08 -------- d-----w- C:\Users\Corinne\AppData\Local\{DEA223F2-19BF-4037-BC20-E625D65FC618}
    2011-05-30 13:47:45 -------- d-----w- C:\Users\Corinne\AppData\Local\V-Safe 100
    2011-05-27 13:23:37 -------- d-----w- C:\Users\Corinne\AppData\Local\{EE0BC9BB-7221-4E97-89B8-69AAD5482AFB}
    2011-05-26 13:37:49 -------- d-----w- C:\Users\Corinne\AppData\Local\{444C4A77-FC2D-4F95-940D-5724B1F7B90A}
    2011-05-25 12:47:23 -------- d-----w- C:\Users\Corinne\AppData\Local\{62526844-F220-4F92-AEE6-3B1713B438F3}
    2011-05-24 13:03:04 -------- d-----w- C:\Users\Corinne\AppData\Local\{B515DAF0-43B9-4174-8824-6646DE3C901B}
    2011-05-23 14:09:46 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2011-05-20 20:10:37 -------- d-----w- C:\Users\Corinne\AppData\Local\{A90AC1E1-F8BB-4D33-85F1-8D34550E1F2D}
    2011-05-19 18:38:54 142336 ----a-w- C:\Windows\System32\poqexec.exe
    2011-05-19 18:38:54 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe
    2011-05-18 12:57:12 -------- d-----w- C:\Users\Corinne\AppData\Local\{0644845A-B935-4376-83CF-CF3779B321D4}
    2011-05-17 13:29:30 -------- d-----w- C:\Users\Corinne\AppData\Local\{28DCE2ED-4AE0-41D8-9014-679171620646}
    2011-05-17 01:29:04 -------- d-----w- C:\Users\Corinne\AppData\Local\{8C4B56F8-6DCB-4880-AE2A-E27811CEA730}
    2011-05-16 12:44:06 -------- d-----w- C:\Users\Corinne\AppData\Local\{0D48E7C7-A41E-4941-97F9-70B33F97868B}
    2011-05-15 19:58:47 -------- d-----w- C:\ProgramData\regid.1986-12.com.adobe
    2011-05-14 00:50:50 -------- d-----w- C:\ProgramData\Skype Extras
    2011-05-14 00:49:15 -------- d-----r- C:\Program Files (x86)\Skype
    2011-05-13 18:45:47 77824 ----a-w- C:\Windows\SysWow64\EBAPI.dll
    2011-05-13 18:45:47 65536 ----a-w- C:\Windows\SysWow64\EEBUtil.dll
    2011-05-13 18:45:47 55808 ----a-w- C:\Windows\SysWow64\EEBSDKIF.dll
    2011-05-13 18:45:47 135168 ----a-w- C:\Windows\SysWow64\EEBAPI.dll
    2011-05-13 18:45:47 110592 ----a-w- C:\Windows\SysWow64\EEBDSCVR.dll
    2011-05-13 18:45:43 -------- d-----w- C:\Program Files\Common Files\EPSON
    2011-05-13 18:44:06 -------- d-----w- C:\Program Files (x86)\EpsonNet
    2011-05-13 18:43:32 558592 ----a-w- C:\Windows\System32\ensppmon.dll
    2011-05-13 18:43:32 558592 ----a-w- C:\Windows\System32\enppmon.dll
    2011-05-13 18:43:32 538112 ----a-w- C:\Windows\System32\ensppui.dll
    2011-05-13 18:43:32 538112 ----a-w- C:\Windows\System32\enppui.dll
    2011-05-13 18:43:32 250880 ----a-w- C:\Windows\System32\enspres.dll
    2011-05-13 18:43:32 250880 ----a-w- C:\Windows\System32\enpres.dll
    2011-05-13 17:41:27 -------- d-----w- C:\Users\Corinne\AppData\Local\{A2A8DFE7-1ED1-4204-AC43-239EE9B784FE}
    2011-05-13 15:37:43 464384 ----a-w- C:\Windows\System32\esxw2ud.dll
    2011-05-13 15:37:43 17408 ----a-w- C:\Windows\System32\esxcdev.dll
    2011-05-13 15:37:43 128392 ----a-w- C:\Windows\System32\esdevapp.exe
    2011-05-12 21:38:00 -------- d-----w- C:\Program Files\EpsonNet
    2011-05-12 21:37:31 -------- d-----w- C:\Program Files (x86)\Common Files\EPSON
    2011-05-12 21:35:43 -------- d-----w- C:\Program Files (x86)\Epson Software
    2011-05-12 21:34:29 501912 ----a-w- C:\Windows\SysWow64\PICSDK2.dll
    2011-05-12 21:34:28 80024 ----a-w- C:\Windows\SysWow64\PICSDK.dll
    2011-05-12 21:34:28 51360 ----a-w- C:\Windows\SysWow64\EpPicPrt.dll
    2011-05-12 21:34:28 51360 ----a-w- C:\Windows\SysWow64\EpPicMgr.dll
    2011-05-12 21:34:28 108704 ----a-w- C:\Windows\SysWow64\PICEntry.dll
    2011-05-12 21:34:00 118784 ----a-w- C:\Windows\System32\E_ILMGBA.DLL
    2011-05-12 21:33:56 88064 ----a-w- C:\Windows\System32\E_IBCBGBA.DLL
    2011-05-12 21:33:43 -------- d-----w- C:\ProgramData\EPSON
    2011-05-12 21:33:11 -------- d-----w- C:\Program Files (x86)\epson
    2011-05-12 18:14:15 -------- d-----w- C:\Users\Corinne\AppData\Local\{0D324B99-EB6C-4A35-B4E2-F31E5A2B4C38}
    2011-05-11 16:45:20 -------- d-----w- C:\Users\Corinne\AppData\Local\{7F7AC2B2-D7F7-4343-8D4C-96DBD7E38F6C}
    2011-05-11 16:45:07 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Windows Live Writer
    2011-05-11 16:45:07 -------- d-----w- C:\Users\Corinne\AppData\Local\Windows Live Writer
    2011-05-11 15:43:36 -------- d-----w- C:\Windows\en
    2011-05-11 12:24:24 5509504 ----a-w- C:\Windows\System32\ntoskrnl.exe
    2011-05-11 12:24:23 3957632 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2011-05-11 12:24:22 3901824 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2011-05-10 18:53:32 17370496 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSO - Copy.DLL
    2011-05-10 18:52:01 17370496 ----a-w- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL
    2011-05-10 17:02:36 91568 ----a-w- C:\Windows\System32\drivers\scdemu.sys
    2011-05-10 17:02:36 -------- d-----w- C:\Program Files (x86)\PowerISO
    .
    ==================== Find3M ====================
    .
    2011-06-06 20:09:11 45056 ----a-w- C:\Windows\System32\acovcnt.exe
    2011-03-11 06:19:26 1395712 ----a-w- C:\Windows\System32\mfc42.dll
    2011-03-11 06:19:26 1359872 ----a-w- C:\Windows\System32\mfc42u.dll
    2011-03-11 05:40:24 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll
    2011-03-11 05:40:24 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll
    .
    ============= FINISH: 17:08:19.65 ===============

    4. DDS (attach)
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-03.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 06/02/2010 4:22:02 AM
    System Uptime: 06/06/2011 4:11:08 PM (1 hours ago)
    .
    Motherboard: ASUSTeK Computer Inc. | | K50ID
    Processor: Pentium(R) Dual-Core CPU T4400 @ 2.20GHz | Socket 478 | 1188/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 116 GiB total, 49.752 GiB free.
    D: is FIXED (NTFS) - 335 GiB total, 334.585 GiB free.
    E: is CDROM ()
    F: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP132: 19/05/2011 10:20:40 PM - Windows Update
    RP133: 26/05/2011 11:14:05 AM - Installed Adobe Reader X.
    RP134: 03/06/2011 3:41:36 PM - Installed HiJackThis
    RP135: 06/06/2011 4:12:10 PM - Removed HiJackThis
    .
    ==== Installed Programs ======================
    .
    Update for Microsoft Office 2007 (KB2508958)
    2007 Microsoft Office system
    Acrobat.com
    Activation Assistant for the 2007 Microsoft Office suites
    Adobe Acrobat X Pro - English, Français, Deutsch
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader X (10.0.1)
    Alcor Micro USB Card Reader
    Apple Application Support
    Apple Software Update
    ASUS AI Recovery
    ASUS AP Bank
    ASUS FancyStart
    ASUS LifeFrame3
    ASUS Live Update
    ASUS MultiFrame
    ASUS SmartLogon
    ASUS Splendid Video Enhancement Technology
    ASUS Virtual Camera
    ASUS_Screensaver
    ATK Package
    µTorrent
    Chicken Invaders 2
    ControlDeck
    CyberLink LabelPrint
    CyberLink Power2Go
    D3DX10
    Dream Day Wedding Married in Manhattan
    Epson Event Manager
    Epson FAX Utility
    Epson PC-FAX Driver
    EPSON Scan
    EpsonNet Print
    EpsonNet Setup 3.3
    FLV to AVI 1.2
    Game Park Console
    Google Talk Plugin
    Island Wars 2
    J2SE Runtime Environment 5.0 Update 6
    Java Auto Updater
    Java(TM) 6 Update 24
    Junk Mail filter update
    Malwarebytes' Anti-Malware
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access MUI (Arabic) 2007
    Microsoft Office Access MUI (Chinese (Simplified)) 2007
    Microsoft Office Access MUI (Chinese (Traditional)) 2007
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access MUI (French) 2007
    Microsoft Office Access MUI (Portuguese (Brazil)) 2007
    Microsoft Office Access MUI (Portuguese (Portugal)) 2007
    Microsoft Office Access MUI (Spanish) 2007
    Microsoft Office Access MUI (Thai) 2007
    Microsoft Office Access MUI (Turkish) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Excel MUI (Arabic) 2007
    Microsoft Office Excel MUI (Chinese (Simplified)) 2007
    Microsoft Office Excel MUI (Chinese (Traditional)) 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Excel MUI (French) 2007
    Microsoft Office Excel MUI (Portuguese (Brazil)) 2007
    Microsoft Office Excel MUI (Portuguese (Portugal)) 2007
    Microsoft Office Excel MUI (Spanish) 2007
    Microsoft Office Excel MUI (Thai) 2007
    Microsoft Office Excel MUI (Turkish) 2007
    Microsoft Office Home and Student 2007
    Microsoft Office IME (Chinese (Simplified)) 2007
    Microsoft Office IME (Chinese (Traditional)) 2007
    Microsoft Office Live Add-in 1.3
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (Arabic) 2007
    Microsoft Office Outlook MUI (Chinese (Simplified)) 2007
    Microsoft Office Outlook MUI (Chinese (Traditional)) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office Outlook MUI (French) 2007
    Microsoft Office Outlook MUI (Portuguese (Brazil)) 2007
    Microsoft Office Outlook MUI (Portuguese (Portugal)) 2007
    Microsoft Office Outlook MUI (Spanish) 2007
    Microsoft Office Outlook MUI (Thai) 2007
    Microsoft Office Outlook MUI (Turkish) 2007
    Microsoft Office PowerPoint MUI (Arabic) 2007
    Microsoft Office PowerPoint MUI (Chinese (Simplified)) 2007
    Microsoft Office PowerPoint MUI (Chinese (Traditional)) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint MUI (French) 2007
    Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2007
    Microsoft Office PowerPoint MUI (Portuguese (Portugal)) 2007
    Microsoft Office PowerPoint MUI (Spanish) 2007
    Microsoft Office PowerPoint MUI (Thai) 2007
    Microsoft Office PowerPoint MUI (Turkish) 2007
    Microsoft Office Professional Hybrid 2007
    Microsoft Office Proof (Arabic) 2007
    Microsoft Office Proof (Basque) 2007
    Microsoft Office Proof (Catalan) 2007
    Microsoft Office Proof (Chinese (Simplified)) 2007
    Microsoft Office Proof (Chinese (Traditional)) 2007
    Microsoft Office Proof (Dutch) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Galician) 2007
    Microsoft Office Proof (German) 2007
    Microsoft Office Proof (Portuguese (Brazil)) 2007
    Microsoft Office Proof (Portuguese (Portugal)) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proof (Thai) 2007
    Microsoft Office Proof (Turkish) 2007
    Microsoft Office Proofing (Arabic) 2007
    Microsoft Office Proofing (Chinese (Simplified)) 2007
    Microsoft Office Proofing (Chinese (Traditional)) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing (French) 2007
    Microsoft Office Proofing (Portuguese (Brazil)) 2007
    Microsoft Office Proofing (Portuguese (Portugal)) 2007
    Microsoft Office Proofing (Spanish) 2007
    Microsoft Office Proofing (Thai) 2007
    Microsoft Office Proofing (Turkish) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Publisher MUI (Arabic) 2007
    Microsoft Office Publisher MUI (Chinese (Simplified)) 2007
    Microsoft Office Publisher MUI (Chinese (Traditional)) 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Publisher MUI (French) 2007
    Microsoft Office Publisher MUI (Portuguese (Brazil)) 2007
    Microsoft Office Publisher MUI (Portuguese (Portugal)) 2007
    Microsoft Office Publisher MUI (Spanish) 2007
    Microsoft Office Publisher MUI (Thai) 2007
    Microsoft Office Publisher MUI (Turkish) 2007
    Microsoft Office Shared MUI (Arabic) 2007
    Microsoft Office Shared MUI (Chinese (Simplified)) 2007
    Microsoft Office Shared MUI (Chinese (Traditional)) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared MUI (French) 2007
    Microsoft Office Shared MUI (Portuguese (Brazil)) 2007
    Microsoft Office Shared MUI (Portuguese (Portugal)) 2007
    Microsoft Office Shared MUI (Spanish) 2007
    Microsoft Office Shared MUI (Thai) 2007
    Microsoft Office Shared MUI (Turkish) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (Arabic) 2007
    Microsoft Office Word MUI (Chinese (Simplified)) 2007
    Microsoft Office Word MUI (Chinese (Traditional)) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Office Word MUI (French) 2007
    Microsoft Office Word MUI (Portuguese (Brazil)) 2007
    Microsoft Office Word MUI (Portuguese (Portugal)) 2007
    Microsoft Office Word MUI (Spanish) 2007
    Microsoft Office Word MUI (Thai) 2007
    Microsoft Office Word MUI (Turkish) 2007
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable - KB2467175
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Mozilla Firefox (3.6.17)
    MSVCRT
    MSVCRT_amd64
    NVIDIA Stereoscopic 3D Driver
    Piggly
    PowerISO
    QuickTime
    Realtek Ethernet Controller Driver
    Realtek High Definition Audio Driver
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2288931)
    Security Update for 2007 Microsoft Office System (KB2345043)
    Security Update for 2007 Microsoft Office System (KB2466156)
    Security Update for 2007 Microsoft Office System (KB2509488)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for Microsoft Office Access 2007 (KB979440)
    Security Update for Microsoft Office Excel 2007 (KB2464583)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
    Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
    Security Update for Microsoft Office Publisher 2007 (KB2284697)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    Skype Toolbars
    Skype™ 5.3
    Smileyville
    Sony Vegas Movie Studio Platinum 8.0
    Update for 2007 Microsoft Office System (KB2284654)
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft Office OneNote 2007 (KB980729)
    Update for Microsoft Office Outlook 2007 (KB2509470)
    Update for Outlook 2007 Junk Email Filter (KB2536413)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Mail
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    WinFlash
    Wireless Console 3
    .
    ==== Event Viewer Messages From Past Week ========
    .
    31/05/2011 10:56:38 AM, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147014847
    06/06/2011 5:07:24 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LIVESRV service.
    03/06/2011 10:02:48 AM, Error: Service Control Manager [7034] - The BitDefender Virus Shield service terminated unexpectedly. It has done this 1 time(s).
    02/06/2011 9:34:58 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.
    02/06/2011 6:07:23 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
    .
    ==== End Of File ===========================

    --------------------------
    5. HijackThis (optional-- if it may help I did this one too just let me know if I should post those too)


    Thank you SO much for your help!
    -Corinne
  2. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ======================================================================

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

    ====================================================================

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    Click the "Scan" button to start scan:
    [​IMG]

    On completion of the scan click "Save log", save it to your desktop and post in your next reply:
    [​IMG]
  3. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    Thanks Broni!

