TechSpot

Heur Win32 Help

By Chronogo
Jun 28, 2011
  1. Hello I've been having some troubles.

    Upon startup I have a Windows security popup that asks me if I wan't to allow hhsetupwow.exe to make changes to my hard drive. I of course say no but I think someone else using my laptop must have selected yes because things changed.

    Now upon startup I still have the same popup, but my security center now gives me alerts about this heur trojan and scans reveal the same.

    Of course guaranteeing does nothing.


    I went to the 7 step page and tried following the instructions ran MBAM and DDS but the GMER mirrors refuse to work.

    Oh and before I post the logs, after running the MBAM and removing the 100+ things found and restarting the problem SEEMS to have abated. Wondering if that means I'm safe or not. Also, I have the somewhat worthless CA security center..is there any free antivirus software I can run along with CA? Or is dual operation impossible?

    Logs:

    MBAM:

    Malwarebytes' Anti-Malware 1.51.0.1200
    www.malwarebytes.org

    Database version: 6972

    Windows 6.1.7600
    Internet Explorer 9.0.8112.16421

    6/28/2011 9:11:10 PM
    mbam-log-2011-06-28 (21-11-10).txt

    Scan type: Quick scan
    Objects scanned: 179496
    Time elapsed: 5 minute(s), 21 second(s)

    Memory Processes Infected: 58
    Memory Modules Infected: 1
    Registry Keys Infected: 6
    Registry Values Infected: 63
    Registry Data Items Infected: 1
    Folders Infected: 3
    Files Infected: 94

    Memory Processes Infected:
    c:\Windows\SysWOW64\iccvid32.exe (Trojan.Tracur.SGen) -> 3076 -> Unloaded process successfully.
    c:\programdata\icmui32.exe (Trojan.Tracur.SGen) -> 3212 -> Unloaded process successfully.
    c:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\20D8.tmp (Trojan.Tracur.SGen) -> 3264 -> Unloaded process successfully.
    c:\Windows\d3d10warpwow.exe (Trojan.Tracur.S) -> 5240 -> Unloaded process successfully.
    c:\Windows\d3d10warpwow.exe (Trojan.Tracur.S) -> 7828 -> Failed to unload process.
    c:\Windows\mciwavewow.exe (Trojan.Tracur.SGen) -> 6684 -> Failed to unload process.
    c:\Windows\mciwavewow.exe (Trojan.Tracur.SGen) -> 7472 -> Failed to unload process.
    c:\Windows\dimsjobwow.exe (Trojan.Tracur.SGen) -> 6760 -> Failed to unload process.
    c:\Windows\dimsjobwow.exe (Trojan.Tracur.SGen) -> 7480 -> Failed to unload process.
    c:\Windows\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> 6780 -> Failed to unload process.
    c:\Windows\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> 7488 -> Failed to unload process.
    c:\Windows\msasn1wow.exe (Trojan.Tracur.SGen) -> 6924 -> Failed to unload process.
    c:\Windows\msasn1wow.exe (Trojan.Tracur.SGen) -> 7496 -> Failed to unload process.
    c:\Windows\winrscmdwow.exe (Trojan.Tracur.SGen) -> 6936 -> Failed to unload process.
    c:\Windows\winrscmdwow.exe (Trojan.Tracur.SGen) -> 7504 -> Failed to unload process.
    c:\Windows\rastapiwow.exe (Trojan.Tracur.SGen) -> 7008 -> Failed to unload process.
    c:\Windows\rastapiwow.exe (Trojan.Tracur.SGen) -> 7580 -> Failed to unload process.
    c:\Windows\pstorecwow.exe (Trojan.Tracur.SGen) -> 7060 -> Failed to unload process.
    c:\Windows\pstorecwow.exe (Trojan.Tracur.SGen) -> 7684 -> Failed to unload process.
    c:\Windows\msoeacctwow.exe (Trojan.Tracur.SGen) -> 7068 -> Failed to unload process.
    c:\Windows\msoeacctwow.exe (Trojan.Tracur.SGen) -> 816 -> Failed to unload process.
    c:\Windows\eappprxywow.exe (Trojan.Tracur.SGen) -> 7076 -> Failed to unload process.
    c:\Windows\eappprxywow.exe (Trojan.Tracur.SGen) -> 7680 -> Failed to unload process.
    c:\Windows\dskquotawow.exe (Trojan.Tracur.SGen) -> 7088 -> Failed to unload process.
    c:\Windows\dskquotawow.exe (Trojan.Tracur.SGen) -> 7664 -> Failed to unload process.
    c:\Windows\kbdroprwow.exe (Trojan.Tracur.SGen) -> 7104 -> Failed to unload process.
    c:\Windows\kbdroprwow.exe (Trojan.Tracur.SGen) -> 7344 -> Failed to unload process.
    c:\Windows\vbajet32wow.exe (Trojan.Tracur.SGen) -> 7116 -> Failed to unload process.
    c:\Windows\vbajet32wow.exe (Trojan.Tracur.SGen) -> 6236 -> Failed to unload process.
    c:\Windows\msxml3awow.exe (Trojan.Tracur.SGen) -> 7164 -> Failed to unload process.
    c:\Windows\msxml3awow.exe (Trojan.Tracur.SGen) -> 4960 -> Failed to unload process.
    c:\Windows\olecli32wow.exe (Trojan.Tracur.SGen) -> 6308 -> Failed to unload process.
    c:\Windows\olecli32wow.exe (Trojan.Tracur.SGen) -> 7564 -> Failed to unload process.
    c:\Windows\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> 6440 -> Failed to unload process.
    c:\Windows\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> 5680 -> Failed to unload process.
    c:\Windows\dmrcwow.exe (Trojan.Tracur.SGen) -> 6556 -> Failed to unload process.
    c:\Windows\dmrcwow.exe (Trojan.Tracur.SGen) -> 4884 -> Failed to unload process.
    c:\Windows\d3drampwow.exe (Trojan.Tracur.SGen) -> 6564 -> Failed to unload process.
    c:\Windows\d3drampwow.exe (Trojan.Tracur.SGen) -> 5760 -> Failed to unload process.
    c:\Windows\framedynwow.exe (Trojan.Tracur.SGen) -> 5500 -> Failed to unload process.
    c:\Windows\framedynwow.exe (Trojan.Tracur.SGen) -> 2500 -> Failed to unload process.
    c:\Windows\dfscliwow.exe (Trojan.Tracur.SGen) -> 6772 -> Failed to unload process.
    c:\Windows\dfscliwow.exe (Trojan.Tracur.SGen) -> 4672 -> Failed to unload process.
    c:\Windows\bootvidwow.exe (Trojan.Tracur.SGen) -> 5468 -> Failed to unload process.
    c:\Windows\bootvidwow.exe (Trojan.Tracur.SGen) -> 6532 -> Failed to unload process.
    c:\Windows\scansettingwow.exe (Trojan.Tracur.SGen) -> 6732 -> Failed to unload process.
    c:\Windows\scansettingwow.exe (Trojan.Tracur.SGen) -> 4740 -> Failed to unload process.
    c:\Windows\msltus40wow.exe (Trojan.Tracur.SGen) -> 6900 -> Failed to unload process.
    c:\Windows\msltus40wow.exe (Trojan.Tracur.SGen) -> 5400 -> Failed to unload process.
    c:\Windows\wscapiwow.exe (Trojan.Tracur.SGen) -> 6904 -> Failed to unload process.
    c:\Windows\wscapiwow.exe (Trojan.Tracur.SGen) -> 6640 -> Failed to unload process.
    c:\Windows\kbdinhinwow.exe (Trojan.Tracur.SGen) -> 6360 -> Failed to unload process.
    c:\Windows\kbdinhinwow.exe (Trojan.Tracur.SGen) -> 4908 -> Failed to unload process.
    c:\Windows\kbdlt1wow.exe (Trojan.Tracur.SGen) -> 7140 -> Failed to unload process.
    c:\Windows\kbdlt1wow.exe (Trojan.Tracur.SGen) -> 4868 -> Failed to unload process.
    c:\Windows\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> 7132 -> Failed to unload process.
    c:\Windows\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> 1396 -> Failed to unload process.
    c:\Users\James\AppData\Roaming\SysWin\lsass.exe (Trojan.Tracur.SGen) -> 4392 -> Failed to unload process.