    Results from the last 2 scans:

    TDSKiller:
    2011/06/06 21:30:24.0236 4764 TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24
    2011/06/06 21:30:26.0238 4764 ================================================================================
    2011/06/06 21:30:26.0238 4764 SystemInfo:
    2011/06/06 21:30:26.0238 4764
    2011/06/06 21:30:26.0238 4764 OS Version: 6.1.7600 ServicePack: 0.0
    2011/06/06 21:30:26.0238 4764 Product type: Workstation
    2011/06/06 21:30:26.0238 4764 ComputerName: CORINNE-PC
    2011/06/06 21:30:26.0239 4764 UserName: Corinne
    2011/06/06 21:30:26.0239 4764 Windows directory: C:\Windows
    2011/06/06 21:30:26.0239 4764 System windows directory: C:\Windows
    2011/06/06 21:30:26.0239 4764 Running under WOW64
    2011/06/06 21:30:26.0239 4764 Processor architecture: Intel x64
    2011/06/06 21:30:26.0239 4764 Number of processors: 2
    2011/06/06 21:30:26.0239 4764 Page size: 0x1000
    2011/06/06 21:30:26.0239 4764 Boot type: Normal boot
    2011/06/06 21:30:26.0239 4764 ================================================================================
    2011/06/06 21:30:32.0580 4764 Initialize success
    2011/06/06 21:30:49.0319 5748 ================================================================================
    2011/06/06 21:30:49.0320 5748 Scan started
    2011/06/06 21:30:49.0320 5748 Mode: Manual;
    2011/06/06 21:30:49.0320 5748 ================================================================================
    2011/06/06 21:30:50.0224 5748 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
    2011/06/06 21:30:50.0280 5748 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
    2011/06/06 21:30:50.0329 5748 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
    2011/06/06 21:30:50.0390 5748 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
    2011/06/06 21:30:50.0447 5748 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
    2011/06/06 21:30:50.0494 5748 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
    2011/06/06 21:30:50.0675 5748 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys
    2011/06/06 21:30:50.0744 5748 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
    2011/06/06 21:30:50.0824 5748 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
    2011/06/06 21:30:50.0875 5748 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
    2011/06/06 21:30:50.0926 5748 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
    2011/06/06 21:30:50.0985 5748 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
    2011/06/06 21:30:51.0040 5748 amdsata (7a4b413614c055935567cf88a9734d38) C:\Windows\system32\DRIVERS\amdsata.sys
    2011/06/06 21:30:51.0089 5748 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
    2011/06/06 21:30:51.0140 5748 amdxata (b4ad0cacbab298671dd6f6ef7e20679d) C:\Windows\system32\DRIVERS\amdxata.sys
    2011/06/06 21:30:51.0198 5748 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
    2011/06/06 21:30:51.0345 5748 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
    2011/06/06 21:30:51.0398 5748 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
    2011/06/06 21:30:51.0539 5748 ASMMAP64 (4c016fd76ed5c05e84ca8cab77993961) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys
    2011/06/06 21:30:51.0668 5748 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
    2011/06/06 21:30:51.0729 5748 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
    2011/06/06 21:30:51.0822 5748 athr (0acc06fcf46f64ed4f11e57ee461c1f4) C:\Windows\system32\DRIVERS\athrx.sys
    2011/06/06 21:30:52.0050 5748 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
    2011/06/06 21:30:52.0126 5748 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
    2011/06/06 21:30:52.0202 5748 BDFM (f050e487a787239c182c279ca97e8cf4) C:\Windows\system32\DRIVERS\bdfm.sys
    2011/06/06 21:30:52.0269 5748 BdfNdisf (cd211cfa62cab0d4c18b5cb8337f57c2) C:\Windows\system32\DRIVERS\BdfNdisf6.sys
    2011/06/06 21:30:52.0395 5748 bdfsfltr (abd97bfb299713a51fe36aaab71f73a2) C:\Windows\system32\DRIVERS\bdfsfltr.sys
    2011/06/06 21:30:52.0504 5748 bdfwfpf (1d634cdb4f742ac282d5265d46829ff6) C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys
    2011/06/06 21:30:52.0558 5748 BDVEDISK (b89deff4817b4cc6fc2bcd8f83b4e75d) C:\Program Files\BitDefender\BitDefender 2010\bdvedisk.sys
    2011/06/06 21:30:52.0662 5748 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
    2011/06/06 21:30:52.0728 5748 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
    2011/06/06 21:30:52.0823 5748 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys
    2011/06/06 21:30:52.0888 5748 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
    2011/06/06 21:30:52.0921 5748 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
    2011/06/06 21:30:53.0021 5748 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
    2011/06/06 21:30:53.0069 5748 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
    2011/06/06 21:30:53.0126 5748 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
    2011/06/06 21:30:53.0164 5748 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
    2011/06/06 21:30:53.0223 5748 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
    2011/06/06 21:30:53.0322 5748 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
    2011/06/06 21:30:53.0379 5748 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
    2011/06/06 21:30:53.0506 5748 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
    2011/06/06 21:30:53.0559 5748 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
    2011/06/06 21:30:53.0637 5748 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
    2011/06/06 21:30:53.0684 5748 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
    2011/06/06 21:30:53.0741 5748 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
    2011/06/06 21:30:53.0804 5748 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
    2011/06/06 21:30:53.0906 5748 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
    2011/06/06 21:30:54.0255 5748 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
    2011/06/06 21:30:54.0404 5748 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys
    2011/06/06 21:30:54.0471 5748 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
    2011/06/06 21:30:54.0532 5748 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
    2011/06/06 21:30:54.0643 5748 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
    2011/06/06 21:30:54.0708 5748 DXGKrnl (ebce0b0924835f635f620d19f0529dce) C:\Windows\System32\drivers\dxgkrnl.sys
    2011/06/06 21:30:54.0916 5748 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
    2011/06/06 21:30:55.0207 5748 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
    2011/06/06 21:30:55.0381 5748 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
    2011/06/06 21:30:55.0440 5748 ETD (3c38648375b7f3988691f53a7aae10a9) C:\Windows\system32\DRIVERS\ETD.sys
    2011/06/06 21:30:55.0512 5748 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
    2011/06/06 21:30:55.0561 5748 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
    2011/06/06 21:30:55.0613 5748 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
    2011/06/06 21:30:55.0699 5748 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
    2011/06/06 21:30:55.0745 5748 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
    2011/06/06 21:30:55.0789 5748 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
    2011/06/06 21:30:55.0840 5748 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
    2011/06/06 21:30:55.0903 5748 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
    2011/06/06 21:30:55.0942 5748 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
    2011/06/06 21:30:55.0996 5748 fvevol (b8b2a6e1558f8f5de5ce431c5b2c7b09) C:\Windows\system32\DRIVERS\fvevol.sys
    2011/06/06 21:30:56.0046 5748 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
    2011/06/06 21:30:56.0102 5748 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
    2011/06/06 21:30:56.0152 5748 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
    2011/06/06 21:30:56.0219 5748 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
    2011/06/06 21:30:56.0309 5748 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
    2011/06/06 21:30:56.0361 5748 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
    2011/06/06 21:30:56.0449 5748 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
    2011/06/06 21:30:56.0493 5748 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
    2011/06/06 21:30:56.0564 5748 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
    2011/06/06 21:30:56.0639 5748 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
    2011/06/06 21:30:56.0719 5748 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
    2011/06/06 21:30:56.0785 5748 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
    2011/06/06 21:30:56.0840 5748 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
    2011/06/06 21:30:56.0936 5748 iaStorV (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys
    2011/06/06 21:30:57.0040 5748 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
    2011/06/06 21:30:57.0191 5748 IntcAzAudAddService (181e4ff75674a7105ecd0a02c35ef43a) C:\Windows\system32\drivers\RTKVHD64.sys
    2011/06/06 21:30:57.0403 5748 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
    2011/06/06 21:30:57.0474 5748 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
    2011/06/06 21:30:57.0527 5748 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
    2011/06/06 21:30:57.0578 5748 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
    2011/06/06 21:30:57.0625 5748 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
    2011/06/06 21:30:57.0686 5748 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
    2011/06/06 21:30:57.0740 5748 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
    2011/06/06 21:30:57.0788 5748 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
    2011/06/06 21:30:57.0847 5748 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
    2011/06/06 21:30:57.0902 5748 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
    2011/06/06 21:30:58.0032 5748 kbfiltr (e63ef8c3271d014f14e2469ce75fecb4) C:\Windows\system32\DRIVERS\kbfiltr.sys
    2011/06/06 21:30:58.0093 5748 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
    2011/06/06 21:30:58.0144 5748 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
    2011/06/06 21:30:58.0202 5748 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
    2011/06/06 21:30:58.0379 5748 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
    2011/06/06 21:30:58.0464 5748 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
    2011/06/06 21:30:58.0501 5748 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
    2011/06/06 21:30:58.0543 5748 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
    2011/06/06 21:30:58.0593 5748 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
    2011/06/06 21:30:58.0755 5748 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
    2011/06/06 21:30:58.0842 5748 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
    2011/06/06 21:30:58.0887 5748 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
    2011/06/06 21:30:58.0939 5748 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
    2011/06/06 21:30:58.0996 5748 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
    2011/06/06 21:30:59.0037 5748 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
    2011/06/06 21:30:59.0091 5748 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
    2011/06/06 21:30:59.0154 5748 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
    2011/06/06 21:30:59.0200 5748 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
    2011/06/06 21:30:59.0245 5748 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
    2011/06/06 21:30:59.0301 5748 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
    2011/06/06 21:30:59.0360 5748 mrxsmb (b7f3d2c40bdf8ffb73ebfb19c77734e2) C:\Windows\system32\DRIVERS\mrxsmb.sys
    2011/06/06 21:30:59.0403 5748 mrxsmb10 (86c6f88b5168ce21cf8d69d0b3ff5d19) C:\Windows\system32\DRIVERS\mrxsmb10.sys
    2011/06/06 21:30:59.0456 5748 mrxsmb20 (b081069251c8e9f42cb8769d07148f9c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
    2011/06/06 21:30:59.0516 5748 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys
    2011/06/06 21:30:59.0561 5748 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
    2011/06/06 21:30:59.0622 5748 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
    2011/06/06 21:30:59.0657 5748 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
    2011/06/06 21:30:59.0685 5748 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
    2011/06/06 21:30:59.0767 5748 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
    2011/06/06 21:30:59.0814 5748 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
    2011/06/06 21:30:59.0846 5748 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
    2011/06/06 21:30:59.0893 5748 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
    2011/06/06 21:30:59.0949 5748 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
    2011/06/06 21:31:00.0003 5748 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
    2011/06/06 21:31:00.0044 5748 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
    2011/06/06 21:31:00.0133 5748 MTsensor (032d35c996f21d19a205a7c8f0b76f3c) C:\Windows\system32\DRIVERS\ATK64AMD.sys
    2011/06/06 21:31:00.0200 5748 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
    2011/06/06 21:31:00.0365 5748 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
    2011/06/06 21:31:00.0471 5748 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
    2011/06/06 21:31:00.0619 5748 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
    2011/06/06 21:31:00.0665 5748 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
    2011/06/06 21:31:00.0710 5748 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
    2011/06/06 21:31:00.0749 5748 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
    2011/06/06 21:31:00.0795 5748 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
    2011/06/06 21:31:00.0840 5748 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
    2011/06/06 21:31:00.0886 5748 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
    2011/06/06 21:31:00.0974 5748 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
    2011/06/06 21:31:01.0024 5748 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
    2011/06/06 21:31:01.0082 5748 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
    2011/06/06 21:31:01.0166 5748 Ntfs (356698a13c4630d5b31c37378d469196) C:\Windows\system32\drivers\Ntfs.sys
    2011/06/06 21:31:01.0305 5748 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
    2011/06/06 21:31:01.0377 5748 NVHDA (ad37248bd442d41c9a896e53eb8a85ee) C:\Windows\system32\drivers\nvhda64v.sys
    2011/06/06 21:31:01.0694 5748 nvlddmkm (bc2d2480f58c3bc7f03c1e36a8ad4bf9) C:\Windows\system32\DRIVERS\nvlddmkm.sys
    2011/06/06 21:31:02.0021 5748 nvraid (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys
    2011/06/06 21:31:02.0086 5748 nvsmu (a1381b3d52850bc4f0cc8b4697bd891c) C:\Windows\system32\DRIVERS\nvsmu.sys
    2011/06/06 21:31:02.0124 5748 nvstor (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys
    2011/06/06 21:31:02.0176 5748 nvstor64 (ebfe363aab0d6e4086adbf04c41ebdf8) C:\Windows\system32\DRIVERS\nvstor64.sys
    2011/06/06 21:31:02.0234 5748 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
    2011/06/06 21:31:02.0304 5748 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
    2011/06/06 21:31:02.0396 5748 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
    2011/06/06 21:31:02.0435 5748 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
    2011/06/06 21:31:02.0497 5748 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
    2011/06/06 21:31:02.0569 5748 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
    2011/06/06 21:31:02.0639 5748 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
    2011/06/06 21:31:02.0686 5748 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
    2011/06/06 21:31:02.0750 5748 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
    2011/06/06 21:31:02.0994 5748 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
    2011/06/06 21:31:03.0044 5748 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
    2011/06/06 21:31:03.0118 5748 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
    2011/06/06 21:31:03.0194 5748 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
    2011/06/06 21:31:03.0322 5748 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
    2011/06/06 21:31:03.0370 5748 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
    2011/06/06 21:31:03.0411 5748 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
    2011/06/06 21:31:03.0472 5748 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
    2011/06/06 21:31:03.0546 5748 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
    2011/06/06 21:31:03.0601 5748 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
    2011/06/06 21:31:03.0654 5748 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
    2011/06/06 21:31:03.0704 5748 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
    2011/06/06 21:31:03.0751 5748 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
    2011/06/06 21:31:03.0795 5748 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
    2011/06/06 21:31:03.0897 5748 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
    2011/06/06 21:31:03.0949 5748 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
    2011/06/06 21:31:03.0988 5748 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
    2011/06/06 21:31:04.0050 5748 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
    2011/06/06 21:31:04.0154 5748 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
    2011/06/06 21:31:04.0225 5748 RTL8167 (f65f171165fbb613f7aa3cc78e8cab42) C:\Windows\system32\DRIVERS\Rt64win7.sys
    2011/06/06 21:31:04.0299 5748 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
    2011/06/06 21:31:04.0472 5748 SCDEmu (6ce6f98ea3d07a9c2ce3cd0a5a86352d) C:\Windows\system32\drivers\SCDEmu.sys
    2011/06/06 21:31:04.0519 5748 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
    2011/06/06 21:31:04.0627 5748 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
    2011/06/06 21:31:04.0701 5748 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
    2011/06/06 21:31:04.0745 5748 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
    2011/06/06 21:31:04.0798 5748 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
    2011/06/06 21:31:04.0874 5748 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
    2011/06/06 21:31:04.0904 5748 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys
    2011/06/06 21:31:04.0941 5748 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\Windows\system32\DRIVERS\sffp_sd.sys
    2011/06/06 21:31:04.0985 5748 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
    2011/06/06 21:31:05.0051 5748 SiSGbeLH (1bc348cf6baa90ec8e533ef6e6a69933) C:\Windows\system32\DRIVERS\SiSG664.sys
    2011/06/06 21:31:05.0091 5748 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
    2011/06/06 21:31:05.0134 5748 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
    2011/06/06 21:31:05.0177 5748 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
    2011/06/06 21:31:05.0300 5748 SNP2UVC (1d8474722cdffbb8fca5fa12c50a05a2) C:\Windows\system32\DRIVERS\snp2uvc.sys
    2011/06/06 21:31:05.0491 5748 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
    2011/06/06 21:31:05.0587 5748 srv (148d50904d2a0df29a19778715eb35bb) C:\Windows\system32\DRIVERS\srv.sys
    2011/06/06 21:31:05.0668 5748 srv2 (ce2189fe31d36678ac9eb7ddee08ec96) C:\Windows\system32\DRIVERS\srv2.sys
    2011/06/06 21:31:05.0761 5748 srvnet (cb69edeb069a49577592835659cd0e46) C:\Windows\system32\DRIVERS\srvnet.sys
    2011/06/06 21:31:05.0864 5748 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
    2011/06/06 21:31:05.0920 5748 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
    2011/06/06 21:31:06.0071 5748 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys
    2011/06/06 21:31:06.0302 5748 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys
    2011/06/06 21:31:06.0378 5748 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
    2011/06/06 21:31:06.0476 5748 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
    2011/06/06 21:31:06.0510 5748 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
    2011/06/06 21:31:06.0557 5748 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
    2011/06/06 21:31:06.0600 5748 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
    2011/06/06 21:31:06.0722 5748 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
    2011/06/06 21:31:06.0777 5748 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
    2011/06/06 21:31:06.0819 5748 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
    2011/06/06 21:31:06.0868 5748 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
    2011/06/06 21:31:06.0938 5748 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
    2011/06/06 21:31:06.0993 5748 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
    2011/06/06 21:31:07.0048 5748 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
    2011/06/06 21:31:07.0116 5748 USBAAPL64 (f724b03c3dfaacf08d17d38bf3333583) C:\Windows\system32\Drivers\usbaapl64.sys
    2011/06/06 21:31:07.0171 5748 usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys
    2011/06/06 21:31:07.0229 5748 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
    2011/06/06 21:31:07.0273 5748 usbehci (2ea4aff7be7eb4632e3aa8595b0803b5) C:\Windows\system32\DRIVERS\usbehci.sys
    2011/06/06 21:31:07.0324 5748 usbhub (4c9042b8df86c1e8e6240c218b99b39b) C:\Windows\system32\DRIVERS\usbhub.sys
    2011/06/06 21:31:07.0368 5748 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
    2011/06/06 21:31:07.0418 5748 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
    2011/06/06 21:31:07.0470 5748 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
    2011/06/06 21:31:07.0523 5748 USBSTOR (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS
    2011/06/06 21:31:07.0567 5748 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys
    2011/06/06 21:31:07.0628 5748 usbvideo (d501e12614b00a3252073101d6a1a74b) C:\Windows\system32\Drivers\usbvideo.sys
    2011/06/06 21:31:07.0703 5748 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
    2011/06/06 21:31:07.0762 5748 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
    2011/06/06 21:31:07.0799 5748 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
    2011/06/06 21:31:07.0846 5748 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
    2011/06/06 21:31:07.0891 5748 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
    2011/06/06 21:31:07.0934 5748 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
    2011/06/06 21:31:07.0988 5748 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
    2011/06/06 21:31:08.0033 5748 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
    2011/06/06 21:31:08.0088 5748 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
    2011/06/06 21:31:08.0161 5748 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
    2011/06/06 21:31:08.0205 5748 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
    2011/06/06 21:31:08.0280 5748 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
    2011/06/06 21:31:08.0339 5748 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
    2011/06/06 21:31:08.0377 5748 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
    2011/06/06 21:31:08.0508 5748 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
    2011/06/06 21:31:08.0559 5748 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
    2011/06/06 21:31:08.0724 5748 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
    2011/06/06 21:31:08.0783 5748 WimFltr (52ded146e4797e6ccf94799e8e22bb2a) C:\Windows\system32\DRIVERS\wimfltr.sys
    2011/06/06 21:31:08.0827 5748 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
    2011/06/06 21:31:09.0126 5748 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys
    2011/06/06 21:31:09.0231 5748 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
    2011/06/06 21:31:09.0365 5748 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
    2011/06/06 21:31:09.0451 5748 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
    2011/06/06 21:31:09.0505 5748 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
    2011/06/06 21:31:09.0594 5748 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
    2011/06/06 21:31:09.0619 5748 ================================================================================
    2011/06/06 21:31:09.0619 5748 Scan finished
    2011/06/06 21:31:09.0619 5748 ================================================================================
    2011/06/06 21:31:09.0644 1312 Detected object count: 0
    2011/06/06 21:31:09.0644 1312 Actual detected object count: 0
    ----------
    aswMBR:

    aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
    Run date: 2011-06-06 21:33:09
    -----------------------------
    21:33:09.544 OS Version: Windows x64 6.1.7600
    21:33:09.544 Number of processors: 2 586 0x170A
    21:33:09.546 ComputerName: CORINNE-PC UserName: Corinne
    21:33:20.658 Initialize success
    21:33:36.985 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000069
    21:33:36.989 Disk 0 Vendor: ST950032 0002 Size: 476940MB BusType: 3
    21:33:39.075 Disk 0 MBR read successfully
    21:33:39.080 Disk 0 MBR scan
    21:33:39.085 Disk 0 unknown MBR code
    21:33:39.096 Service scanning
    21:33:40.435 Disk 0 trace - called modules:
    21:33:40.504 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor64.sys
    21:33:40.511 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800423b370]
    21:33:40.517 3 CLASSPNP.SYS[fffff8800120143f] -> nt!IofCallDriver -> [0xfffffa80040a02f0]
    21:33:40.524 5 ACPI.sys[fffff88000f06781] -> nt!IofCallDriver -> \Device\00000069[0xfffffa80040a0730]
    21:33:40.531 Scan finished successfully
    21:36:15.381 Disk 0 MBR has been saved successfully to "C:\Users\Corinne\Desktop\MBR.dat"
    21:36:15.439 The log file has been saved successfully to "C:\Users\Corinne\Desktop\aswMBR.txt"


    Thank you!
  4. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Those are fine.

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
  5. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    Combofix did work so I did not run Rkill, did you want me to also run that one?

    Here is my log from Combo fix:
    ComboFix 11-06-06.02 - Corinne 06/06/2011 22:46:31.1.2 - x64
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.4095.2033 [GMT -4:00]
    Running from: C:\Users\Corinne\Downloads\ComboFix.exe
    AV: BitDefender Antivirus *Disabled/Updated* {982ADE23-275B-0766-37C5-DE01A484098E}
    FW: BitDefender Firewall *Disabled* {A0115F06-6D34-063E-1C9A-77345A574EF5}
    SP: BitDefender Antispyware *Disabled/Updated* {234B3FC7-0161-08E8-0D75-E573DF034333}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\ProgramData\FullRemove.exe
    C:\Users\Corinne\AppData\Local\{414BE071-C180-4B12-AC24-5C6C49630909}
    C:\Users\Corinne\AppData\Local\{414BE071-C180-4B12-AC24-5C6C49630909}\chrome.manifest
    C:\Users\Corinne\AppData\Local\{414BE071-C180-4B12-AC24-5C6C49630909}\chrome\content\_cfg.js
    C:\Users\Corinne\AppData\Local\{414BE071-C180-4B12-AC24-5C6C49630909}\chrome\content\overlay.xul
    C:\Users\Corinne\AppData\Local\{414BE071-C180-4B12-AC24-5C6C49630909}\install.rdf
    C:\Users\Corinne\AppData\Roaming\.#


    ((((((((((((((((((((((((( Files Created from 2011-05-07 to 2011-06-07 )))))))))))))))))))))))))))))))


    2011-06-07 03:03:38 . 2011-06-07 03:03:38 -------- d-----w- C:\Users\Default\AppData\Local\temp
    2011-06-06 15:24:04 . 2011-06-06 15:24:16 -------- d-----w- C:\Users\Corinne\AppData\Local\{BEB5018F-ED05-444D-9E55-DC46E3DDE24F}
    2011-06-03 16:41:12 . 2011-06-03 16:41:12 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Malwarebytes
    2011-06-03 16:40:48 . 2010-12-20 22:09:00 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    2011-06-03 16:40:46 . 2011-06-03 16:40:46 -------- d-----w- C:\ProgramData\Malwarebytes
    2011-06-03 16:40:43 . 2011-06-03 16:40:50 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2011-06-03 16:40:43 . 2010-12-20 22:08:40 24152 ----a-w- C:\Windows\system32\drivers\mbam.sys
    2011-06-03 13:01:36 . 2011-06-03 13:01:47 -------- d-----w- C:\Users\Corinne\AppData\Local\{3C5EDF73-F2FA-496C-AEB8-43D697C18003}
    2011-06-02 13:04:07 . 2011-06-02 13:04:18 -------- d-----w- C:\Users\Corinne\AppData\Local\{0338694F-F134-4901-B03B-7A90307E5990}
    2011-06-01 12:41:54 . 2011-06-01 12:42:05 -------- d-----w- C:\Users\Corinne\AppData\Local\{C1A829AD-4B80-44D6-928D-D9A8772EB614}
    2011-05-31 16:12:43 . 2011-05-31 16:12:54 -------- d-----w- C:\Users\Corinne\AppData\Local\{BC426DAE-E278-4F7B-9897-C6C6D2777D56}
    2011-05-30 13:54:08 . 2011-05-30 13:54:19 -------- d-----w- C:\Users\Corinne\AppData\Local\{DEA223F2-19BF-4037-BC20-E625D65FC618}
    2011-05-30 13:47:45 . 2011-05-30 13:48:44 -------- d-----w- C:\Users\Corinne\AppData\Local\V-Safe 100
    2011-05-27 13:23:37 . 2011-05-27 13:23:48 -------- d-----w- C:\Users\Corinne\AppData\Local\{EE0BC9BB-7221-4E97-89B8-69AAD5482AFB}
    2011-05-26 13:37:49 . 2011-05-26 13:38:01 -------- d-----w- C:\Users\Corinne\AppData\Local\{444C4A77-FC2D-4F95-940D-5724B1F7B90A}
    2011-05-25 12:47:23 . 2011-05-25 12:47:34 -------- d-----w- C:\Users\Corinne\AppData\Local\{62526844-F220-4F92-AEE6-3B1713B438F3}
    2011-05-24 13:03:04 . 2011-05-24 13:03:15 -------- d-----w- C:\Users\Corinne\AppData\Local\{B515DAF0-43B9-4174-8824-6646DE3C901B}
    2011-05-23 14:09:46 . 2011-05-23 14:09:46 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2011-05-20 20:10:37 . 2011-05-20 20:10:48 -------- d-----w- C:\Users\Corinne\AppData\Local\{A90AC1E1-F8BB-4D33-85F1-8D34550E1F2D}
    2011-05-19 18:38:54 . 2011-04-09 06:58:56 142336 ----a-w- C:\Windows\system32\poqexec.exe
    2011-05-19 18:38:54 . 2011-04-09 05:56:38 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe
    2011-05-18 12:57:12 . 2011-05-18 12:57:24 -------- d-----w- C:\Users\Corinne\AppData\Local\{0644845A-B935-4376-83CF-CF3779B321D4}
    2011-05-17 13:29:30 . 2011-05-17 13:29:41 -------- d-----w- C:\Users\Corinne\AppData\Local\{28DCE2ED-4AE0-41D8-9014-679171620646}
    2011-05-17 01:29:04 . 2011-05-17 01:29:15 -------- d-----w- C:\Users\Corinne\AppData\Local\{8C4B56F8-6DCB-4880-AE2A-E27811CEA730}
    2011-05-16 12:44:06 . 2011-05-16 12:44:18 -------- d-----w- C:\Users\Corinne\AppData\Local\{0D48E7C7-A41E-4941-97F9-70B33F97868B}
    2011-05-15 19:58:47 . 2011-05-15 19:59:10 -------- d-----w- C:\ProgramData\regid.1986-12.com.adobe
    2011-05-15 19:05:06 . 2011-05-15 19:06:44 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Download Manager
    2011-05-14 00:50:50 . 2011-05-29 04:15:24 -------- d-----w- C:\Users\Corinne\AppData\Roaming\skypePM
    2011-05-14 00:50:50 . 2011-05-28 20:46:56 -------- d-----w- C:\ProgramData\Skype Extras
    2011-05-14 00:49:47 . 2011-05-29 05:39:05 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Skype
    2011-05-14 00:49:19 . 2011-05-14 00:49:19 -------- d-----w- C:\Program Files (x86)\Common Files\Skype
    2011-05-14 00:49:15 . 2011-05-14 00:49:36 -------- d-----r- C:\Program Files (x86)\Skype
    2011-05-14 00:49:11 . 2011-05-14 00:49:14 -------- d-----w- C:\ProgramData\Skype
    2011-05-13 18:54:35 . 2011-05-13 18:54:35 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Leadertech
    2011-05-13 18:45:47 . 2007-09-07 21:33:50 135168 ----a-w- C:\Windows\SysWow64\EEBAPI.dll
    2011-05-13 18:45:47 . 2007-03-28 22:26:42 65536 ----a-w- C:\Windows\SysWow64\EEBUtil.dll
    2011-05-13 18:45:47 . 2006-12-19 22:31:12 110592 ----a-w- C:\Windows\SysWow64\EEBDSCVR.dll
    2011-05-13 18:45:47 . 2006-12-19 22:20:20 77824 ----a-w- C:\Windows\SysWow64\EBAPI.dll
    2011-05-13 18:45:47 . 2003-12-17 05:01:00 55808 ----a-w- C:\Windows\SysWow64\EEBSDKIF.dll
    2011-05-13 18:45:43 . 2011-05-13 18:45:43 -------- d-----w- C:\Program Files\Common Files\EPSON
    2011-05-13 18:44:06 . 2011-05-13 18:44:06 -------- d-----w- C:\Program Files (x86)\EpsonNet
    2011-05-13 18:43:32 . 2010-09-13 19:01:36 538112 ----a-w- C:\Windows\system32\ensppui.dll
    2011-05-13 18:43:32 . 2010-09-13 19:01:36 538112 ----a-w- C:\Windows\system32\enppui.dll
    2011-05-13 18:43:32 . 2010-09-13 19:00:30 558592 ----a-w- C:\Windows\system32\ensppmon.dll
    2011-05-13 18:43:32 . 2010-09-13 19:00:30 558592 ----a-w- C:\Windows\system32\enppmon.dll
    2011-05-13 18:43:32 . 2008-06-18 15:49:14 250880 ----a-w- C:\Windows\system32\enspres.dll
    2011-05-13 18:43:32 . 2008-06-18 15:49:14 250880 ----a-w- C:\Windows\system32\enpres.dll
    2011-05-13 17:41:27 . 2011-05-13 17:41:38 -------- d-----w- C:\Users\Corinne\AppData\Local\{A2A8DFE7-1ED1-4204-AC43-239EE9B784FE}
    2011-05-13 15:37:43 . 2009-12-09 04:00:00 464384 ----a-w- C:\Windows\system32\esxw2ud.dll
    2011-05-13 15:37:43 . 2009-05-01 04:00:00 17408 ----a-w- C:\Windows\system32\esxcdev.dll
    2011-05-13 15:37:43 . 2009-05-01 04:00:00 128392 ----a-w- C:\Windows\system32\esdevapp.exe
    2011-05-12 21:38:00 . 2011-05-13 18:43:33 -------- d-----w- C:\Program Files\EpsonNet
    2011-05-12 21:37:31 . 2011-05-13 18:45:46 -------- d-----w- C:\Program Files (x86)\Common Files\EPSON
    2011-05-12 21:36:55 . 2011-05-12 22:06:38 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Epson
    2011-05-12 21:35:43 . 2011-05-13 15:40:06 -------- d-----w- C:\Program Files (x86)\Epson Software
    2011-05-12 21:34:29 . 2006-10-20 04:10:00 501912 ----a-w- C:\Windows\SysWow64\PICSDK2.dll
    2011-05-12 21:34:28 . 2006-10-31 04:10:00 51360 ----a-w- C:\Windows\SysWow64\EpPicPrt.dll
    2011-05-12 21:34:28 . 2006-10-31 04:10:00 51360 ----a-w- C:\Windows\SysWow64\EpPicMgr.dll
    2011-05-12 21:34:28 . 2006-10-20 04:10:00 80024 ----a-w- C:\Windows\SysWow64\PICSDK.dll
    2011-05-12 21:34:28 . 2006-10-20 04:10:00 108704 ----a-w- C:\Windows\SysWow64\PICEntry.dll
    2011-05-12 21:34:26 . 2011-05-12 21:34:26 -------- d-----w- C:\Users\Corinne\AppData\Roaming\InstallShield
    2011-05-12 21:34:00 . 2008-11-12 02:00:00 118784 ----a-w- C:\Windows\system32\E_ILMGBA.DLL
    2011-05-12 21:33:56 . 2009-10-01 03:01:00 88064 ----a-w- C:\Windows\system32\E_IBCBGBA.DLL
    2011-05-12 21:33:43 . 2011-05-13 18:45:43 -------- d-----w- C:\ProgramData\EPSON
    2011-05-12 21:33:11 . 2011-05-13 15:40:06 -------- d-----w- C:\Program Files (x86)\epson
    2011-05-12 18:14:15 . 2011-05-12 18:14:25 -------- d-----w- C:\Users\Corinne\AppData\Local\{0D324B99-EB6C-4A35-B4E2-F31E5A2B4C38}
    2011-05-11 16:45:20 . 2011-05-11 16:45:30 -------- d-----w- C:\Users\Corinne\AppData\Local\{7F7AC2B2-D7F7-4343-8D4C-96DBD7E38F6C}
    2011-05-11 16:45:07 . 2011-05-12 21:38:47 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Windows Live Writer
    2011-05-11 16:45:07 . 2011-05-11 16:45:16 -------- d-----w- C:\Users\Corinne\AppData\Local\Windows Live Writer
    2011-05-11 15:43:36 . 2011-05-11 15:43:36 -------- d-----w- C:\Windows\en
    2011-05-11 15:33:25 . 2011-05-11 15:33:25 -------- d-----w- C:\Program Files\Windows Live
    2011-05-11 12:24:24 . 2011-04-09 06:45:48 5509504 ----a-w- C:\Windows\system32\ntoskrnl.exe
    2011-05-11 12:24:23 . 2011-04-09 06:13:06 3957632 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2011-05-11 12:24:22 . 2011-04-09 06:13:06 3901824 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2011-05-10 18:53:32 . 2011-02-16 23:00:38 17370496 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSO - Copy.DLL
    2011-05-10 18:52:01 . 2011-02-16 23:00:38 17370496 ----a-w- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL
    2011-05-10 17:02:36 . 2011-05-10 17:02:37 -------- d-----w- C:\Program Files (x86)\PowerISO
    2011-05-10 17:02:36 . 2010-04-12 08:55:00 91568 ----a-w- C:\Windows\system32\drivers\scdemu.sys
    .