    Memory Modules Infected:
    c:\programdata\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Delete on reboot.

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient32 (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{29E5D1F9-08F3-47DA-83D7-DE2D215821Cf} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{29E5D1F9-08F3-47DA-83D7-DE2D215821CF} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{29E5D1F9-08F3-47DA-83D7-DE2D215821CF} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{29E5D1F9-08F3-47DA-83D7-DE2D215821CF} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3d10warpwow.exe (Trojan.Tracur.S) -> Value: d3d10warpwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mciwavewow.exe (Trojan.Tracur.SGen) -> Value: mciwavewow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mciwavewow.exe (Trojan.Tracur.SGen) -> Value: mciwavewow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dimsjobwow.exe (Trojan.Tracur.SGen) -> Value: dimsjobwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dimsjobwow.exe (Trojan.Tracur.SGen) -> Value: dimsjobwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> Value: nlslexicons0046wow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NlsLexicons0046wow.exe (Trojan.Tracur.SGen) -> Value: NlsLexicons0046wow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msasn1wow.exe (Trojan.Tracur.SGen) -> Value: msasn1wow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msasn1wow.exe (Trojan.Tracur.SGen) -> Value: msasn1wow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winrscmdwow.exe (Trojan.Tracur.SGen) -> Value: winrscmdwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winrscmdwow.exe (Trojan.Tracur.SGen) -> Value: winrscmdwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rastapiwow.exe (Trojan.Tracur.SGen) -> Value: rastapiwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rastapiwow.exe (Trojan.Tracur.SGen) -> Value: rastapiwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pstorecwow.exe (Trojan.Tracur.SGen) -> Value: pstorecwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pstorecwow.exe (Trojan.Tracur.SGen) -> Value: pstorecwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msoeacctwow.exe (Trojan.Tracur.SGen) -> Value: msoeacctwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msoeacctwow.exe (Trojan.Tracur.SGen) -> Value: msoeacctwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eappprxywow.exe (Trojan.Tracur.SGen) -> Value: eappprxywow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eappprxywow.exe (Trojan.Tracur.SGen) -> Value: eappprxywow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dskquotawow.exe (Trojan.Tracur.SGen) -> Value: dskquotawow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dskquotawow.exe (Trojan.Tracur.SGen) -> Value: dskquotawow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbdroprwow.exe (Trojan.Tracur.SGen) -> Value: kbdroprwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KBDROPRwow.exe (Trojan.Tracur.SGen) -> Value: KBDROPRwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vbajet32wow.exe (Trojan.Tracur.SGen) -> Value: vbajet32wow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vbajet32wow.exe (Trojan.Tracur.SGen) -> Value: vbajet32wow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msxml3awow.exe (Trojan.Tracur.SGen) -> Value: msxml3awow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msxml3awow.exe (Trojan.Tracur.SGen) -> Value: msxml3awow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\olecli32wow.exe (Trojan.Tracur.SGen) -> Value: olecli32wow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\olecli32wow.exe (Trojan.Tracur.SGen) -> Value: olecli32wow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> Value: photometadatahandlerwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PhotoMetadataHandlerwow.exe (Trojan.Tracur.SGen) -> Value: PhotoMetadataHandlerwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dmrcwow.exe (Trojan.Tracur.SGen) -> Value: dmrcwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dmrcwow.exe (Trojan.Tracur.SGen) -> Value: dmrcwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3drampwow.exe (Trojan.Tracur.SGen) -> Value: d3drampwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3drampwow.exe (Trojan.Tracur.SGen) -> Value: d3drampwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\framedynwow.exe (Trojan.Tracur.SGen) -> Value: framedynwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\framedynwow.exe (Trojan.Tracur.SGen) -> Value: framedynwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfscliwow.exe (Trojan.Tracur.SGen) -> Value: dfscliwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfscliwow.exe (Trojan.Tracur.SGen) -> Value: dfscliwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bootvidwow.exe (Trojan.Tracur.SGen) -> Value: bootvidwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BOOTVIDwow.exe (Trojan.Tracur.SGen) -> Value: BOOTVIDwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scansettingwow.exe (Trojan.Tracur.SGen) -> Value: scansettingwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scansettingwow.exe (Trojan.Tracur.SGen) -> Value: scansettingwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msltus40wow.exe (Trojan.Tracur.SGen) -> Value: msltus40wow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msltus40wow.exe (Trojan.Tracur.SGen) -> Value: msltus40wow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscapiwow.exe (Trojan.Tracur.SGen) -> Value: wscapiwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscapiwow.exe (Trojan.Tracur.SGen) -> Value: wscapiwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbdinhinwow.exe (Trojan.Tracur.SGen) -> Value: kbdinhinwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KBDINHINwow.exe (Trojan.Tracur.SGen) -> Value: KBDINHINwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbdlt1wow.exe (Trojan.Tracur.SGen) -> Value: kbdlt1wow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KBDLT1wow.exe (Trojan.Tracur.SGen) -> Value: KBDLT1wow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> Value: d3dx9_31wow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> Value: d3dx9_31wow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RTHDBPL (Trojan.Tracur.SGen) -> Value: RTHDBPL -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhsetupwow.exe (Trojan.Tracur.SGen) -> Value: hhsetupwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deskadpwow.exe (Trojan.TracurW.Gen) -> Value: deskadpwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deskadpwow.exe (Trojan.TracurW.Gen) -> Value: deskadpwow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SyncHostpswow.exe (Trojan.TracurW.Gen) -> Value: SyncHostpswow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\synchostpswow.exe (Trojan.TracurW.Gen) -> Value: synchostpswow.exe -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weruiwow.exe (Trojan.TracurW.Gen) -> Value: weruiwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weruiwow.exe (Trojan.TracurW.Gen) -> Value: weruiwow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bitsprx4wow.exe (Trojan.TracurW.Gen) -> Value: bitsprx4wow.exe -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audioengwow.exe (Trojan.TracurW.Gen) -> Value: audioengwow.exe -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur.SGen) -> Bad: (C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll) Good: () -> Quarantined and deleted successfully.

    Folders Infected:
    c:\programdata\175576591 (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175 (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\Users\James\AppData\Roaming\SysWin (Trojan.Agent) -> Delete on reboot.