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    Thanks!
  6. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    The log is incomplete.
    Please, find your log here: C:\combofix.txt and repost it.
  7. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    Sorry, I missed the last part, does this look complete?

    ComboFix 11-06-06.02 - Corinne 06/06/2011 22:46:31.1.2 - x64
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.4095.2033 [GMT -4:00]
    Running from: C:\Users\Corinne\Downloads\ComboFix.exe
    AV: BitDefender Antivirus *Disabled/Updated* {982ADE23-275B-0766-37C5-DE01A484098E}
    FW: BitDefender Firewall *Disabled* {A0115F06-6D34-063E-1C9A-77345A574EF5}
    SP: BitDefender Antispyware *Disabled/Updated* {234B3FC7-0161-08E8-0D75-E573DF034333}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\ProgramData\FullRemove.exe
    C:\Users\Corinne\AppData\Local\{414BE071-C180-4B12-AC24-5C6C49630909}
    C:\Users\Corinne\AppData\Local\{414BE071-C180-4B12-AC24-5C6C49630909}\chrome.manifest
    C:\Users\Corinne\AppData\Local\{414BE071-C180-4B12-AC24-5C6C49630909}\chrome\content\_cfg.js
    C:\Users\Corinne\AppData\Local\{414BE071-C180-4B12-AC24-5C6C49630909}\chrome\content\overlay.xul
    C:\Users\Corinne\AppData\Local\{414BE071-C180-4B12-AC24-5C6C49630909}\install.rdf
    C:\Users\Corinne\AppData\Roaming\.#


    ((((((((((((((((((((((((( Files Created from 2011-05-07 to 2011-06-07 )))))))))))))))))))))))))))))))


    2011-06-07 03:03:38 . 2011-06-07 03:03:38 -------- d-----w- C:\Users\Default\AppData\Local\temp
    2011-06-06 15:24:04 . 2011-06-06 15:24:16 -------- d-----w- C:\Users\Corinne\AppData\Local\{BEB5018F-ED05-444D-9E55-DC46E3DDE24F}
    2011-06-03 16:41:12 . 2011-06-03 16:41:12 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Malwarebytes
    2011-06-03 16:40:48 . 2010-12-20 22:09:00 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    2011-06-03 16:40:46 . 2011-06-03 16:40:46 -------- d-----w- C:\ProgramData\Malwarebytes
    2011-06-03 16:40:43 . 2011-06-03 16:40:50 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2011-06-03 16:40:43 . 2010-12-20 22:08:40 24152 ----a-w- C:\Windows\system32\drivers\mbam.sys
    2011-06-03 13:01:36 . 2011-06-03 13:01:47 -------- d-----w- C:\Users\Corinne\AppData\Local\{3C5EDF73-F2FA-496C-AEB8-43D697C18003}
    2011-06-02 13:04:07 . 2011-06-02 13:04:18 -------- d-----w- C:\Users\Corinne\AppData\Local\{0338694F-F134-4901-B03B-7A90307E5990}
    2011-06-01 12:41:54 . 2011-06-01 12:42:05 -------- d-----w- C:\Users\Corinne\AppData\Local\{C1A829AD-4B80-44D6-928D-D9A8772EB614}
    2011-05-31 16:12:43 . 2011-05-31 16:12:54 -------- d-----w- C:\Users\Corinne\AppData\Local\{BC426DAE-E278-4F7B-9897-C6C6D2777D56}
    2011-05-30 13:54:08 . 2011-05-30 13:54:19 -------- d-----w- C:\Users\Corinne\AppData\Local\{DEA223F2-19BF-4037-BC20-E625D65FC618}
    2011-05-30 13:47:45 . 2011-05-30 13:48:44 -------- d-----w- C:\Users\Corinne\AppData\Local\V-Safe 100
    2011-05-27 13:23:37 . 2011-05-27 13:23:48 -------- d-----w- C:\Users\Corinne\AppData\Local\{EE0BC9BB-7221-4E97-89B8-69AAD5482AFB}
    2011-05-26 13:37:49 . 2011-05-26 13:38:01 -------- d-----w- C:\Users\Corinne\AppData\Local\{444C4A77-FC2D-4F95-940D-5724B1F7B90A}
    2011-05-25 12:47:23 . 2011-05-25 12:47:34 -------- d-----w- C:\Users\Corinne\AppData\Local\{62526844-F220-4F92-AEE6-3B1713B438F3}
    2011-05-24 13:03:04 . 2011-05-24 13:03:15 -------- d-----w- C:\Users\Corinne\AppData\Local\{B515DAF0-43B9-4174-8824-6646DE3C901B}
    2011-05-23 14:09:46 . 2011-05-23 14:09:46 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2011-05-20 20:10:37 . 2011-05-20 20:10:48 -------- d-----w- C:\Users\Corinne\AppData\Local\{A90AC1E1-F8BB-4D33-85F1-8D34550E1F2D}
    2011-05-19 18:38:54 . 2011-04-09 06:58:56 142336 ----a-w- C:\Windows\system32\poqexec.exe
    2011-05-19 18:38:54 . 2011-04-09 05:56:38 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe
    2011-05-18 12:57:12 . 2011-05-18 12:57:24 -------- d-----w- C:\Users\Corinne\AppData\Local\{0644845A-B935-4376-83CF-CF3779B321D4}
    2011-05-17 13:29:30 . 2011-05-17 13:29:41 -------- d-----w- C:\Users\Corinne\AppData\Local\{28DCE2ED-4AE0-41D8-9014-679171620646}
    2011-05-17 01:29:04 . 2011-05-17 01:29:15 -------- d-----w- C:\Users\Corinne\AppData\Local\{8C4B56F8-6DCB-4880-AE2A-E27811CEA730}
    2011-05-16 12:44:06 . 2011-05-16 12:44:18 -------- d-----w- C:\Users\Corinne\AppData\Local\{0D48E7C7-A41E-4941-97F9-70B33F97868B}
    2011-05-15 19:58:47 . 2011-05-15 19:59:10 -------- d-----w- C:\ProgramData\regid.1986-12.com.adobe
    2011-05-15 19:05:06 . 2011-05-15 19:06:44 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Download Manager
    2011-05-14 00:50:50 . 2011-05-29 04:15:24 -------- d-----w- C:\Users\Corinne\AppData\Roaming\skypePM
    2011-05-14 00:50:50 . 2011-05-28 20:46:56 -------- d-----w- C:\ProgramData\Skype Extras
    2011-05-14 00:49:47 . 2011-05-29 05:39:05 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Skype
    2011-05-14 00:49:19 . 2011-05-14 00:49:19 -------- d-----w- C:\Program Files (x86)\Common Files\Skype
    2011-05-14 00:49:15 . 2011-05-14 00:49:36 -------- d-----r- C:\Program Files (x86)\Skype
    2011-05-14 00:49:11 . 2011-05-14 00:49:14 -------- d-----w- C:\ProgramData\Skype
    2011-05-13 18:54:35 . 2011-05-13 18:54:35 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Leadertech
    2011-05-13 18:45:47 . 2007-09-07 21:33:50 135168 ----a-w- C:\Windows\SysWow64\EEBAPI.dll
    2011-05-13 18:45:47 . 2007-03-28 22:26:42 65536 ----a-w- C:\Windows\SysWow64\EEBUtil.dll
    2011-05-13 18:45:47 . 2006-12-19 22:31:12 110592 ----a-w- C:\Windows\SysWow64\EEBDSCVR.dll
    2011-05-13 18:45:47 . 2006-12-19 22:20:20 77824 ----a-w- C:\Windows\SysWow64\EBAPI.dll
    2011-05-13 18:45:47 . 2003-12-17 05:01:00 55808 ----a-w- C:\Windows\SysWow64\EEBSDKIF.dll
    2011-05-13 18:45:43 . 2011-05-13 18:45:43 -------- d-----w- C:\Program Files\Common Files\EPSON
    2011-05-13 18:44:06 . 2011-05-13 18:44:06 -------- d-----w- C:\Program Files (x86)\EpsonNet
    2011-05-13 18:43:32 . 2010-09-13 19:01:36 538112 ----a-w- C:\Windows\system32\ensppui.dll
    2011-05-13 18:43:32 . 2010-09-13 19:01:36 538112 ----a-w- C:\Windows\system32\enppui.dll
    2011-05-13 18:43:32 . 2010-09-13 19:00:30 558592 ----a-w- C:\Windows\system32\ensppmon.dll
    2011-05-13 18:43:32 . 2010-09-13 19:00:30 558592 ----a-w- C:\Windows\system32\enppmon.dll
    2011-05-13 18:43:32 . 2008-06-18 15:49:14 250880 ----a-w- C:\Windows\system32\enspres.dll
    2011-05-13 18:43:32 . 2008-06-18 15:49:14 250880 ----a-w- C:\Windows\system32\enpres.dll
    2011-05-13 17:41:27 . 2011-05-13 17:41:38 -------- d-----w- C:\Users\Corinne\AppData\Local\{A2A8DFE7-1ED1-4204-AC43-239EE9B784FE}
    2011-05-13 15:37:43 . 2009-12-09 04:00:00 464384 ----a-w- C:\Windows\system32\esxw2ud.dll
    2011-05-13 15:37:43 . 2009-05-01 04:00:00 17408 ----a-w- C:\Windows\system32\esxcdev.dll
    2011-05-13 15:37:43 . 2009-05-01 04:00:00 128392 ----a-w- C:\Windows\system32\esdevapp.exe
    2011-05-12 21:38:00 . 2011-05-13 18:43:33 -------- d-----w- C:\Program Files\EpsonNet
    2011-05-12 21:37:31 . 2011-05-13 18:45:46 -------- d-----w- C:\Program Files (x86)\Common Files\EPSON
    2011-05-12 21:36:55 . 2011-05-12 22:06:38 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Epson
    2011-05-12 21:35:43 . 2011-05-13 15:40:06 -------- d-----w- C:\Program Files (x86)\Epson Software
    2011-05-12 21:34:29 . 2006-10-20 04:10:00 501912 ----a-w- C:\Windows\SysWow64\PICSDK2.dll
    2011-05-12 21:34:28 . 2006-10-31 04:10:00 51360 ----a-w- C:\Windows\SysWow64\EpPicPrt.dll
    2011-05-12 21:34:28 . 2006-10-31 04:10:00 51360 ----a-w- C:\Windows\SysWow64\EpPicMgr.dll
    2011-05-12 21:34:28 . 2006-10-20 04:10:00 80024 ----a-w- C:\Windows\SysWow64\PICSDK.dll
    2011-05-12 21:34:28 . 2006-10-20 04:10:00 108704 ----a-w- C:\Windows\SysWow64\PICEntry.dll
    2011-05-12 21:34:26 . 2011-05-12 21:34:26 -------- d-----w- C:\Users\Corinne\AppData\Roaming\InstallShield
    2011-05-12 21:34:00 . 2008-11-12 02:00:00 118784 ----a-w- C:\Windows\system32\E_ILMGBA.DLL
    2011-05-12 21:33:56 . 2009-10-01 03:01:00 88064 ----a-w- C:\Windows\system32\E_IBCBGBA.DLL
    2011-05-12 21:33:43 . 2011-05-13 18:45:43 -------- d-----w- C:\ProgramData\EPSON
    2011-05-12 21:33:11 . 2011-05-13 15:40:06 -------- d-----w- C:\Program Files (x86)\epson
    2011-05-12 18:14:15 . 2011-05-12 18:14:25 -------- d-----w- C:\Users\Corinne\AppData\Local\{0D324B99-EB6C-4A35-B4E2-F31E5A2B4C38}
    2011-05-11 16:45:20 . 2011-05-11 16:45:30 -------- d-----w- C:\Users\Corinne\AppData\Local\{7F7AC2B2-D7F7-4343-8D4C-96DBD7E38F6C}
    2011-05-11 16:45:07 . 2011-05-12 21:38:47 -------- d-----w- C:\Users\Corinne\AppData\Roaming\Windows Live Writer
    2011-05-11 16:45:07 . 2011-05-11 16:45:16 -------- d-----w- C:\Users\Corinne\AppData\Local\Windows Live Writer
    2011-05-11 15:43:36 . 2011-05-11 15:43:36 -------- d-----w- C:\Windows\en
    2011-05-11 15:33:25 . 2011-05-11 15:33:25 -------- d-----w- C:\Program Files\Windows Live
    2011-05-11 12:24:24 . 2011-04-09 06:45:48 5509504 ----a-w- C:\Windows\system32\ntoskrnl.exe
    2011-05-11 12:24:23 . 2011-04-09 06:13:06 3957632 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2011-05-11 12:24:22 . 2011-04-09 06:13:06 3901824 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2011-05-10 18:53:32 . 2011-02-16 23:00:38 17370496 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSO - Copy.DLL
    2011-05-10 18:52:01 . 2011-02-16 23:00:38 17370496 ----a-w- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL
    2011-05-10 17:02:36 . 2011-05-10 17:02:37 -------- d-----w- C:\Program Files (x86)\PowerISO
    2011-05-10 17:02:36 . 2010-04-12 08:55:00 91568 ----a-w- C:\Windows\system32\drivers\scdemu.sys
    .


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2011-06-06 20:09:11 . 2011-03-04 14:00:07 45056 ----a-w- C:\Windows\system32\acovcnt.exe
    2011-03-12 18:47:11 . 2010-06-24 15:33:56 18328 ----a-w- C:\ProgramData\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2011-03-11 06:19:26 . 2011-04-14 23:35:03 1359872 ----a-w- C:\Windows\system32\mfc42u.dll
    2011-03-11 06:19:26 . 2011-04-14 23:35:02 1395712 ----a-w- C:\Windows\system32\mfc42.dll
    2011-03-11 05:40:24 . 2011-04-14 23:35:02 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll
    2011-03-11 05:40:24 . 2011-04-14 23:35:01 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll
  8. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    No, it still doesn't.
    Try to re-run Combofix one more time.
  9. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    Ok so now I am having problems with Combofix. The first attempt "stalled" at the last screen saying it was completing the log report and preparing it.
    That is from one posted.

    The remaining scan attempts stalled at Step 50. I made sure no programs were operating and my bitdefender was disabled. I also did not click it.

    What do you think went wrong/ what should I do?

    Thank you!
  10. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Delete you Combofix file, download fresh one and try again.

    If still some problem, read my reply #4 starting at:
  11. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    Hi Broni,

    1. I tried operating ComboFix in Safe mode but I was not able to turn off my BitDefender and I did not want to risk "machine damage". Will it be ok if I still run it in Safe Mode if I turn it off before restarting into Safe mode? The message came up saying it was on and it could cause damage.

    2. I tried all 3 Rkill and they all "worked" but Combofix (from step 2) did not work with it.
    Here was RKill's first log:

    This log file is located at C:\rkill.log.
    Please post this only if requested to by the person helping you.
    Otherwise you can close this log when you wish.

    Rkill was run on 07/06/2011 at 22:16:54.
    Operating System: Windows 7 Home Premium


    Processes terminated by Rkill or while it was running:

    C:\Windows\SysWow64\rundll32.exe


    Rkill completed on 07/06/2011 at 22:17:13.
    ---------------------------------------------------------------



    PS Every time I run ComboFix it will stall on one stage then my bitDefendar (which is disabled) will pop up now and then. Some times it skips to the "preparing log" page and never goes anywhere from there. The most complete log I have was the first time I ran it.

    Thanks for your help!
     
  12. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Is it getting stuck, if you run it from Safe Mode?

    Are you still getting redirected?
  13. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    I haven't run it from Safe mode because I can't turn my anti-virus off from Safe Mode and I am worried for their so called "machine damage" from "unpredictable results" if I have my BitDefender running. Should it be ok to run in Safe mode?
  14. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Yes, go ahead.
  15. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    ok finally Combofix completed in Safe Mode!

    Here is the complete log:
    ComboFix 11-06-08.03 - Corinne 08/06/2011 23:30:42.8.2 - x64 MINIMAL
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.4095.3028 [GMT -4:00]
    Running from: c:\users\Corinne\Desktop\ComboFix.exe
    AV: BitDefender Antivirus *Disabled/Updated* {982ADE23-275B-0766-37C5-DE01A484098E}
    FW: BitDefender Firewall *Disabled* {A0115F06-6D34-063E-1C9A-77345A574EF5}
    SP: BitDefender Antispyware *Disabled/Updated* {234B3FC7-0161-08E8-0D75-E573DF034333}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-05-09 to 2011-06-09 )))))))))))))))))))))))))))))))
    .
    .
    2011-06-09 03:36 . 2011-06-09 03:36 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-06-08 17:20 . 2011-06-08 17:20 -------- d-----w- c:\users\Corinne\AppData\Local\{3A5AEF18-623A-4E16-911B-8DC6F78E3F37}
    2011-06-08 02:21 . 2011-06-08 02:24 -------- d-----w- C:\Corinne
    2011-06-07 17:00 . 2011-06-07 17:00 -------- d-----w- c:\users\Corinne\AppData\Local\{DE1D1C38-7683-4CB9-86CF-D415948F710D}
    2011-06-06 15:24 . 2011-06-06 15:24 -------- d-----w- c:\users\Corinne\AppData\Local\{BEB5018F-ED05-444D-9E55-DC46E3DDE24F}
    2011-06-03 16:41 . 2011-06-03 16:41 -------- d-----w- c:\users\Corinne\AppData\Roaming\Malwarebytes
    2011-06-03 16:40 . 2010-12-20 22:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
    2011-06-03 16:40 . 2011-06-03 16:40 -------- d-----w- c:\programdata\Malwarebytes
    2011-06-03 16:40 . 2011-06-03 16:40 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2011-06-03 16:40 . 2010-12-20 22:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-06-03 13:01 . 2011-06-03 13:01 -------- d-----w- c:\users\Corinne\AppData\Local\{3C5EDF73-F2FA-496C-AEB8-43D697C18003}
    2011-06-02 13:04 . 2011-06-02 13:04 -------- d-----w- c:\users\Corinne\AppData\Local\{0338694F-F134-4901-B03B-7A90307E5990}
    2011-06-01 12:41 . 2011-06-01 12:42 -------- d-----w- c:\users\Corinne\AppData\Local\{C1A829AD-4B80-44D6-928D-D9A8772EB614}
    2011-05-31 16:12 . 2011-05-31 16:12 -------- d-----w- c:\users\Corinne\AppData\Local\{BC426DAE-E278-4F7B-9897-C6C6D2777D56}
    2011-05-30 13:54 . 2011-05-30 13:54 -------- d-----w- c:\users\Corinne\AppData\Local\{DEA223F2-19BF-4037-BC20-E625D65FC618}
    2011-05-30 13:47 . 2011-05-30 13:48 -------- d-----w- c:\users\Corinne\AppData\Local\V-Safe 100
    2011-05-27 13:23 . 2011-05-27 13:23 -------- d-----w- c:\users\Corinne\AppData\Local\{EE0BC9BB-7221-4E97-89B8-69AAD5482AFB}
    2011-05-26 13:37 . 2011-05-26 13:38 -------- d-----w- c:\users\Corinne\AppData\Local\{444C4A77-FC2D-4F95-940D-5724B1F7B90A}
    2011-05-25 12:47 . 2011-05-25 12:47 -------- d-----w- c:\users\Corinne\AppData\Local\{62526844-F220-4F92-AEE6-3B1713B438F3}
    2011-05-24 13:03 . 2011-05-24 13:03 -------- d-----w- c:\users\Corinne\AppData\Local\{B515DAF0-43B9-4174-8824-6646DE3C901B}
    2011-05-23 14:09 . 2011-05-23 14:09 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2011-05-20 20:10 . 2011-05-20 20:10 -------- d-----w- c:\users\Corinne\AppData\Local\{A90AC1E1-F8BB-4D33-85F1-8D34550E1F2D}
    2011-05-19 18:38 . 2011-04-09 06:58 142336 ----a-w- c:\windows\system32\poqexec.exe
    2011-05-19 18:38 . 2011-04-09 05:56 123904 ----a-w- c:\windows\SysWow64\poqexec.exe
    2011-05-18 12:57 . 2011-05-18 12:57 -------- d-----w- c:\users\Corinne\AppData\Local\{0644845A-B935-4376-83CF-CF3779B321D4}
    2011-05-17 13:29 . 2011-05-17 13:29 -------- d-----w- c:\users\Corinne\AppData\Local\{28DCE2ED-4AE0-41D8-9014-679171620646}
    2011-05-17 01:29 . 2011-05-17 01:29 -------- d-----w- c:\users\Corinne\AppData\Local\{8C4B56F8-6DCB-4880-AE2A-E27811CEA730}
    2011-05-16 12:44 . 2011-05-16 12:44 -------- d-----w- c:\users\Corinne\AppData\Local\{0D48E7C7-A41E-4941-97F9-70B33F97868B}
    2011-05-15 19:58 . 2011-05-15 19:59 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
    2011-05-15 19:05 . 2011-05-15 19:06 -------- d-----w- c:\users\Corinne\AppData\Roaming\Download Manager
    2011-05-14 00:50 . 2011-05-29 04:15 -------- d-----w- c:\users\Corinne\AppData\Roaming\skypePM
    2011-05-14 00:50 . 2011-05-28 20:46 -------- d-----w- c:\programdata\Skype Extras
    2011-05-14 00:49 . 2011-05-29 05:39 -------- d-----w- c:\users\Corinne\AppData\Roaming\Skype
    2011-05-14 00:49 . 2011-05-14 00:49 -------- d-----w- c:\program files (x86)\Common Files\Skype
    2011-05-14 00:49 . 2011-05-14 00:49 -------- d-----r- c:\program files (x86)\Skype
    2011-05-14 00:49 . 2011-05-14 00:49 -------- d-----w- c:\programdata\Skype
    2011-05-13 18:54 . 2011-05-13 18:54 -------- d-----w- c:\users\Corinne\AppData\Roaming\Leadertech
    2011-05-13 18:45 . 2007-09-07 21:33 135168 ----a-w- c:\windows\SysWow64\EEBAPI.dll
    2011-05-13 18:45 . 2007-03-28 22:26 65536 ----a-w- c:\windows\SysWow64\EEBUtil.dll
    2011-05-13 18:45 . 2006-12-19 22:31 110592 ----a-w- c:\windows\SysWow64\EEBDSCVR.dll
    2011-05-13 18:45 . 2006-12-19 22:20 77824 ----a-w- c:\windows\SysWow64\EBAPI.dll
    2011-05-13 18:45 . 2003-12-17 05:01 55808 ----a-w- c:\windows\SysWow64\EEBSDKIF.dll
    2011-05-13 18:45 . 2011-05-13 18:45 -------- d-----w- c:\program files\Common Files\EPSON
    2011-05-13 18:44 . 2011-05-13 18:44 -------- d-----w- c:\program files (x86)\EpsonNet
    2011-05-13 18:43 . 2010-09-13 19:01 538112 ----a-w- c:\windows\system32\ensppui.dll
    2011-05-13 18:43 . 2010-09-13 19:01 538112 ----a-w- c:\windows\system32\enppui.dll
    2011-05-13 18:43 . 2010-09-13 19:00 558592 ----a-w- c:\windows\system32\ensppmon.dll
    2011-05-13 18:43 . 2010-09-13 19:00 558592 ----a-w- c:\windows\system32\enppmon.dll
    2011-05-13 18:43 . 2008-06-18 15:49 250880 ----a-w- c:\windows\system32\enspres.dll
    2011-05-13 18:43 . 2008-06-18 15:49 250880 ----a-w- c:\windows\system32\enpres.dll
    2011-05-13 17:41 . 2011-05-13 17:41 -------- d-----w- c:\users\Corinne\AppData\Local\{A2A8DFE7-1ED1-4204-AC43-239EE9B784FE}
    2011-05-13 15:37 . 2009-12-09 04:00 464384 ----a-w- c:\windows\system32\esxw2ud.dll
    2011-05-13 15:37 . 2009-05-01 04:00 17408 ----a-w- c:\windows\system32\esxcdev.dll
    2011-05-13 15:37 . 2009-05-01 04:00 128392 ----a-w- c:\windows\system32\esdevapp.exe
    2011-05-12 21:38 . 2011-05-13 18:43 -------- d-----w- c:\program files\EpsonNet
    2011-05-12 21:37 . 2011-05-13 18:45 -------- d-----w- c:\program files (x86)\Common Files\EPSON
    2011-05-12 21:36 . 2011-05-12 22:06 -------- d-----w- c:\users\Corinne\AppData\Roaming\Epson
    2011-05-12 21:35 . 2011-05-13 15:40 -------- d-----w- c:\program files (x86)\Epson Software
    2011-05-12 21:34 . 2006-10-20 04:10 501912 ----a-w- c:\windows\SysWow64\PICSDK2.dll
    2011-05-12 21:34 . 2006-10-31 04:10 51360 ----a-w- c:\windows\SysWow64\EpPicPrt.dll
    2011-05-12 21:34 . 2006-10-31 04:10 51360 ----a-w- c:\windows\SysWow64\EpPicMgr.dll
    2011-05-12 21:34 . 2006-10-20 04:10 80024 ----a-w- c:\windows\SysWow64\PICSDK.dll
    2011-05-12 21:34 . 2006-10-20 04:10 108704 ----a-w- c:\windows\SysWow64\PICEntry.dll
    2011-05-12 21:34 . 2011-05-12 21:34 -------- d-----w- c:\users\Corinne\AppData\Roaming\InstallShield
    2011-05-12 21:34 . 2008-11-12 02:00 118784 ----a-w- c:\windows\system32\E_ILMGBA.DLL
    2011-05-12 21:33 . 2009-10-01 03:01 88064 ----a-w- c:\windows\system32\E_IBCBGBA.DLL
    2011-05-12 21:33 . 2011-05-13 18:45 -------- d-----w- c:\programdata\EPSON
    2011-05-12 21:33 . 2011-05-13 15:40 -------- d-----w- c:\program files (x86)\epson
    2011-05-12 18:14 . 2011-05-12 18:14 -------- d-----w- c:\users\Corinne\AppData\Local\{0D324B99-EB6C-4A35-B4E2-F31E5A2B4C38}
    2011-05-11 16:45 . 2011-05-11 16:45 -------- d-----w- c:\users\Corinne\AppData\Local\{7F7AC2B2-D7F7-4343-8D4C-96DBD7E38F6C}
    2011-05-11 16:45 . 2011-05-12 21:38 -------- d-----w- c:\users\Corinne\AppData\Roaming\Windows Live Writer
    2011-05-11 16:45 . 2011-05-11 16:45 -------- d-----w- c:\users\Corinne\AppData\Local\Windows Live Writer
    2011-05-11 15:43 . 2011-05-11 15:43 -------- d-----w- c:\windows\en
    2011-05-11 15:33 . 2011-05-11 15:33 -------- d-----w- c:\program files\Windows Live
    2011-05-11 12:24 . 2011-04-09 06:45 5509504 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-05-11 12:24 . 2011-04-09 06:13 3957632 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
    2011-05-11 12:24 . 2011-04-09 06:13 3901824 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
    2011-05-10 18:53 . 2011-02-16 23:00 17370496 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\OFFICE12\MSO - Copy.DLL
    2011-05-10 18:52 . 2011-02-16 23:00 17370496 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL
    2011-05-10 17:02 . 2011-05-10 17:02 -------- d-----w- c:\program files (x86)\PowerISO
    2011-05-10 17:02 . 2010-04-12 08:55 91568 ----a-w- c:\windows\system32\drivers\scdemu.sys
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-06-09 01:53 . 2011-03-04 14:00 45056 ----a-w- c:\windows\system32\acovcnt.exe
    2011-03-12 18:47 . 2010-06-24 15:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2011-03-11 06:19 . 2011-04-14 23:35 1359872 ----a-w- c:\windows\system32\mfc42u.dll
    2011-03-11 06:19 . 2011-04-14 23:35 1395712 ----a-w- c:\windows\system32\mfc42.dll
    2011-03-11 05:40 . 2011-04-14 23:35 1137664 ----a-w- c:\windows\SysWow64\mfc42.dll
    2011-03-11 05:40 . 2011-04-14 23:35 1164288 ----a-w- c:\windows\SysWow64\mfc42u.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "Microsoft Pinyin IME Migration"="c:\progra~2\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE" [2008-11-04 33128]
    "UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
    "UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
    "ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2009-10-27 6998656]
    "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2009-08-20 170624]
    "HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-12-13 421160]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
    "PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
    "EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
    "FUFAXSTM"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-03 847872]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-10-25 932288]
    "Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2011-01-30 36760]
    "Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2011-01-30 821144]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    FancyStart daemon.lnk - c:\windows\Installer\{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}\_A1DDD39913A1970387B7B3.exe [2010-1-16 12862]
    SRS Premium Sound.lnk - c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe [2010-1-16 156952]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804]
    IME File REG_SZ IMSC12.IME
    .
    R1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\windows\system32\DRIVERS\BdfNdisf6.sys [x]
    R1 bdfwfpf;bdfwfpf;c:\program files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys [2010-05-04 89680]
    R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    R2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
    R2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
    R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2010\bdvedisk.sys [2010-05-04 103944]
    R2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [2009-09-14 166400]
    R2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2009-09-14 128512]
    R2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [2009-09-15 44312]
    R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\windows\SysWOW64\nvSCPAPISvr.exe [2009-12-11 239208]
    R3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [2009-10-20 278224]
    R3 BDFM;BDFM;c:\windows\system32\DRIVERS\bdfm.sys [x]
    R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
    R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-06-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2524423669-13035828-1011310499-1001Core.job
    - c:\users\Corinne\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-02 16:01]
    .
    2011-06-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2524423669-13035828-1011310499-1001UA.job
    - c:\users\Corinne\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-02 16:01]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
    @="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
    [HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
    2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
    @="{64174815-8D98-4CE6-8646-4C039977D808}"
    [HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
    2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Microsoft Pinyin IME Migration"="c:\progra~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE" [2008-10-25 60264]
    "EeeStorageBackup"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2009-11-26 1732608]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-11 16414824]
    "ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-09-30 621440]
    "AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-01 323584]
    "BitDefender Antiphishing Helper 32"="c:\program files\BitDefender\BitDefender 2010\Antispam32\IEShow.exe" [2009-10-19 71152]
    "BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2010\IEShow.exe" [2009-10-20 76296]
    "BDAgent"="c:\program files\BitDefender\BitDefender 2010\bdagent.exe" [2011-05-14 1699152]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uStart Page = about:blank
    uLocal Page = c:\windows\system32\blank.htm
    mStart Page = about:blank
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
    TCP: DhcpNameServer = 192.168.0.1
    FF - ProfilePath - c:\users\Corinne\AppData\Roaming\Mozilla\Firefox\Profiles\196v7hs0.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    Toolbar-Locked - (no file)
    AddRemove-ASUS_Screensaver - c:\windows\system32\ASUS_Screensaver.scr
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker3"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2011-06-08 23:37:52
    ComboFix-quarantined-files.txt 2011-06-09 03:37
    .
    Pre-Run: 52,234,641,408 bytes free
    Post-Run: 52,033,863,680 bytes free
    .
    - - End Of File - - 6949B639CCAE92B722B51F6A8D9093A0


    What do you think?

    Thanks!
  16. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Good job :)

    You didn't say:
    Combofix log looks good :)

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
  17. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    Broni,

    Nothing has redirected yet, but I will be working on Google more on Monday so I will know for sure then.

    I will let you know (crossing fingers).