    Files Infected:
    c:\Windows\SysWOW64\iccvid32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\programdata\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\programdata\icmui32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\20D8.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\d3d10warpwow.exe (Trojan.Tracur.S) -> Quarantined and deleted successfully.
    c:\Windows\mciwavewow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\dimsjobwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\msasn1wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\winrscmdwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\rastapiwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\pstorecwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\msoeacctwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\eappprxywow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\dskquotawow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\kbdroprwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\vbajet32wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\msxml3awow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\olecli32wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\dmrcwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\d3drampwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\framedynwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\dfscliwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\bootvidwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\scansettingwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\msltus40wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\wscapiwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\kbdinhinwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\kbdlt1wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Users\James\AppData\Roaming\SysWin\lsass.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\hhsetupwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\System32\iccvid32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\System32\config\systemprofile\AppData\Roaming\20D8.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\System32\config\systemprofile\AppData\Roaming\584C.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\System32\config\systemprofile\AppData\Roaming\A416.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\System32\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\System32\icmui32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\SysWOW64\icmui32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
    c:\Windows\deskadpwow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
    c:\Windows\synchostpswow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
    c:\Windows\weruiwow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
    c:\Windows\bitsprx4wow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
    c:\Windows\audioengwow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i0.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i1.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i10.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i11.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i12.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i13.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i14.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i15.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i2.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i3.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i4.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i5.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i6.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i7.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i8.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\175576591\new.i9.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt0.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt0.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt1.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt1.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt10.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt10.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt11.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt11.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt12.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt12.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt13.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt13.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt14.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt14.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt15.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt15.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt2.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt2.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt3.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt3.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt4.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt4.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt5.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt5.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt6.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt6.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt7.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt7.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt8.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt8.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt9.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
    c:\programdata\669181175\frt9.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.



    Attach.txt


    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-23.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 6/11/2011 9:08:20 PM
    System Uptime: 6/28/2011 8:33:39 PM (1 hours ago)
    .
    Motherboard: Dell Inc. | | 0XK6HV
    Processor: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz | CPU | 2301/100mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 451 GiB total, 393.932 GiB free.
    D: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
    Description: facap, FastAccess Video Capture
    Device ID: ROOT\IMAGE\0000
    Manufacturer: Sensible Vision
    Name: facap, FastAccess Video Capture
    PNP Device ID: ROOT\IMAGE\0000
    Service: FACAP
    .
    Class GUID:
    Description:
    Device ID: ACPI\SMO8800\1
    Manufacturer:
    Name:
    PNP Device ID: ACPI\SMO8800\1
    Service:
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: HIPS Core Filter Driver
    Device ID: ROOT\LEGACY_KMXFILTER\0000
    Manufacturer:
    Name: HIPS Core Filter Driver
    PNP Device ID: ROOT\LEGACY_KMXFILTER\0000
    Service: KmxFilter
    .
    ==== System Restore Points ===================
    .
    RP50: 6/23/2011 9:47:39 PM - Windows 7 Service Pack 1
    RP51: 6/24/2011 9:50:35 AM - Windows Update
    RP52: 6/25/2011 10:14:26 AM - Windows Update
    RP53: 6/27/2011 10:30:18 AM - Windows Update
    RP54: 6/28/2011 7:04:03 PM - Restore Operation
    RP55: 6/28/2011 7:14:16 PM - Windows Update
    RP56: 6/28/2011 8:18:28 PM - Restore Operation
    RP57: 6/28/2011 8:38:56 PM - Windows Update
    RP58: 6/28/2011 8:41:03 PM - Windows Update
    .
    ==== Installed Programs ======================
    .
    .
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader X (10.1.0)
    Age of Mythology
    Age of Mythology - The Titans Expansion
    Apple Application Support
    Apple Software Update
    Ask Toolbar
    Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
    Bing Bar
    Bing Bar Platform
    CA Backup and Migration
    CA Parental Controls
    Centra Client
    Conduit Engine
    CyberLink PowerDVD 9.6
    D3DX10
    Dell MusicStage
    Dell PhotoStage
    Dell Stage
    Dell VideoStage
    DirectXInstallService
    DNAMigrator
    EasyBits GO
    EMC 10 Content
    FrostWire 4.21.8
    Google Chrome
    GoToAssist 8.0.0.514
    Intel(R) Management Engine Components
    Intel(R) Processor Graphics
    Intel(R) Rapid Storage Technology
    Java Auto Updater
    Java(TM) 6 Update 26
    Junk Mail filter update
    Malwarebytes' Anti-Malware version 1.51.0.1200
    Mesh Runtime
    Messenger Companion
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
    Microsoft WSE 3.0 Runtime
    mIRC
    Mozilla Firefox 4.0.1 (x86 en-US)
    MSVCRT
    MSVCRT_amd64
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML4 Parser
    NVIDIA Stereoscopic 3D Driver
    QuickTime
    Realtek High Definition Audio Driver
    Renesas Electronics USB 3.0 Host Controller Driver
    Road Runner Toolbar
    Roxio Activation Module
    Roxio BackOnTrack
    Roxio Burn
    Roxio Central Audio
    Roxio Central Copy
    Roxio Central Core
    Roxio Central Data
    Roxio Central Tools
    Roxio Easy CD and DVD Burning
    Roxio Express Labeler 3
    Roxio Update Manager
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
    Skype Toolbars
    Skype™ 5.3
    Sonic CinePlayer Decoder Pack
    StickyNotes
    The Sims Medieval
    TWC Customer Controls
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live Messenger Companion Core
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    WinRAR 4.01 (32-bit)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    6/28/2011 9:00:21 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {5F36DC27-B076-4D0C-BD8C-7AEE14022193} and APPID {D3D96827-F7A7-4C54-A65F-EDC42D9EBB5E} to the user James-PC\UpdatusUser SID (S-1-5-21-1966946865-1856105359-1223038778-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    6/28/2011 8:48:26 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {5F36DC27-B076-4D0C-BD8C-7AEE14022193} and APPID {D3D96827-F7A7-4C54-A65F-EDC42D9EBB5E} to the user James-PC\James SID (S-1-5-21-1966946865-1856105359-1223038778-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    6/28/2011 8:40:32 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Update for Windows 7 for x64-based Systems (KB2552343).
    6/28/2011 8:39:57 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Update for Windows 7 for x64-based Systems (KB2547666).
    6/28/2011 8:39:49 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Update for Windows 7 for x64-based Systems (KB2545698).
    6/28/2011 8:35:19 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: KmxFilter RxFilter
    6/28/2011 8:34:58 PM, Error: Service Control Manager [7000] - The SessionLauncher service failed to start due to the following error: The system cannot find the file specified.
    6/28/2011 8:11:39 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache KmxAgent KmxFile KmxFilter NetBIOS NetBT nsiproxy Psched rdbss RxFilter spldr tdx vwififlt Wanarpv6 WfpLwf ws2ifsl
    6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
    6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    6/28/2011 6:42:15 PM, Error: Service Control Manager [7000] - The SessionLauncher service failed to start due to the following error: The system cannot find the path specified.
    6/28/2011 6:25:10 PM, Error: Service Control Manager [7034] - The NVIDIA Update Service Daemon service terminated unexpectedly. It has done this 1 time(s).
    6/24/2011 9:46:45 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the WinSock Extention Manager service to connect.
    6/24/2011 9:46:45 AM, Error: Service Control Manager [7000] - The WinSock Extention Manager service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    6/24/2011 6:13:23 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the NVIDIA Update Service Daemon service to connect.
    6/24/2011 6:13:23 PM, Error: Service Control Manager [7000] - The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    6/23/2011 9:56:33 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {5F36DC27-B076-4D0C-BD8C-7AEE14022193} and APPID {D3D96827-F7A7-4C54-A65F-EDC42D9EBB5E} to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    6/23/2011 9:46:00 PM, Error: Microsoft-Windows-Service Pack Installer [6] - The Service Pack cannot be installed when the computer is running on battery power.
    6/23/2011 11:14:23 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63AA156-D534-4BAC-9BF1-55359CF5EC30} and APPID {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} to the user James-PC\UpdatusUser SID (S-1-5-21-1966946865-1856105359-1223038778-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    6/22/2011 9:06:52 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the EvtEng service.
    6/22/2011 5:03:02 PM, Error: Service Control Manager [7034] - The WebClient service terminated unexpectedly. It has done this 1 time(s).
    6/22/2011 12:16:32 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: RxFilter
    6/22/2011 12:15:50 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x000000000000001c, 0x0000000000000002, 0x0000000000000001, 0xfffff8800187931a). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 062211-20732-01.
    6/21/2011 9:06:16 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    6/21/2011 9:06:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    6/21/2011 9:06:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    6/21/2011 9:06:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    6/21/2011 9:06:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    6/21/2011 9:06:07 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    6/21/2011 9:05:59 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    6/21/2011 9:05:42 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache KmxAgent KmxCfg KmxFile KmxFilter KmxFw NetBIOS NetBT nsiproxy Psched rdbss RxFilter spldr tdx vwififlt Wanarpv6 WfpLwf ws2ifsl
    6/21/2011 8:37:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WinExtManager with arguments "-Service" in order to run the server: {5F36DC27-B076-4D0C-BD8C-7AEE14022193}
    6/21/2011 8:37:44 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    6/21/2011 8:36:49 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\IWMSSvc.dll Error Code: 21
    6/21/2011 8:36:30 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache KmxAgent KmxCfg KmxFile KmxFilter KmxFw RxFilter spldr Wanarpv6
    6/21/2011 2:12:44 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SeaPort service to connect.
    6/21/2011 2:12:44 PM, Error: Service Control Manager [7000] - The SeaPort service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    .
    ==== End Of File ===========================
     