    Thanks so much!
  18. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Very well :)

    Go ahead with OTL scan.
  19. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    Hi Broni,

    It appears to be fixed :) ! but I should still do the OTL scan?
  20. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    Absolutely. We have to check, if nothing else is hiding there.
  21. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    Hi Broni,
    I had to post one at a time due to their size
    Here is my Extras log:

    Extras:
    OTL Extras logfile created on: 6/14/2011 7:31:11 PM - Run 1
    OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Corinne\Desktop
    64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.7600.16385)
    Locale: 00000409 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    4.00 Gb Total Physical Memory | 2.71 Gb Available Physical Memory | 67.79% Memory free
    8.00 Gb Paging File | 6.38 Gb Available in Paging File | 79.76% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 116.44 Gb Total Space | 47.83 Gb Free Space | 41.08% Space Free | Partition Type: NTFS
    Drive D: | 334.67 Gb Total Space | 334.58 Gb Free Space | 99.97% Space Free | Partition Type: NTFS

    Computer Name: CORINNE-PC | User Name: Corinne | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

    [HKEY_USERS\S-1-5-21-2524423669-13035828-1011310499-1001\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %* File not found
    cmdfile [open] -- "%1" %* File not found
    comfile [open] -- "%1" %* File not found
    exefile [open] -- "%1" %* File not found
    helpfile [open] -- Reg Error: Key error.
    htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
    inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
    InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
    InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %* File not found
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1" File not found
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
    scrfile [open] -- "%1" /S File not found
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
    "{0C682623-8F66-46A8-B9B3-93FE1E66A001}" = iTunes
    "{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot
    "{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
    "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
    "{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
    "{90120000-0028-0404-1000-0000000FF1CE}" = Microsoft Office IME (Chinese (Traditional)) 2007
    "{90120000-0028-0804-1000-0000000FF1CE}" = Microsoft Office IME (Chinese (Simplified)) 2007
    "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
    "{90120000-002A-0401-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Arabic) 2007
    "{90120000-002A-0404-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Chinese (Traditional)) 2007
    "{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
    "{90120000-002A-040C-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (French) 2007
    "{90120000-002A-0416-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Portuguese (Brazil)) 2007
    "{90120000-002A-041E-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Thai) 2007
    "{90120000-002A-041F-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Turkish) 2007
    "{90120000-002A-0804-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Chinese (Simplified)) 2007
    "{90120000-002A-0816-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Portuguese (Portugal)) 2007
    "{90120000-002A-0C04-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Chinese (Traditional)) 2007
    "{90120000-002A-0C0A-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Spanish) 2007
    "{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
    "{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}" = ASUS Power4Gear Hybrid
    "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{963BFE7E-C350-4346-B43C-B02358306A45}" = Apple Mobile Device Support
    "{A149E33D-74B9-4033-9B53-A5DE82864850}" = BitDefender Internet Security 2010
    "{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
    "{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
    "{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
    "{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
    "{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour
    "{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}" = SRS Premium Sound Control Panel
    "{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
    "ASUS WebStorage" = ASUS WebStorage
    "Elantech" = ETDWare PS/2-x64 7.0.5.9_WHQL
    "EPSON WorkForce 630 Series" = EPSON WorkForce 630 Series Printer Uninstall
    "NVIDIA Drivers" = NVIDIA Drivers
    "USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    "{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}" = Epson Event Manager
    "{06585B02-F20D-4AB2-9A64-86EF2AE0F8F0}" = ASUS AI Recovery
    "{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
    "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
    "{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}" = Epson FAX Utility
    "{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
    "{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
    "{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
    "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
    "{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
    "{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 24
    "{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
    "{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
    "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
    "{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
    "{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print
    "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
    "{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
    "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
    "{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
    "{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
    "{5B65EF64-1DFA-414A-8C94-7BB726158E21}" = ControlDeck
    "{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
    "{64678DB1-3475-4674-80AD-4C07C4295A9B}_is1" = FLV to AVI 1.2
    "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
    "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
    "{6C3496DF-CC4C-4CDE-87A1-8657619EE2D6}_is1" = Game Park Console
    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}" = Chicken Invaders 2
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110304260}" = Island Wars 2
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110413757}" = Smileyville
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115233673}" = Dream Day Wedding Married in Manhattan
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-116864777}" = Piggly
    "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
    "{83E0E8FF-F256-4712-934D-DDDF15755B27}" = Sony Vegas Movie Studio Platinum 8.0
    "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
    "{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
    "{90120000-0015-0401-0000-0000000FF1CE}" = Microsoft Office Access MUI (Arabic) 2007
    "{90120000-0015-0401-0000-0000000FF1CE}_PROHYBRIDR_{F3C3851B-43B8-4B86-89BA-ECAD6518AD22}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0015-0404-0000-0000000FF1CE}" = Microsoft Office Access MUI (Chinese (Traditional)) 2007
    "{90120000-0015-0404-0000-0000000FF1CE}_PROHYBRIDR_{E600B433-47CB-4AFC-90BF-2958E8E7EF99}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
    "{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007
    "{90120000-0015-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0015-0416-0000-0000000FF1CE}" = Microsoft Office Access MUI (Portuguese (Brazil)) 2007
    "{90120000-0015-0416-0000-0000000FF1CE}_PROHYBRIDR_{02A880E2-B8B9-4BF5-8822-EA1374734E2E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0015-041E-0000-0000000FF1CE}" = Microsoft Office Access MUI (Thai) 2007
    "{90120000-0015-041E-0000-0000000FF1CE}_PROHYBRIDR_{E84AA79E-3E58-4E65-92AC-38E929EB96DF}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0015-041F-0000-0000000FF1CE}" = Microsoft Office Access MUI (Turkish) 2007
    "{90120000-0015-041F-0000-0000000FF1CE}_PROHYBRIDR_{1FD10452-5023-4673-A939-7A2D1B4DCCB1}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0015-0804-0000-0000000FF1CE}" = Microsoft Office Access MUI (Chinese (Simplified)) 2007
    "{90120000-0015-0804-0000-0000000FF1CE}_PROHYBRIDR_{18EBA2E9-1310-46B3-91A2-536B0F314F2B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0015-0816-0000-0000000FF1CE}" = Microsoft Office Access MUI (Portuguese (Portugal)) 2007
    "{90120000-0015-0816-0000-0000000FF1CE}_PROHYBRIDR_{C2EC91A8-CC39-45F7-9E46-62B85ADF9DF5}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0015-0C04-0000-0000000FF1CE}" = Microsoft Office Access MUI (Chinese (Traditional)) 2007
    "{90120000-0015-0C04-0000-0000000FF1CE}_PROHYBRIDR_{45EDF005-5D73-4D75-9BD7-3FC67DB6FD0D}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0015-0C0A-0000-0000000FF1CE}" = Microsoft Office Access MUI (Spanish) 2007
    "{90120000-0015-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0401-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Arabic) 2007
    "{90120000-0016-0401-0000-0000000FF1CE}_PROHYBRIDR_{F3C3851B-43B8-4B86-89BA-ECAD6518AD22}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0404-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Chinese (Traditional)) 2007
    "{90120000-0016-0404-0000-0000000FF1CE}_PROHYBRIDR_{E600B433-47CB-4AFC-90BF-2958E8E7EF99}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
    "{90120000-0016-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0416-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Portuguese (Brazil)) 2007
    "{90120000-0016-0416-0000-0000000FF1CE}_PROHYBRIDR_{02A880E2-B8B9-4BF5-8822-EA1374734E2E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-041E-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Thai) 2007
    "{90120000-0016-041E-0000-0000000FF1CE}_PROHYBRIDR_{E84AA79E-3E58-4E65-92AC-38E929EB96DF}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-041F-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Turkish) 2007
    "{90120000-0016-041F-0000-0000000FF1CE}_PROHYBRIDR_{1FD10452-5023-4673-A939-7A2D1B4DCCB1}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0804-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Chinese (Simplified)) 2007
    "{90120000-0016-0804-0000-0000000FF1CE}_PROHYBRIDR_{18EBA2E9-1310-46B3-91A2-536B0F314F2B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0816-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Portuguese (Portugal)) 2007
    "{90120000-0016-0816-0000-0000000FF1CE}_PROHYBRIDR_{C2EC91A8-CC39-45F7-9E46-62B85ADF9DF5}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0C04-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Chinese (Traditional)) 2007
    "{90120000-0016-0C04-0000-0000000FF1CE}_PROHYBRIDR_{45EDF005-5D73-4D75-9BD7-3FC67DB6FD0D}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0C0A-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Spanish) 2007
    "{90120000-0016-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0401-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Arabic) 2007
    "{90120000-0018-0401-0000-0000000FF1CE}_PROHYBRIDR_{F3C3851B-43B8-4B86-89BA-ECAD6518AD22}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0404-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Chinese (Traditional)) 2007
    "{90120000-0018-0404-0000-0000000FF1CE}_PROHYBRIDR_{E600B433-47CB-4AFC-90BF-2958E8E7EF99}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
    "{90120000-0018-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0416-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2007
    "{90120000-0018-0416-0000-0000000FF1CE}_PROHYBRIDR_{02A880E2-B8B9-4BF5-8822-EA1374734E2E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-041E-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Thai) 2007
    "{90120000-0018-041E-0000-0000000FF1CE}_PROHYBRIDR_{E84AA79E-3E58-4E65-92AC-38E929EB96DF}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-041F-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Turkish) 2007
    "{90120000-0018-041F-0000-0000000FF1CE}_PROHYBRIDR_{1FD10452-5023-4673-A939-7A2D1B4DCCB1}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0804-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Chinese (Simplified)) 2007
    "{90120000-0018-0804-0000-0000000FF1CE}_PROHYBRIDR_{18EBA2E9-1310-46B3-91A2-536B0F314F2B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0816-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Portuguese (Portugal)) 2007
    "{90120000-0018-0816-0000-0000000FF1CE}_PROHYBRIDR_{C2EC91A8-CC39-45F7-9E46-62B85ADF9DF5}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0C04-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Chinese (Traditional)) 2007
    "{90120000-0018-0C04-0000-0000000FF1CE}_PROHYBRIDR_{45EDF005-5D73-4D75-9BD7-3FC67DB6FD0D}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0C0A-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Spanish) 2007
    "{90120000-0018-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-0401-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Arabic) 2007
    "{90120000-0019-0401-0000-0000000FF1CE}_PROHYBRIDR_{F3C3851B-43B8-4B86-89BA-ECAD6518AD22}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-0404-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Chinese (Traditional)) 2007
    "{90120000-0019-0404-0000-0000000FF1CE}_PROHYBRIDR_{E600B433-47CB-4AFC-90BF-2958E8E7EF99}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
    "{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007
    "{90120000-0019-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-0416-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Portuguese (Brazil)) 2007
    "{90120000-0019-0416-0000-0000000FF1CE}_PROHYBRIDR_{02A880E2-B8B9-4BF5-8822-EA1374734E2E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-041E-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Thai) 2007
    "{90120000-0019-041E-0000-0000000FF1CE}_PROHYBRIDR_{E84AA79E-3E58-4E65-92AC-38E929EB96DF}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-041F-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Turkish) 2007
    "{90120000-0019-041F-0000-0000000FF1CE}_PROHYBRIDR_{1FD10452-5023-4673-A939-7A2D1B4DCCB1}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-0804-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Chinese (Simplified)) 2007
    "{90120000-0019-0804-0000-0000000FF1CE}_PROHYBRIDR_{18EBA2E9-1310-46B3-91A2-536B0F314F2B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-0816-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Portuguese (Portugal)) 2007
    "{90120000-0019-0816-0000-0000000FF1CE}_PROHYBRIDR_{C2EC91A8-CC39-45F7-9E46-62B85ADF9DF5}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-0C04-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Chinese (Traditional)) 2007
    "{90120000-0019-0C04-0000-0000000FF1CE}_PROHYBRIDR_{45EDF005-5D73-4D75-9BD7-3FC67DB6FD0D}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-0C0A-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Spanish) 2007
    "{90120000-0019-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-0401-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Arabic) 2007
    "{90120000-001A-0401-0000-0000000FF1CE}_PROHYBRIDR_{F3C3851B-43B8-4B86-89BA-ECAD6518AD22}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-0404-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Chinese (Traditional)) 2007
    "{90120000-001A-0404-0000-0000000FF1CE}_PROHYBRIDR_{E600B433-47CB-4AFC-90BF-2958E8E7EF99}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
    "{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007
    "{90120000-001A-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-0416-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Portuguese (Brazil)) 2007
    "{90120000-001A-0416-0000-0000000FF1CE}_PROHYBRIDR_{02A880E2-B8B9-4BF5-8822-EA1374734E2E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-041E-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Thai) 2007
    "{90120000-001A-041E-0000-0000000FF1CE}_PROHYBRIDR_{E84AA79E-3E58-4E65-92AC-38E929EB96DF}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-041F-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Turkish) 2007
    "{90120000-001A-041F-0000-0000000FF1CE}_PROHYBRIDR_{1FD10452-5023-4673-A939-7A2D1B4DCCB1}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-0804-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Chinese (Simplified)) 2007
    "{90120000-001A-0804-0000-0000000FF1CE}_PROHYBRIDR_{18EBA2E9-1310-46B3-91A2-536B0F314F2B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-0816-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Portuguese (Portugal)) 2007
    "{90120000-001A-0816-0000-0000000FF1CE}_PROHYBRIDR_{C2EC91A8-CC39-45F7-9E46-62B85ADF9DF5}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-0C04-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Chinese (Traditional)) 2007
    "{90120000-001A-0C04-0000-0000000FF1CE}_PROHYBRIDR_{45EDF005-5D73-4D75-9BD7-3FC67DB6FD0D}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-0C0A-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Spanish) 2007
    "{90120000-001A-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0401-0000-0000000FF1CE}" = Microsoft Office Word MUI (Arabic) 2007
    "{90120000-001B-0401-0000-0000000FF1CE}_PROHYBRIDR_{F3C3851B-43B8-4B86-89BA-ECAD6518AD22}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0404-0000-0000000FF1CE}" = Microsoft Office Word MUI (Chinese (Traditional)) 2007
    "{90120000-001B-0404-0000-0000000FF1CE}_PROHYBRIDR_{E600B433-47CB-4AFC-90BF-2958E8E7EF99}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
    "{90120000-001B-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0416-0000-0000000FF1CE}" = Microsoft Office Word MUI (Portuguese (Brazil)) 2007
    "{90120000-001B-0416-0000-0000000FF1CE}_PROHYBRIDR_{02A880E2-B8B9-4BF5-8822-EA1374734E2E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-041E-0000-0000000FF1CE}" = Microsoft Office Word MUI (Thai) 2007
    "{90120000-001B-041E-0000-0000000FF1CE}_PROHYBRIDR_{E84AA79E-3E58-4E65-92AC-38E929EB96DF}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-041F-0000-0000000FF1CE}" = Microsoft Office Word MUI (Turkish) 2007
    "{90120000-001B-041F-0000-0000000FF1CE}_PROHYBRIDR_{1FD10452-5023-4673-A939-7A2D1B4DCCB1}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0804-0000-0000000FF1CE}" = Microsoft Office Word MUI (Chinese (Simplified)) 2007
    "{90120000-001B-0804-0000-0000000FF1CE}_PROHYBRIDR_{18EBA2E9-1310-46B3-91A2-536B0F314F2B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0816-0000-0000000FF1CE}" = Microsoft Office Word MUI (Portuguese (Portugal)) 2007
    "{90120000-001B-0816-0000-0000000FF1CE}_PROHYBRIDR_{C2EC91A8-CC39-45F7-9E46-62B85ADF9DF5}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0C04-0000-0000000FF1CE}" = Microsoft Office Word MUI (Chinese (Traditional)) 2007
    "{90120000-001B-0C04-0000-0000000FF1CE}_PROHYBRIDR_{45EDF005-5D73-4D75-9BD7-3FC67DB6FD0D}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0C0A-0000-0000000FF1CE}" = Microsoft Office Word MUI (Spanish) 2007
    "{90120000-001B-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
    "{90120000-001F-0401-0000-0000000FF1CE}_PROHYBRIDR_{14809F99-C601-4D4A-9391-F1E8FAA964C5}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0403-0000-0000000FF1CE}" = Microsoft Office Proof (Catalan) 2007
    "{90120000-001F-0403-0000-0000000FF1CE}_PROHYBRIDR_{4B47C31E-46B0-462B-BEE4-DC383B6A1F2A}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0404-0000-0000000FF1CE}" = Microsoft Office Proof (Chinese (Traditional)) 2007
    "{90120000-001F-0404-0000-0000000FF1CE}_PROHYBRIDR_{33FA7680-10ED-444E-BC72-214064317283}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
    "{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
    "{90120000-001F-0413-0000-0000000FF1CE}_PROHYBRIDR_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2007
    "{90120000-001F-0416-0000-0000000FF1CE}_PROHYBRIDR_{75EBE365-7FC5-4720-A7D3-804BF550D1BC}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-041E-0000-0000000FF1CE}" = Microsoft Office Proof (Thai) 2007
    "{90120000-001F-041E-0000-0000000FF1CE}_PROHYBRIDR_{0ED7C31A-FB21-4F8E-BD16-921A5E69B2C5}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-041F-0000-0000000FF1CE}" = Microsoft Office Proof (Turkish) 2007
    "{90120000-001F-041F-0000-0000000FF1CE}_PROHYBRIDR_{CB71F1CB-4CC3-47DE-B003-40413E64FE10}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-042D-0000-0000000FF1CE}" = Microsoft Office Proof (Basque) 2007
    "{90120000-001F-0456-0000-0000000FF1CE}" = Microsoft Office Proof (Galician) 2007
    "{90120000-001F-0804-0000-0000000FF1CE}" = Microsoft Office Proof (Chinese (Simplified)) 2007
    "{90120000-001F-0804-0000-0000000FF1CE}_PROHYBRIDR_{82E853AD-6911-4EA9-9EB0-2F9BE7747878}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0816-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Portugal)) 2007
    "{90120000-001F-0816-0000-0000000FF1CE}_PROHYBRIDR_{C312E1CD-EC19-4270-A072-F36F634DFF79}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-0028-0404-0000-0000000FF1CE}" = Microsoft Office IME (Chinese (Traditional)) 2007
    "{90120000-0028-0404-0000-0000000FF1CE}_PROHYBRIDR_{5E6C6E79-40BE-491B-9ABF-C665667E1B07}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0028-0404-1000-0000000FF1CE}_PROHYBRIDR_{1252D255-DB26-4F85-9F0F-D59B9DFE339E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0028-0804-0000-0000000FF1CE}" = Microsoft Office IME (Chinese (Simplified)) 2007
    "{90120000-0028-0804-0000-0000000FF1CE}_PROHYBRIDR_{4029CB10-E410-41AD-BB3F-052C95243407}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0028-0804-1000-0000000FF1CE}_PROHYBRIDR_{B45C4BDA-CDBB-4D65-8970-6ABB35BE81B8}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-0000-1000-0000000FF1CE}_PROHYBRIDR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-0401-1000-0000000FF1CE}_PROHYBRIDR_{C1547C6B-A758-4270-964E-4EE8D323C99D}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-0404-1000-0000000FF1CE}_PROHYBRIDR_{3F96DD0A-F509-4CBD-8130-B3B3194A9C3D}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-0409-1000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-040C-1000-0000000FF1CE}_PROHYBRIDR_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-0416-1000-0000000FF1CE}_PROHYBRIDR_{9A141B2B-7C5E-47D2-8E9E-9AC6018F3C42}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-041E-1000-0000000FF1CE}_PROHYBRIDR_{CEB4C8D4-2A39-45FD-B201-FBC950549C59}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-041F-1000-0000000FF1CE}_PROHYBRIDR_{5BAE8A52-83CD-4A7B-90B0-5EFB57FD78C8}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-0804-1000-0000000FF1CE}_PROHYBRIDR_{A844CE03-EE56-4609-808D-946E33AA9236}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-0816-1000-0000000FF1CE}_PROHYBRIDR_{A8523DA4-5563-4F0E-BD9D-4E4CC3CF7239}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-0C04-1000-0000000FF1CE}_PROHYBRIDR_{364CCAC1-F404-461B-8025-8586FC7CA772}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002A-0C0A-1000-0000000FF1CE}_PROHYBRIDR_{6113C11D-BACA-4D8E-8002-03C8D06FD5E6}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-002C-0401-0000-0000000FF1CE}" = Microsoft Office Proofing (Arabic) 2007
    "{90120000-002C-0404-0000-0000000FF1CE}" = Microsoft Office Proofing (Chinese (Traditional)) 2007
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
    "{90120000-002C-0416-0000-0000000FF1CE}" = Microsoft Office Proofing (Portuguese (Brazil)) 2007
    "{90120000-002C-041E-0000-0000000FF1CE}" = Microsoft Office Proofing (Thai) 2007
    "{90120000-002C-041F-0000-0000000FF1CE}" = Microsoft Office Proofing (Turkish) 2007
    "{90120000-002C-0804-0000-0000000FF1CE}" = Microsoft Office Proofing (Chinese (Simplified)) 2007
    "{90120000-002C-0816-0000-0000000FF1CE}" = Microsoft Office Proofing (Portuguese (Portugal)) 2007
    "{90120000-002C-0C04-0000-0000000FF1CE}" = Microsoft Office Proofing (Chinese (Traditional)) 2007
    "{90120000-002C-0C0A-0000-0000000FF1CE}" = Microsoft Office Proofing (Spanish) 2007
    "{90120000-006E-0401-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Arabic) 2007
    "{90120000-006E-0401-0000-0000000FF1CE}_PROHYBRIDR_{C1547C6B-A758-4270-964E-4EE8D323C99D}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-0404-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Chinese (Traditional)) 2007
    "{90120000-006E-0404-0000-0000000FF1CE}_PROHYBRIDR_{3F96DD0A-F509-4CBD-8130-B3B3194A9C3D}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
    "{90120000-006E-040C-0000-0000000FF1CE}_PROHYBRIDR_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-0416-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Portuguese (Brazil)) 2007
    "{90120000-006E-0416-0000-0000000FF1CE}_PROHYBRIDR_{9A141B2B-7C5E-47D2-8E9E-9AC6018F3C42}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-041E-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Thai) 2007
    "{90120000-006E-041E-0000-0000000FF1CE}_PROHYBRIDR_{CEB4C8D4-2A39-45FD-B201-FBC950549C59}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-041F-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Turkish) 2007
    "{90120000-006E-041F-0000-0000000FF1CE}_PROHYBRIDR_{5BAE8A52-83CD-4A7B-90B0-5EFB57FD78C8}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-0804-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Chinese (Simplified)) 2007
    "{90120000-006E-0804-0000-0000000FF1CE}_PROHYBRIDR_{A844CE03-EE56-4609-808D-946E33AA9236}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-0816-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Portuguese (Portugal)) 2007
    "{90120000-006E-0816-0000-0000000FF1CE}_PROHYBRIDR_{A8523DA4-5563-4F0E-BD9D-4E4CC3CF7239}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-0C04-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Chinese (Traditional)) 2007
    "{90120000-006E-0C04-0000-0000000FF1CE}_PROHYBRIDR_{364CCAC1-F404-461B-8025-8586FC7CA772}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-0C0A-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Spanish) 2007
    "{90120000-006E-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{6113C11D-BACA-4D8E-8002-03C8D06FD5E6}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
    "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0116-0409-1000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
    "{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
    "{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame
    "{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
    "{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
    "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
    "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
    "{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
    "{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
    "{AC76BA86-1033-F400-7760-000000000005}" = Adobe Acrobat X Pro - English, Français, Deutsch
    "{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
    "{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
    "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
    "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
    "{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
    "{C9D8A041-2963-4B31-8FFC-1500F3DB9293}" = EpsonNet Setup 3.3
    "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
    "{CF0EDB56-BBF6-3C9F-9C50-2E3B3D444641}" = Google Talk Plugin
    "{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
    "{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
    "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
    "{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
    "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
    "{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
    "{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
    "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
    "{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}" = ASUS FancyStart
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "{F4BF5F6B-F695-4762-AEB2-D095A4C34D89}" = Alcor Micro USB Card Reader
    "{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
    "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "ASUS AP Bank_is1" = ASUS AP Bank
    "ASUS_Screensaver" = ASUS_Screensaver
    "EPSON PC-FAX Driver 2" = Epson PC-FAX Driver
    "EPSON Scanner" = EPSON Scan
    "HOMESTUDENTR" = Microsoft Office Home and Student 2007
    "InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
    "InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
    "InstallShield_{F4BF5F6B-F695-4762-AEB2-D095A4C34D89}" = Alcor Micro USB Card Reader
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Mozilla Firefox (3.6.17)" = Mozilla Firefox (3.6.17)
    "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
    "PowerISO" = PowerISO
    "PROHYBRIDR" = 2007 Microsoft Office system
    "uTorrent" = µTorrent
    "WinLiveSuite" = Windows Live Essentials

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-2524423669-13035828-1011310499-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

    ========== Last 10 Event Log Errors ==========

    Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

    < End of report >
  22. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    OTL Log:

    OTL logfile created on: 6/14/2011 7:31:11 PM - Run 1
    OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Corinne\Desktop
    64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.7600.16385)
    Locale: 00000409 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    4.00 Gb Total Physical Memory | 2.71 Gb Available Physical Memory | 67.79% Memory free
    8.00 Gb Paging File | 6.38 Gb Available in Paging File | 79.76% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 116.44 Gb Total Space | 47.83 Gb Free Space | 41.08% Space Free | Partition Type: NTFS
    Drive D: | 334.67 Gb Total Space | 334.58 Gb Free Space | 99.97% Space Free | Partition Type: NTFS

    Computer Name: CORINNE-PC | User Name: Corinne | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/06/14 19:28:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Corinne\Desktop\OTL.exe
    PRC - [2011/01/30 11:45:14 | 000,821,144 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
    PRC - [2010/04/12 04:40:16 | 000,180,224 | ---- | M] (PowerISO Computing, Inc.) -- C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
    PRC - [2010/01/16 02:09:19 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe
    PRC - [2009/12/11 11:50:00 | 000,239,208 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWOW64\nvSCPAPISvr.exe
    PRC - [2009/12/03 10:12:12 | 000,976,320 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    PRC - [2009/11/24 17:45:36 | 000,053,888 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
    PRC - [2009/11/12 14:10:06 | 001,597,440 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
    PRC - [2009/11/09 23:20:36 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
    PRC - [2009/11/02 18:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
    PRC - [2009/10/27 00:29:32 | 006,998,656 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
    PRC - [2009/10/26 14:10:42 | 000,174,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
    PRC - [2009/08/20 00:31:48 | 000,170,624 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
    PRC - [2009/06/19 14:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
    PRC - [2009/06/19 14:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
    PRC - [2009/06/15 21:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
    PRC - [2009/05/18 19:58:38 | 000,305,720 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
    PRC - [2008/12/22 21:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
    PRC - [2008/08/14 01:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
    PRC - [2007/11/30 15:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
    PRC - [2006/12/19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe


    ========== Modules (SafeList) ==========

    MOD - [2011/06/14 19:28:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Corinne\Desktop\OTL.exe
    MOD - [2011/04/01 19:44:24 | 000,232,968 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) -- C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_75\midas32.dll
    MOD - [2010/08/21 01:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV:64bit: - [2011/03/07 23:09:37 | 000,409,672 | ---- | M] (BitDefender S.R.L.) [Auto | Running] -- C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe -- (LIVESRV)
    SRV:64bit: - [2010/04/01 18:38:51 | 000,393,728 | ---- | M] (S.C. BitDefender S.R.L) [On_Demand | Stopped] -- C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\scan.dll -- (scan)
    SRV:64bit: - [2010/04/01 18:38:09 | 002,299,656 | ---- | M] (BitDefender S.R.L.) [Auto | Running] -- C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe -- (VSSERV)
    SRV:64bit: - [2009/10/19 20:04:58 | 000,278,224 | ---- | M] (BitDefender S.R.L. http://www.bitdefender.com) [On_Demand | Stopped] -- C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe -- (Arrakis3)
    SRV:64bit: - [2009/09/17 15:36:34 | 000,359,552 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysNative\FBAgent.exe -- (AFBAgent)
    SRV:64bit: - [2009/09/14 05:00:00 | 000,166,400 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE -- (EPSON_EB_RPCV4_04)
    SRV:64bit: - [2009/09/14 05:00:00 | 000,128,512 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE -- (EPSON_PM_RPCV4_04)
    SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV - [2009/12/11 11:50:00 | 000,239,208 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Windows\SysWOW64\nvSCPAPISvr.exe -- (Stereo Service)
    SRV - [2009/11/09 23:20:36 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
    SRV - [2009/09/14 21:03:42 | 000,044,312 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService)
    SRV - [2009/06/15 21:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)
    SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
    SRV - [2006/12/19 18:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe -- (EpsonBidirectionalService)


    ========== Driver Services (SafeList) ==========

    DRV:64bit: - [2010/09/28 16:44:52 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
    DRV:64bit: - [2010/05/04 19:03:36 | 000,103,944 | ---- | M] (BitDefender) [Kernel | Auto | Running] -- C:\Program Files\BitDefender\BitDefender 2010\bdvedisk.sys -- (BDVEDISK)
    DRV:64bit: - [2010/05/04 19:03:34 | 000,089,680 | ---- | M] (BitDefender LLC) [Kernel | System | Running] -- C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys -- (bdfwfpf)
    DRV:64bit: - [2010/05/04 19:03:34 | 000,088,144 | ---- | M] (BitDefender LLC) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BdfNdisf6.sys -- (BdfNdisf)
    DRV:64bit: - [2010/04/01 18:38:20 | 000,347,336 | ---- | M] (BitDefender) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\bdfsfltr.sys -- (bdfsfltr)
    DRV:64bit: - [2010/02/09 20:50:10 | 000,163,936 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\bdfm.sys -- (BDFM)
    DRV:64bit: - [2009/10/15 05:23:19 | 000,117,760 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
    DRV:64bit: - [2009/10/05 12:33:59 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
    DRV:64bit: - [2009/08/21 00:24:03 | 000,084,512 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
    DRV:64bit: - [2009/08/18 14:44:19 | 000,236,544 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
    DRV:64bit: - [2009/07/20 13:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
    DRV:64bit: - [2009/07/13 21:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
    DRV:64bit: - [2009/07/13 21:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
    DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
    DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
    DRV:64bit: - [2009/07/13 21:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
    DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
    DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
    DRV:64bit: - [2009/06/10 16:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
    DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
    DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
    DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
    DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
    DRV:64bit: - [2009/06/05 14:15:55 | 001,806,400 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
    DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
    DRV:64bit: - [2009/05/13 13:07:20 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
    DRV:64bit: - [2008/05/23 21:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
    DRV - [2009/07/02 21:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank


    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    IE - HKU\S-1-5-21-2524423669-13035828-1011310499-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
    IE - HKU\S-1-5-21-2524423669-13035828-1011310499-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-2524423669-13035828-1011310499-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.search.suggest.enabled: false
    FF - prefs.js..browser.startup.homepage: "http://www.google.ca/"
    FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7280
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
    FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
    FF - prefs.js..extensions.enabledItems: FFToolbar@bitdefender.com:2.0
    FF - prefs.js..extensions.enabledItems: web2pdfextension@web2pdf.adobedotcom:1.0

    FF - HKLM\software\mozilla\Firefox\Extensions\\FFToolbar@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\ [2011/05/14 10:24:24 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011/06/10 11:39:03 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/05/02 10:52:52 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/06/10 11:39:58 | 000,000,000 | ---D | M]

    [2010/02/07 19:53:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Corinne\AppData\Roaming\Mozilla\Extensions
    [2011/06/14 16:55:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Corinne\AppData\Roaming\Mozilla\Firefox\Profiles\196v7hs0.default\extensions
    [2011/04/15 07:20:58 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Corinne\AppData\Roaming\Mozilla\Firefox\Profiles\196v7hs0.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
    [2010/12/27 12:03:34 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Corinne\AppData\Roaming\Mozilla\Firefox\Profiles\196v7hs0.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
    [2011/05/11 16:42:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Corinne\AppData\Roaming\Mozilla\Firefox\Profiles\196v7hs0.default\extensions\personas@christopher.beard
    [2011/05/26 11:08:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Corinne\AppData\Roaming\Mozilla\Firefox\Profiles\196v7hs0.default\extensions\staged-xpis
    [2011/05/13 20:49:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
    [2011/05/13 20:49:37 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
    [2010/11/30 13:46:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    [2010/11/30 19:10:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    [2011/01/19 10:38:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    [2011/02/18 10:09:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
    [2011/06/10 11:39:03 | 000,000,000 | ---D | M] (Adobe Acrobat - Create PDF) -- C:\PROGRAM FILES (X86)\ADOBE\ACROBAT 10.0\ACROBAT\BROWSER\WCFIREFOXEXTN
    [2011/05/14 10:24:24 | 000,000,000 | ---D | M] ("BitDefender Antiphishing Toolbar") -- C:\PROGRAM FILES\BITDEFENDER\BITDEFENDER 2010\BDAPHFFEXT
    [2011/02/02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