  2. Chronogo

    Chronogo TS Rookie Topic Starter

    Part 2 of logs

    DDS.txt


    .
    DDS (Ver_2011-06-23.01) - NTFSAMD64
    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
    Run by James at 20:58:41 on 2011-06-28
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.6058.3390 [GMT -5:00]
    .
    AV: CA Anti-Virus Plus *Enabled/Updated* {3EED0195-0A4B-4EF3-CC4F-4F401BDC245F}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: CA Anti-Virus Plus *Enabled/Updated* {858CE071-2C71-417D-F6FF-7432605B6EE2}
    FW: CA Personal Firewall *Enabled* {6F8E4568-E0DA-DA91-5F44-FD1E1B727591}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Program Files (x86)\Sensible Vision\Fast Access\FAService.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\WLANExt.exe
    C:\Windows\system32\conhost.exe
    C:\Program Files (x86)\CA\SharedComponents\HIPSEngine\UmxCfg.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files (x86)\CA\SharedComponents\HIPSEngine\UmxPol.exe
    C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
    C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    C:\Windows\system32\svchost.exe -k bthsvcs
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\caamsvc.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\isafe.exe
    C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
    C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\SysWOW64\iccvid32.exe
    C:\Windows\SysWOW64\mdmcls32.exe
    C:\ProgramData\icmui32.exe
    C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\20D8.tmp
    C:\Windows\SysWOW64\svcprs32.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\SysWOW64\cfgmig32.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
    c:\windows\d3d10warpwow.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
    C:\Program Files\CA\CA Internet Security Suite\casc.exe
    C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files (x86)\Skype\Phone\Skype.exe
    C:\Program Files (x86)\Centra\Client\bin\centraSystray.exe
    C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
    C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\mciwavewow.exe
    C:\Windows\dimsjobwow.exe
    C:\Windows\NlsLexicons0046wow.exe
    C:\Windows\msasn1wow.exe
    C:\Windows\winrscmdwow.exe
    C:\Windows\System32\StikyNot.exe
    C:\Windows\rastapiwow.exe
    C:\Windows\pstorecwow.exe
    C:\Windows\msoeacctwow.exe
    C:\Windows\eappprxywow.exe
    C:\Windows\dskquotawow.exe
    C:\Windows\KBDROPRwow.exe
    C:\Windows\vbajet32wow.exe
    C:\Windows\msxml3awow.exe
    C:\Windows\olecli32wow.exe
    C:\Windows\PhotoMetadataHandlerwow.exe
    C:\Windows\dmrcwow.exe
    C:\Windows\d3drampwow.exe
    C:\Windows\framedynwow.exe
    C:\Windows\dfscliwow.exe
    C:\Windows\BOOTVIDwow.exe
    C:\Windows\scansettingwow.exe
    C:\Windows\msltus40wow.exe
    C:\Windows\wscapiwow.exe
    C:\Windows\KBDINHINwow.exe
    C:\Windows\KBDLT1wow.exe
    C:\Windows\d3dx9_31wow.exe
    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe
    C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
    C:\Program Files (x86)\CyberLink\Shared files\brs.exe
    C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayAlert.exe
    C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
    C:\Program Files (x86)\Sensible Vision\Fast Access\Vendor\FastAccessChatAssist.exe
    C:\Program Files (x86)\Ask.com\Updater\Updater.exe
    C:\Users\James\AppData\Roaming\SysWin\lsass.exe
    C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
    C:\Windows\mciwavewow.exe
    C:\Windows\dimsjobwow.exe
    C:\Windows\NlsLexicons0046wow.exe
    C:\Windows\msasn1wow.exe
    C:\Windows\winrscmdwow.exe
    C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Windows\rastapiwow.exe
    C:\Windows\pstorecwow.exe
    C:\Windows\msoeacctwow.exe
    C:\Windows\eappprxywow.exe
    C:\Windows\dskquotawow.exe
    C:\Windows\KBDROPRwow.exe
    C:\Windows\vbajet32wow.exe
    C:\Windows\msxml3awow.exe
    C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
    C:\Windows\olecli32wow.exe
    C:\Windows\PhotoMetadataHandlerwow.exe
    C:\Windows\dmrcwow.exe
    C:\Windows\d3drampwow.exe
    C:\Windows\framedynwow.exe
    C:\Windows\dfscliwow.exe
    C:\Windows\BOOTVIDwow.exe
    C:\Windows\scansettingwow.exe
    C:\Windows\msltus40wow.exe
    C:\Windows\wscapiwow.exe
    C:\Windows\KBDINHINwow.exe
    C:\Windows\KBDLT1wow.exe
    C:\Windows\d3dx9_31wow.exe
    C:\Program Files (x86)\QuickTime\QTTask.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Windows\d3d10warpwow.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Users\James\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    C:\Users\James\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Program Files\CA\CA Internet Security Suite\ccEvtMgr.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.ask.com/?l=dis&o=14196
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: Road Runner Toolbar: {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll
    mURLSearchHooks: Road Runner Toolbar: {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll
    mWinlogon: Userinit=userinit.exe
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: {29e5d1f9-08f3-47da-83d7-de2d215821cf} - C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-032.dll
    BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
    BHO: CA Anti-Phishing Toolbar Helper: {45011cf5-e4a9-4f13-9093-f30a784eb9b2} - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Phishing\x86\toolbar\caIEToolbar.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
    BHO: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    BHO: SSOIEAddonBHO Class: {da5bce70-d057-4d63-943d-5f3927ec59f1} - C:\Program Files (x86)\Sensible Vision\Fast Access\FAIESSO.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO: Road Runner Toolbar: {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll
    TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
    TB: CA Anti-Phishing Toolbar: {0123b506-0ad9-43aa-b0cf-916c122ad4c5} - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Phishing\x86\toolbar\caIEToolbar.dll
    TB: Road Runner Toolbar: {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll
    TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
    TB: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    uRun: [Google Update] "C:\Users\James\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
    uRun: [Centra Launcher] C:\Program Files (x86)\Centra\Client\bin\centraSystray.exe /startup
    uRun: [deskadpwow.exe] C:\Windows\deskadpwow.exe
    uRun: [SyncHostpswow.exe] C:\Windows\SyncHostpswow.exe
    uRun: [weruiwow.exe] C:\Windows\weruiwow.exe
    uRun: [mciwavewow.exe] C:\Windows\mciwavewow.exe
    uRun: [dimsjobwow.exe] C:\Windows\dimsjobwow.exe
    uRun: [NlsLexicons0046wow.exe] C:\Windows\NlsLexicons0046wow.exe
    uRun: [msasn1wow.exe] C:\Windows\msasn1wow.exe
    uRun: [winrscmdwow.exe] C:\Windows\winrscmdwow.exe
    uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
    uRun: [rastapiwow.exe] C:\Windows\rastapiwow.exe
    uRun: [pstorecwow.exe] C:\Windows\pstorecwow.exe