    O1 HOSTS File: ([2011/06/06 23:03:52 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O3:64bit: - HKLM\..\Toolbar: (BitDefender Toolbar) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2010\IEToolbar.dll (BitDefender S.R.L.)
    O3 - HKLM\..\Toolbar: (BitDefender Toolbar) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2010\Antispam32\IEToolbar.dll (BitDefender S.R.L.)
    O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3 - HKU\S-1-5-21-2524423669-13035828-1011310499-1001\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
    O3 - HKU\S-1-5-21-2524423669-13035828-1011310499-1001\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
    O4:64bit: - HKLM..\Run: [BDAgent] C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe (BitDefender S.R.L.)
    O4:64bit: - HKLM..\Run: [BitDefender Antiphishing Helper] C:\Program Files\BitDefender\BitDefender 2010\IEShow.exe (BitDefender S.R.L.)
    O4:64bit: - HKLM..\Run: [BitDefender Antiphishing Helper 32] C:\Program Files\BitDefender\BitDefender 2010\Antispam32\IEShow.exe (BitDefender S.R.L.)
    O4:64bit: - HKLM..\Run: [EeeStorageBackup] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe ()
    O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
    O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
    O4 - HKLM..\Run: [] File not found
    O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
    O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
    O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
    O4 - HKLM..\Run: [EEventManager] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
    O4 - HKLM..\Run: [FUFAXSTM] C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe (SEIKO EPSON CORPORATION)
    O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
    O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
    O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
    O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2524423669-13035828-1011310499-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2524423669-13035828-1011310499-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O8:64bit: - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8:64bit: - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8:64bit: - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
    O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
    O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
    O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
    O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
    O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
    O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O32 - HKLM CDRom: AutoRun - 1
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35:64bit: - HKLM\..comfile [open] -- "%1" %*
    O35:64bit: - HKLM\..exefile [open] -- "%1" %*
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*


    Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: VIDC.CFHD - C:\Windows\SysWow64\cfhd.dll (CineForm Inc.)
    Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/06/14 19:28:37 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Corinne\Desktop\OTL.exe
    [2011/06/10 20:36:39 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{AAECB3F6-77D7-4F9A-B82D-19B776422AF3}
    [2011/06/10 08:30:47 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{143A9479-963B-431A-ABE8-C40C4D896D66}
    [2011/06/08 23:40:12 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2011/06/08 23:37:54 | 000,000,000 | ---D | C] -- C:\Windows\temp
    [2011/06/08 13:20:01 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{3A5AEF18-623A-4E16-911B-8DC6F78E3F37}
    [2011/06/07 23:15:08 | 000,000,000 | ---D | C] -- C:\Corinne19412C
    [2011/06/07 22:21:15 | 000,000,000 | ---D | C] -- C:\Corinne
    [2011/06/07 13:00:25 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{DE1D1C38-7683-4CB9-86CF-D415948F710D}
    [2011/06/06 22:44:41 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2011/06/06 22:44:41 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2011/06/06 22:44:41 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2011/06/06 22:44:30 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2011/06/06 22:40:02 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/06/06 11:24:04 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{BEB5018F-ED05-444D-9E55-DC46E3DDE24F}
    [2011/06/03 12:41:12 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Roaming\Malwarebytes
    [2011/06/03 12:40:48 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    [2011/06/03 12:40:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/06/03 12:40:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2011/06/03 12:40:43 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
    [2011/06/03 12:40:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    [2011/06/03 09:01:36 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{3C5EDF73-F2FA-496C-AEB8-43D697C18003}
    [2011/06/02 09:04:07 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{0338694F-F134-4901-B03B-7A90307E5990}
    [2011/06/01 08:41:54 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{C1A829AD-4B80-44D6-928D-D9A8772EB614}
    [2011/05/31 12:12:43 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{BC426DAE-E278-4F7B-9897-C6C6D2777D56}
    [2011/05/30 09:54:08 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{DEA223F2-19BF-4037-BC20-E625D65FC618}
    [2011/05/30 09:47:45 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\V-Safe 100
    [2011/05/27 09:23:37 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{EE0BC9BB-7221-4E97-89B8-69AAD5482AFB}
    [2011/05/26 09:37:49 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{444C4A77-FC2D-4F95-940D-5724B1F7B90A}
    [2011/05/25 08:47:23 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{62526844-F220-4F92-AEE6-3B1713B438F3}
    [2011/05/24 09:03:04 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{B515DAF0-43B9-4174-8824-6646DE3C901B}
    [2011/05/20 16:10:37 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{A90AC1E1-F8BB-4D33-85F1-8D34550E1F2D}
    [2011/05/18 08:57:12 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{0644845A-B935-4376-83CF-CF3779B321D4}
    [2011/05/17 09:29:30 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{28DCE2ED-4AE0-41D8-9014-679171620646}
    [2011/05/16 21:29:04 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{8C4B56F8-6DCB-4880-AE2A-E27811CEA730}
    [2011/05/16 08:44:06 | 000,000,000 | ---D | C] -- C:\Users\Corinne\AppData\Local\{0D48E7C7-A41E-4941-97F9-70B33F97868B}
    [2 C:\Users\Corinne\Documents\*.tmp files -> C:\Users\Corinne\Documents\*.tmp -> ]
    [1 C:\Users\Corinne\Desktop\*.tmp files -> C:\Users\Corinne\Desktop\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2011/06/14 19:28:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Corinne\Desktop\OTL.exe
    [2011/06/14 19:25:38 | 000,000,916 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2524423669-13035828-1011310499-1001UA.job
    [2011/06/14 19:25:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2011/06/14 15:11:22 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    [2011/06/14 15:11:22 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    [2011/06/14 15:03:15 | 000,045,056 | ---- | M] () -- C:\Windows\SysNative\acovcnt.exe
    [2011/06/14 15:02:43 | 3220,647,936 | -HS- | M] () -- C:\hiberfil.sys
    [2011/06/14 13:57:00 | 000,000,864 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2524423669-13035828-1011310499-1001Core.job
    [2011/06/13 23:08:07 | 000,000,052 | ---- | M] () -- C:\Windows\SysNative\ashttpstats.csv
    [2011/06/13 09:45:51 | 000,002,028 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
    [2011/06/11 16:10:18 | 000,717,892 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
    [2011/06/11 16:10:18 | 000,622,546 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
    [2011/06/11 16:10:18 | 000,108,636 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
    [2011/06/07 21:34:43 | 000,789,272 | ---- | M] () -- C:\Users\Corinne\Documents\Corinne2011portfolioAssante.pdf
    [2011/06/06 23:03:52 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
    [2011/06/06 21:36:15 | 000,000,512 | ---- | M] () -- C:\Users\Corinne\Desktop\MBR.dat
    [2011/05/26 11:16:42 | 000,002,021 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
    [2 C:\Users\Corinne\Documents\*.tmp files -> C:\Users\Corinne\Documents\*.tmp -> ]
    [1 C:\Users\Corinne\Desktop\*.tmp files -> C:\Users\Corinne\Desktop\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011/06/07 21:34:43 | 000,789,272 | ---- | C] () -- C:\Users\Corinne\Documents\Corinne2011portfolioAssante.pdf
    [2011/06/06 22:44:41 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
    [2011/06/06 22:44:41 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2011/06/06 22:44:41 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2011/06/06 22:44:41 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2011/06/06 22:44:41 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2011/06/06 21:36:15 | 000,000,512 | ---- | C] () -- C:\Users\Corinne\Desktop\MBR.dat
    [2011/05/26 11:16:42 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
    [2011/05/26 11:16:42 | 000,002,021 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
    [2011/05/13 20:50:56 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
    [2011/05/12 17:34:29 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini
    [2011/05/12 17:34:28 | 000,073,220 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat
    [2011/05/12 17:34:28 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat
    [2011/05/12 17:34:28 | 000,029,114 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat
    [2011/05/12 17:34:28 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat
    [2011/05/12 17:34:28 | 000,021,021 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat
    [2011/05/12 17:34:28 | 000,015,670 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat
    [2011/05/12 17:34:28 | 000,013,280 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat
    [2011/05/12 17:34:28 | 000,010,673 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat
    [2011/05/12 17:34:28 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat
    [2011/05/12 17:34:28 | 000,001,140 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat
    [2011/05/12 17:34:28 | 000,001,140 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat
    [2011/05/12 17:34:28 | 000,001,137 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat
    [2011/05/12 17:34:28 | 000,001,130 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat
    [2011/05/12 17:34:28 | 000,001,130 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat
    [2011/05/12 17:34:28 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat
    [2011/05/12 17:17:28 | 000,000,149 | ---- | C] () -- C:\Windows\EWF630.ini
    [2011/01/18 11:20:14 | 000,722,802 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
    [2010/07/20 18:00:59 | 000,000,120 | ---- | C] () -- C:\Users\Corinne\AppData\Local\Okakewukuwupomu.dat
    [2010/07/20 18:00:59 | 000,000,000 | ---- | C] () -- C:\Users\Corinne\AppData\Local\Ynoweqovu.bin
    [2010/06/18 21:50:55 | 000,005,632 | ---- | C] () -- C:\Users\Corinne\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/02/16 21:07:27 | 000,000,025 | ---- | C] () -- C:\Users\Corinne\AppData\Roaming\bdfvconp.ini
    [2010/02/09 22:30:26 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
    [2010/02/06 06:45:31 | 000,000,034 | -H-- | C] () -- C:\Windows\SysWow64\Converter_sysquict.dat
    [2010/02/06 06:27:53 | 000,765,952 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
    [2010/02/06 06:27:53 | 000,383,238 | ---- | C] () -- C:\Windows\SysWow64\libmp3lame-0.dll
    [2010/01/16 01:44:20 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\LogonStart.dll
    [2009/12/11 11:50:00 | 000,095,848 | ---- | C] () -- C:\Windows\SysWow64\nvimage.dll
    [2009/10/25 23:38:20 | 000,000,176 | ---- | C] () -- C:\Windows\explorer.exe.config
    [2009/08/19 04:33:09 | 000,018,432 | ---- | C] () -- C:\Windows\OOBEPlayer.exe
    [2009/08/19 04:33:09 | 000,000,035 | ---- | C] () -- C:\Windows\OOBEPlayer.ini
    [2009/07/29 01:20:40 | 000,000,010 | ---- | C] () -- C:\Windows\SysWow64\ABLKSR.ini
    [2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
    [2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
    [2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
    [2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
    [2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
    [2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
    [2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

    ========== LOP Check ==========

    [2010/02/07 20:51:29 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\Asus WebStorage
    [2010/02/06 06:04:29 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\BitDefender
    [2010/09/17 12:36:56 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\EeeStorageUploader
    [2011/05/12 18:06:38 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\Epson
    [2011/04/22 14:04:39 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\F09CC6F2B729301E7CB04B23CB854AFF
    [2010/02/09 22:31:07 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\GameConsole
    [2010/03/30 20:06:33 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\GetRightToGo
    [2011/05/13 14:54:35 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\Leadertech
    [2010/02/06 05:46:09 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\Publish Providers
    [2010/02/06 05:46:04 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\Sony
    [2011/06/01 08:31:22 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\uTorrent
    [2011/05/12 17:38:47 | 000,000,000 | ---D | M] -- C:\Users\Corinne\AppData\Roaming\Windows Live Writer
    [2011/04/10 14:14:29 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < >

    < %SYSTEMDRIVE%\*.* >
    [2009/06/15 07:11:59 | 000,000,054 | ---- | M] () -- C:\AdobeReader.log
    [2011/05/14 10:10:53 | 000,179,598 | ---- | M] () -- C:\bdlog.txt
    [2009/07/13 21:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
    [2009/07/29 02:03:37 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
    [2011/06/08 23:37:52 | 000,021,151 | ---- | M] () -- C:\ComboFix.txt
    [2010/01/16 02:14:37 | 000,013,886 | ---- | M] () -- C:\devlist.txt
    [2010/01/16 02:14:37 | 000,000,009 | ---- | M] () -- C:\Finish.log
    [2011/06/14 15:02:43 | 3220,647,936 | -HS- | M] () -- C:\hiberfil.sys
    [2010/01/16 02:04:34 | 000,963,125 | ---- | M] () -- C:\inject.log.txt
    [2009/12/28 22:05:26 | 001,048,576 | -H-- | M] () -- C:\K40ID.BIN
    [2009/12/30 03:17:28 | 000,000,019 | ---- | M] () -- C:\K40ID_K50ID_WIN7.20
    [2009/12/28 21:54:23 | 001,048,576 | -H-- | M] () -- C:\K50ID.BIN
    [2009/06/11 21:32:00 | 000,000,057 | ---- | M] () -- C:\OFFICE2007_E.TXT
    [2011/06/14 15:02:46 | 4294,201,344 | -HS- | M] () -- C:\pagefile.sys
    [2010/01/15 11:28:53 | 000,000,146 | ---- | M] () -- C:\Pass.txt
    [2009/12/17 01:48:04 | 000,000,277 | ---- | M] () -- C:\Patch_Win7.log
    [2009/12/10 02:25:53 | 000,000,024 | ---- | M] () -- C:\RECOVERY.DAT
    [2010/01/16 02:07:38 | 000,003,263 | ---- | M] () -- C:\RHDSetup.log
    [2011/06/07 23:14:36 | 000,000,253 | ---- | M] () -- C:\rkill.log
    [2010/01/16 02:09:06 | 000,000,090 | ---- | M] () -- C:\setup.log
    [2006/05/14 04:22:24 | 000,000,005 | ---- | M] () -- C:\store.log
    [2010/01/16 01:32:01 | 000,000,170 | ---- | M] () -- C:\SumHidd.txt
    [2010/01/16 01:30:31 | 000,000,098 | ---- | M] () -- C:\SumOS.txt
    [2011/06/06 21:33:01 | 000,064,984 | ---- | M] () -- C:\TDSSKiller.2.5.3.0_06.06.2011_21.30.24_log.txt
    [2009/09/16 14:04:46 | 000,000,024 | ---- | M] () -- C:\v82.txt

    < %systemroot%\Fonts\*.com >
    [2009/07/14 01:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
    [2009/07/14 01:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
    [2009/07/14 01:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
    [2009/07/14 01:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2009/06/10 16:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >
    [2010/01/16 02:09:40 | 000,068,237 | ---- | M] () -- C:\Windows\AsCD_Stage145.jpg

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2010/11/10 02:28:46 | 000,301,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2009/07/14 00:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >
    [2009/10/25 23:38:20 | 000,000,176 | ---- | M] () -- C:\Windows\explorer.exe.config

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2010/02/06 05:36:06 | 000,000,221 | -HS- | M] () -- C:\Users\Corinne\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >
    [2011/06/14 19:28:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Corinne\Desktop\OTL.exe
    [1 C:\Users\Corinne\Desktop\*.tmp files -> C:\Users\Corinne\Desktop\*.tmp -> ]

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >
    [2009/06/10 17:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\addins\FXSEXT.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2010/08/04 10:38:04 | 000,000,402 | -HS- | M] () -- C:\Users\Corinne\Favorites\desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >
    [2010/01/16 01:46:29 | 000,000,105 | ---- | M] () -- C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
    [2010/01/16 01:45:33 | 000,000,107 | ---- | M] () -- C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    ========== Files - Unicode (All) ==========
    [2011/04/22 13:30:03 | 000,000,000 | ---D | M](C:\Users\Corinne\Favorites\??sorted Bookmarks) -- C:\Users\Corinne\Favorites\鑀“sorted Bookmarks

    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:B88E99C8

    < End of report >

    What do you think?

    Thanks!
  23. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    1. Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    2. Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    =====================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
      O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
      O3 - HKU\S-1-5-21-2524423669-13035828-1011310499-1001\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
      O4 - HKLM..\Run: [] File not found
      [2 C:\Users\Corinne\Documents\*.tmp files -> C:\Users\Corinne\Documents\*.tmp -> ]
      [1 C:\Users\Corinne\Desktop\*.tmp files -> C:\Users\Corinne\Desktop\*.tmp -> ]
      @Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:B88E99C8
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ====================================================================

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
  24. indierinrin

    indierinrin TS Rookie Topic Starter Posts: 18

    thanks I will get to this tomorrow!
  25. Broni

    Broni Malware Annihilator Posts: 46,775   +254

    OK...................
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.