    uRun: [msoeacctwow.exe] C:\Windows\msoeacctwow.exe
    uRun: [eappprxywow.exe] C:\Windows\eappprxywow.exe
    uRun: [dskquotawow.exe] C:\Windows\dskquotawow.exe
    uRun: [KBDROPRwow.exe] C:\Windows\KBDROPRwow.exe
    uRun: [vbajet32wow.exe] C:\Windows\vbajet32wow.exe
    uRun: [msxml3awow.exe] C:\Windows\msxml3awow.exe
    uRun: [olecli32wow.exe] C:\Windows\olecli32wow.exe
    uRun: [PhotoMetadataHandlerwow.exe] C:\Windows\PhotoMetadataHandlerwow.exe
    uRun: [dmrcwow.exe] C:\Windows\dmrcwow.exe
    uRun: [d3drampwow.exe] C:\Windows\d3drampwow.exe
    uRun: [framedynwow.exe] C:\Windows\framedynwow.exe
    uRun: [dfscliwow.exe] C:\Windows\dfscliwow.exe
    uRun: [BOOTVIDwow.exe] C:\Windows\BOOTVIDwow.exe
    uRun: [scansettingwow.exe] C:\Windows\scansettingwow.exe
    uRun: [msltus40wow.exe] C:\Windows\msltus40wow.exe
    uRun: [wscapiwow.exe] C:\Windows\wscapiwow.exe
    uRun: [KBDINHINwow.exe] C:\Windows\KBDINHINwow.exe
    uRun: [KBDLT1wow.exe] C:\Windows\KBDLT1wow.exe
    uRun: [d3dx9_31wow.exe] C:\Windows\d3dx9_31wow.exe
    mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
    mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun: [FATrayAlert] C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe
    mRun: [FAStartup]
    mRun: [RemoteControl9] "C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"
    mRun: [PDVD9LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe"
    mRun: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe
    mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
    mRun: [<NO NAME>]
    mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
    mRun: [RTHDBPL] C:\Users\James\AppData\Roaming\SysWin\lsass.exe
    mRun: [deskadpwow.exe] c:\windows\deskadpwow.exe
    mRun: [synchostpswow.exe] c:\windows\synchostpswow.exe
    mRun: [weruiwow.exe] c:\windows\weruiwow.exe
    mRun: [mciwavewow.exe] c:\windows\mciwavewow.exe
    mRun: [dimsjobwow.exe] c:\windows\dimsjobwow.exe
    mRun: [nlslexicons0046wow.exe] c:\windows\nlslexicons0046wow.exe
    mRun: [msasn1wow.exe] c:\windows\msasn1wow.exe
    mRun: [winrscmdwow.exe] c:\windows\winrscmdwow.exe
    mRun: [hhsetupwow.exe] C:\Windows\hhsetupwow.exe
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [rastapiwow.exe] c:\windows\rastapiwow.exe
    mRun: [pstorecwow.exe] c:\windows\pstorecwow.exe
    mRun: [msoeacctwow.exe] c:\windows\msoeacctwow.exe
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [eappprxywow.exe] c:\windows\eappprxywow.exe
    mRun: [dskquotawow.exe] c:\windows\dskquotawow.exe
    mRun: [kbdroprwow.exe] c:\windows\kbdroprwow.exe
    mRun: [vbajet32wow.exe] c:\windows\vbajet32wow.exe
    mRun: [msxml3awow.exe] c:\windows\msxml3awow.exe
    mRun: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
    mRun: [olecli32wow.exe] c:\windows\olecli32wow.exe
    mRun: [photometadatahandlerwow.exe] c:\windows\photometadatahandlerwow.exe
    mRun: [dmrcwow.exe] c:\windows\dmrcwow.exe
    mRun: [d3drampwow.exe] c:\windows\d3drampwow.exe
    mRun: [framedynwow.exe] c:\windows\framedynwow.exe
    mRun: [dfscliwow.exe] c:\windows\dfscliwow.exe
    mRun: [bootvidwow.exe] c:\windows\bootvidwow.exe
    mRun: [scansettingwow.exe] c:\windows\scansettingwow.exe
    mRun: [msltus40wow.exe] c:\windows\msltus40wow.exe
    mRun: [wscapiwow.exe] c:\windows\wscapiwow.exe
    mRun: [kbdinhinwow.exe] c:\windows\kbdinhinwow.exe
    mRun: [kbdlt1wow.exe] c:\windows\kbdlt1wow.exe
    mRun: [d3dx9_31wow.exe] c:\windows\d3dx9_31wow.exe
    mRun: [bitsprx4wow.exe] c:\windows\bitsprx4wow.exe
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [audioengwow.exe] c:\windows\audioengwow.exe
    mRun: [d3d10warpwow.exe] c:\windows\d3d10warpwow.exe
    mRunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    LSP: winsflt.dll
    LSP: C:\Windows\system32\VetRedir.dll
    DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxps://support.dell.com/systemprofiler/SysProExe.CAB
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: DhcpNameServer = 192.168.1.1 209.18.47.61 209.18.47.62
    TCP: Interfaces\{12526F08-E833-48B9-98DA-82759A5EEC06} : DhcpNameServer = 192.168.1.1 209.18.47.61 209.18.47.62
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    Notify: FastAccess - C:\Program Files (x86)\Sensible Vision\Fast Access\FALogNot.dll
    Notify: PFW - UmxWnp.Dll
    AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll UmxSbxExw.dll,C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll
    LSA: Notification Packages = scecli FAPassSync
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-032.dll
    BHO-X64: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
    BHO-X64: Conduit Engine - No File
    BHO-X64: CA Anti-Phishing Toolbar Helper: {45011CF5-E4A9-4F13-9093-F30A784EB9B2} - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Phishing\x86\toolbar\caIEToolbar.dll
    BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO-X64: Search Helper - No File
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    BHO-X64: Skype Plug-In: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO-X64: SkypeIEPluginBHO - No File
    BHO-X64: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
    BHO-X64: FrostWire Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    BHO-X64: Ask Toolbar BHO - No File
    BHO-X64: SSOIEAddonBHO Class: {DA5BCE70-D057-4D63-943D-5F3927EC59F1} - C:\Program Files (x86)\Sensible Vision\Fast Access\FAIESSO.dll
    BHO-X64: SSOIEAddonBHO - No File
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO-X64: Road Runner Toolbar: {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll
    BHO-X64: Road Runner - No File
    TB-X64: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
    TB-X64: CA Anti-Phishing Toolbar: {0123B506-0AD9-43AA-B0CF-916C122AD4C5} - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Phishing\x86\toolbar\caIEToolbar.dll
    TB-X64: Road Runner Toolbar: {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll
    TB-X64: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
    TB-X64: FrostWire Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    mRun-x64: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
    mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun-x64: [FATrayAlert] C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe
    mRun-x64: [FAStartup]
    mRun-x64: [RemoteControl9] "C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"
    mRun-x64: [PDVD9LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe"
    mRun-x64: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe
    mRun-x64: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
    mRun-x64: [(Default)]
    mRun-x64: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
    mRun-x64: [RTHDBPL] C:\Users\James\AppData\Roaming\SysWin\lsass.exe
    mRun-x64: [deskadpwow.exe] c:\windows\deskadpwow.exe
    mRun-x64: [synchostpswow.exe] c:\windows\synchostpswow.exe
    mRun-x64: [weruiwow.exe] c:\windows\weruiwow.exe
    mRun-x64: [mciwavewow.exe] c:\windows\mciwavewow.exe
    mRun-x64: [dimsjobwow.exe] c:\windows\dimsjobwow.exe
    mRun-x64: [nlslexicons0046wow.exe] c:\windows\nlslexicons0046wow.exe
    mRun-x64: [msasn1wow.exe] c:\windows\msasn1wow.exe
    mRun-x64: [winrscmdwow.exe] c:\windows\winrscmdwow.exe
    mRun-x64: [hhsetupwow.exe] C:\Windows\hhsetupwow.exe
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun-x64: [rastapiwow.exe] c:\windows\rastapiwow.exe
    mRun-x64: [pstorecwow.exe] c:\windows\pstorecwow.exe
    mRun-x64: [msoeacctwow.exe] c:\windows\msoeacctwow.exe
    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun-x64: [eappprxywow.exe] c:\windows\eappprxywow.exe
    mRun-x64: [dskquotawow.exe] c:\windows\dskquotawow.exe
    mRun-x64: [kbdroprwow.exe] c:\windows\kbdroprwow.exe
    mRun-x64: [vbajet32wow.exe] c:\windows\vbajet32wow.exe
    mRun-x64: [msxml3awow.exe] c:\windows\msxml3awow.exe
    mRun-x64: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
    mRun-x64: [olecli32wow.exe] c:\windows\olecli32wow.exe
    mRun-x64: [photometadatahandlerwow.exe] c:\windows\photometadatahandlerwow.exe
    mRun-x64: [dmrcwow.exe] c:\windows\dmrcwow.exe
    mRun-x64: [d3drampwow.exe] c:\windows\d3drampwow.exe
    mRun-x64: [framedynwow.exe] c:\windows\framedynwow.exe
    mRun-x64: [dfscliwow.exe] c:\windows\dfscliwow.exe
    mRun-x64: [bootvidwow.exe] c:\windows\bootvidwow.exe
    mRun-x64: [scansettingwow.exe] c:\windows\scansettingwow.exe
    mRun-x64: [msltus40wow.exe] c:\windows\msltus40wow.exe
    mRun-x64: [wscapiwow.exe] c:\windows\wscapiwow.exe
    mRun-x64: [kbdinhinwow.exe] c:\windows\kbdinhinwow.exe
    mRun-x64: [kbdlt1wow.exe] c:\windows\kbdlt1wow.exe
    mRun-x64: [d3dx9_31wow.exe] c:\windows\d3dx9_31wow.exe
    mRun-x64: [bitsprx4wow.exe] c:\windows\bitsprx4wow.exe
    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun-x64: [audioengwow.exe] c:\windows\audioengwow.exe
    mRun-x64: [d3d10warpwow.exe] c:\windows\d3d10warpwow.exe
    mRunOnce-x64: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    AppInit_DLLs-X64: C:\Windows\SysWOW64\nvinit.dll UmxSbxExw.dll,C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\ue8341i2.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com/?l=dis&o=14196
    FF - prefs.js: network.proxy.type - 0
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
    FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: C:\Users\James\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 KmxAMRT;KmxAMRT;C:\Windows\system32\DRIVERS\KmxAMRT.sys --> C:\Windows\system32\DRIVERS\KmxAMRT.sys [?]
    R0 nvpciflt;nvpciflt;C:\Windows\system32\DRIVERS\nvpciflt.sys --> C:\Windows\system32\DRIVERS\nvpciflt.sys [?]
    R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
    R1 KmxAgent;KmxAgent;C:\Windows\system32\DRIVERS\kmxagent.sys --> C:\Windows\system32\DRIVERS\kmxagent.sys [?]
    R1 KmxFile;KmxFile;C:\Windows\system32\DRIVERS\KmxFile.sys --> C:\Windows\system32\DRIVERS\KmxFile.sys [?]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
    R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
    R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2011-6-11 98208]
    R2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-1-24 901184]
    R2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2011-1-24 991296]
    R2 CAAMSvc;CAAMSvc;C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\caamsvc.exe [2011-6-12 292168]
    R2 CAISafe;CAISafe;C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\isafe.exe [2011-6-12 301568]
    R2 ccSchedulerSVC;CA Common Scheduler Service;C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe [2011-6-12 285520]
    R2 ezGOSvc;Easybits GO Services for Windows;C:\Windows\system32\svchost.exe -k netsvcs [2009-7-13 20992]
    R2 FAService;FAService;C:\Program Files (x86)\Sensible Vision\Fast Access\FAService.exe [2010-11-1 2428552]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-6-11 13336]
    R2 KmxSbx;KmxSbx;C:\Windows\system32\DRIVERS\KmxSbx.sys --> C:\Windows\system32\DRIVERS\KmxSbx.sys [?]
    R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-6-11 1997416]
    R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-12-23 378984]
    R2 UmxAgent;HIPS Event Manager;C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe [2009-8-4 1479160]
    R2 UmxCfg;HIPS Configuration Interpreter;C:\Program Files (x86)\CA\SharedComponents\HIPSEngine\UmxCfg.exe [2010-8-24 740160]
    R2 UmxPol;HIPS Policy Manager;C:\Program Files (x86)\CA\SharedComponents\HIPSEngine\UmxPol.exe [2010-9-17 301648]
    R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-6-11 2656280]
    R2 WebClient32;WebClient ;C:\Windows\System32\iccvid32.exe [2011-6-13 1547264]
    R2 WinExtManager;WinSock Extention Manager;C:\Windows\SysWOW64\mdmcls32.exe [2011-6-12 2347760]
    R2 WinSvchostManager;WinSock Svchost Manager;C:\Windows\SysWOW64\svcprs32.exe [2011-6-12 1377008]
    R2 WinSvchostManagerSrv;WinSvchostManagerSrv;C:\Windows\SysWOW64\cfgmig32.exe [2011-6-12 259408]
    R3 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2011-1-24 1298496]
    R3 btmaux;Intel Bluetooth Auxiliary Service;C:\Windows\system32\DRIVERS\btmaux.sys --> C:\Windows\system32\DRIVERS\btmaux.sys [?]
    R3 btmhsf;btmhsf;C:\Windows\system32\DRIVERS\btmhsf.sys --> C:\Windows\system32\DRIVERS\btmhsf.sys [?]
    R3 iBtFltCoex;iBtFltCoex;C:\Windows\system32\DRIVERS\iBtFltCoex.sys --> C:\Windows\system32\DRIVERS\iBtFltCoex.sys [?]
    R3 IntcDAud;Intel(R) Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
    R3 KmxCfg;KmxCfg;C:\Windows\system32\DRIVERS\kmxcfg.sys --> C:\Windows\system32\DRIVERS\kmxcfg.sys [?]
    R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]
    R3 MEIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
    R3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys --> C:\Windows\system32\DRIVERS\NETwNs64.sys [?]
    R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys --> C:\Windows\system32\DRIVERS\nusb3hub.sys [?]
    R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys --> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?]
    R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
    S1 KmxFilter;HIPS Core Filter Driver;C:\Windows\system32\DRIVERS\KmxFilter.sys --> C:\Windows\system32\DRIVERS\KmxFilter.sys [?]
    S2 CLKMSVC10_9EC60124;CyberLink Product - 2011/06/11 23:08:28;C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [2010-10-29 236016]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 SessionLauncher;SessionLauncher;C:\Users\James\AppData\Local\Temp\DX9\SessionLauncher.exe --> C:\Users\James\AppData\Local\Temp\DX9\SessionLauncher.exe [?]
    S3 FACAP;facap, FastAccess Video Capture;C:\Windows\system32\DRIVERS\facap.sys --> C:\Windows\system32\DRIVERS\facap.sys [?]
    S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
    S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
    S3 KmxCF;KmxCF;C:\Windows\system32\DRIVERS\KmxCF.sys --> C:\Windows\system32\DRIVERS\KmxCF.sys [?]
    S3 KmxFw;KmxFw;C:\Windows\system32\DRIVERS\kmxfw.sys --> C:\Windows\system32\DRIVERS\kmxfw.sys [?]
    S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-12-17 340240]
    S3 RoxMediaDB10;RoxMediaDB10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\RoxMediaDB10.exe [2009-6-26 1124848]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
    .
     
  3. Chronogo

    Chronogo TS Rookie Topic Starter

    Part 3 of logs

    =============== Created Last 30 ================
    .
    2011-06-29 01:54:42 -------- d-----w- C:\Users\James\AppData\Roaming\Malwarebytes
    2011-06-29 01:54:38 39984 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    2011-06-29 01:54:37 -------- d-----w- C:\ProgramData\Malwarebytes
    2011-06-29 01:54:33 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2011-06-29 01:54:33 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2011-06-29 01:41:55 8873296 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6C415097-5F7C-4E57-8620-0B50018B97C0}\mpengine.dll
    2011-06-29 01:35:39 522752 --sh--w- C:\Windows\d3d10warpwow.exe
    2011-06-28 23:15:43 -------- d-----w- C:\Users\James\AppData\Roaming\Uniblue
    2011-06-28 23:15:41 -------- dc----w- C:\ProgramData\{AB2D8F2E-F7AD-4446-A11A-50D846B2CF2A}
    2011-06-28 23:15:41 -------- d-----w- C:\Program Files (x86)\Uniblue
    2011-06-28 23:15:33 -------- d-----w- C:\Users\James\AppData\Local\PackageAware
    2011-06-28 02:13:52 -------- d-----w- C:\Program Files (x86)\SwiftKit
    2011-06-24 02:45:36 -------- d-----w- C:\Windows\System32\EventProviders
    2011-06-24 02:45:30 -------- d-----w- C:\0205d525f8210dbc69c1c3
    2011-06-24 02:20:31 536064 --sh--w- C:\Windows\AudioEngwow.exe
    2011-06-24 01:57:29 -------- d-----w- C:\Users\James\AppData\Local\Apple Computer
    2011-06-24 01:57:14 126312 ----a-w- C:\Windows\System32\GEARAspi64.dll
    2011-06-24 01:57:14 107368 ----a-w- C:\Windows\SysWow64\GEARAspi.dll
    2011-06-24 01:57:13 34152 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
    2011-06-24 01:55:54 -------- d-----w- C:\Users\James\AppData\Local\Apple
    2011-06-24 01:55:29 -------- d-----w- C:\Program Files\Bonjour
    2011-06-24 01:55:29 -------- d-----w- C:\Program Files (x86)\Bonjour
    2011-06-23 16:43:07 536064 --sh--w- C:\Windows\bitsprx4wow.exe
    2011-06-23 01:17:30 540160 --sh--w- C:\Windows\d3dx9_31wow.exe
    2011-06-22 22:03:07 540160 --sh--w- C:\Windows\KBDLT1wow.exe
    2011-06-22 21:23:05 540160 --sh--w- C:\Windows\KBDINHINwow.exe
    2011-06-22 18:10:49 -------- d-----w- C:\Users\James\AppData\Roaming\Fingertapps
    2011-06-22 01:34:27 -------- d--h--w- C:\Windows\msdownld.tmp
    2011-06-22 01:34:21 -------- d-----w- C:\Windows\SysWow64\directx
    2011-06-20 20:39:08 577536 --sh--w- C:\Windows\wscapiwow.exe
    2011-06-20 20:29:33 -------- d-----w- C:\Program Files (x86)\Easy Uninstaller
    2011-06-20 20:12:10 577536 --sh--w- C:\Windows\msltus40wow.exe
    2011-06-20 19:55:29 577536 --sh--w- C:\Windows\scansettingwow.exe
    2011-06-20 19:15:19 577536 --sh--w- C:\Windows\BOOTVIDwow.exe
    2011-06-20 17:43:43 577536 --sh--w- C:\Windows\dfscliwow.exe
    2011-06-20 16:05:34 577536 --sh--w- C:\Windows\framedynwow.exe
    2011-06-20 15:45:35 82523 ----a-w- C:\Program Files\Uninstall.exe
    2011-06-20 15:11:20 577536 --sh--w- C:\Windows\d3drampwow.exe
    2011-06-20 14:31:21 577536 --sh--w- C:\Windows\dmrcwow.exe
    2011-06-20 03:06:21 577536 --sh--w- C:\Windows\PhotoMetadataHandlerwow.exe
    2011-06-19 15:26:44 577536 --sh--w- C:\Windows\olecli32wow.exe
    2011-06-19 15:14:50 -------- d-----w- C:\FIND_EULA_PATH
    2011-06-19 15:10:04 577536 --sh--w- C:\Windows\msxml3awow.exe
    2011-06-19 01:58:43 -------- d-----w- C:\Users\James\AppData\Local\Diagnostics
    2011-06-18 21:58:21 585728 --sh--w- C:\Windows\vbajet32wow.exe
    2011-06-18 17:04:05 585728 --sh--w- C:\Windows\KBDROPRwow.exe
    2011-06-18 16:25:16 585728 --sh--w- C:\Windows\dskquotawow.exe
    2011-06-18 04:19:01 585728 --sh--w- C:\Windows\eappprxywow.exe
    2011-06-18 02:47:53 -------- d-----w- C:\Users\James\AppData\Local\Adobe
    2011-06-17 15:13:31 585728 --sh--w- C:\Windows\msoeacctwow.exe
    2011-06-17 15:10:45 585728 --sh--w- C:\Windows\pstorecwow.exe
    2011-06-17 04:15:52 -------- d-----w- C:\Users\James\AppData\Roaming\mIRC
    2011-06-17 04:15:52 -------- d-----w- C:\Program Files (x86)\mIRC
    2011-06-17 03:56:44 585728 --sh--w- C:\Windows\rastapiwow.exe
    2011-06-16 23:51:49 585728 --sh--w- C:\Windows\hhsetupwow.exe
    2011-06-16 19:16:15 585728 --sh--w- C:\Windows\winrscmdwow.exe
    2011-06-16 18:15:38 585728 --sh--w- C:\Windows\msasn1wow.exe
    2011-06-16 17:55:53 585728 --sh--w- C:\Windows\NlsLexicons0046wow.exe
    2011-06-15 17:07:59 585728 --sh--w- C:\Windows\dimsjobwow.exe
    2011-06-15 15:25:03 102400 ----a-w- C:\Windows\System32\drivers\dfsc.sys
    2011-06-15 15:17:37 -------- d-----w- C:\Users\James\AppData\Local\{F0960D2F-88D5-422A-9630-960938C8C9F2}
    2011-06-15 15:17:37 -------- d-----w- C:\Users\James\AppData\Local\{4E2D8DBA-C46A-4176-BA8C-6E0530D55C69}
    2011-06-15 15:16:25 585728 --sh--w- C:\Windows\mciwavewow.exe
    2011-06-14 20:10:04 565248 --sh--w- C:\Windows\weruiwow.exe
    2011-06-14 18:00:06 -------- d-----w- C:\ProgramData\Electronic Arts
    2011-06-14 18:00:06 -------- d-----w- C:\ProgramData\EA Core
    2011-06-14 17:58:19 447752 ----a-w- C:\Windows\SysWow64\vp6vfw.dll
    2011-06-14 17:58:15 -------- d-----w- C:\Program Files (x86)\Microsoft WSE
    2011-06-14 17:54:52 3977496 ----a-w- C:\Windows\System32\d3dx9_31.dll
    2011-06-14 17:54:52 2414360 ----a-w- C:\Windows\SysWow64\d3dx9_31.dll
    2011-06-14 17:22:59 565248 --sh--w- C:\Windows\SyncHostpswow.exe
    2011-06-14 13:29:42 8718160 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
    2011-06-14 13:22:31 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
    2011-06-14 13:17:11 -------- d-----w- C:\Users\James\AppData\Local\{45F39B0F-6304-49CC-8973-86FDBBF8E87A}
    2011-06-14 03:27:22 -------- d-----w- C:\Users\James\AppData\Roaming\WhiteSmoke
    2011-06-14 03:26:46 -------- d-----w- C:\Program Files (x86)\WhiteSmoke
    2011-06-14 03:02:40 -------- d-----w- C:\ProgramData\669181175
    2011-06-14 02:59:38 -------- d-sh--w- C:\ProgramData\SysWoW32
    2011-06-14 02:59:24 203776 --sh--w- C:\ProgramData\unrar.exe
    2011-06-14 02:59:24 -------- d-----w- C:\ProgramData\175576591
    2011-06-14 02:59:14 565248 --sh--w- C:\Windows\deskadpwow.exe
    2011-06-14 02:59:14 -------- d-sh--w- C:\ProgramData\040A370D8F7B80A63625CA2FDB68551A
    2011-06-14 02:59:09 256000 ----a-w- C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll
    2011-06-14 02:59:09 1547264 ----a-w- C:\ProgramData\icmui32.exe
    2011-06-14 02:59:07 1547264 ----a-w- C:\Windows\SysWow64\iccvid32.exe
    2011-06-14 02:59:06 -------- d-sh--w- C:\Users\James\AppData\Roaming\SysWin
    2011-06-14 02:59:04 257536 ----a-w- C:\Windows\SysWow64\icmui32.exe
    2011-06-14 02:59:03 420352 ----a-w- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-032.dll
    2011-06-13 17:21:55 -------- d-----w- C:\Users\James\AppData\Local\{7CEF6ED2-F6EF-4F23-9F49-25C9EF7AF0D0}
    2011-06-13 01:45:31 -------- d-----w- C:\Program Files (x86)\Microsoft Games
    2011-06-13 00:39:58 -------- d-----w- C:\ProgramData\Citrix
    2011-06-13 00:39:20 -------- d-----w- C:\Program Files (x86)\Citrix
    2011-06-13 00:39:13 -------- d-----w- C:\Users\James\AppData\Local\Citrix
    2011-06-13 00:39:11 61224 ----a-w- C:\Users\James\GoToAssistDownloadHelper.exe
    2011-06-12 22:55:55 -------- d-----w- C:\Users\James\FrostWire
    2011-06-12 22:55:51 -------- d-----w- C:\Users\James\AppData\Roaming\FrostWire
    2011-06-12 22:55:16 -------- d-----w- C:\Program Files (x86)\Ask.com
    2011-06-12 22:55:10 -------- d-----w- C:\Program Files (x86)\FrostWire
    2011-06-12 22:39:26 -------- d-----w- C:\Users\James\AppData\Roaming\DAEMON Tools Pro
    2011-06-12 22:39:26 -------- d-----w- C:\ProgramData\DAEMON Tools Pro
    2011-06-12 21:13:11 -------- d-----w- C:\Program Files (x86)\CA-SupportBridge
    2011-06-12 20:09:38 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
    2011-06-12 20:06:07 -------- d-----w- C:\Users\James\AppData\Roaming\Saba
    2011-06-12 20:06:04 -------- d-----w- C:\Users\James\AppData\Roaming\Centra
    2011-06-12 19:37:58 -------- d-----w- C:\Users\James\AppData\Local\Microsoft Games
    2011-06-12 19:36:14 -------- d-----w- C:\Users\James\AppData\Local\Mozilla
    2011-06-12 19:34:27 80256 ----a-w- C:\Windows\SysWow64\ezGOSvc.dll
    2011-06-12 19:34:27 663424 ----a-w- C:\Windows\SysWow64\ezGOSvcApp.exe
    2011-06-12 18:28:15 -------- d-----w- C:\Program Files (x86)\Conduit
    2011-06-12 18:28:13 -------- d-----w- C:\Program Files (x86)\ConduitEngine
    2011-06-12 18:28:11 -------- d-----w- C:\Users\James\AppData\Local\Conduit
    2011-06-12 18:28:11 -------- d-----w- C:\Program Files (x86)\Road_Runner
    2011-06-12 18:27:08 7 ----a-w- C:\Windows\SysWow64\mkghj.dll
    2011-06-12 18:27:01 -------- d-----w- C:\ProgramData\Logs
    2011-06-12 18:26:06 -------- d-----w- C:\Program Files\ISSThirdParty
    2011-06-12 18:24:49 -------- d-----w- C:\Program Files\CA
    2011-06-12 18:24:16 -------- d-----w- C:\ProgramData\CA
    2011-06-12 18:16:20 -------- d-----w- C:\Users\James\AppData\Roaming\SupportSoft
    2011-06-12 18:15:18 -------- d-----w- C:\Program Files (x86)\Common Files\supportsoft
    2011-06-12 17:46:00 -------- d-----w- C:\Users\James\AppData\Local\{97DF2AB8-5348-4474-BB55-194B9623FEC2}
    2011-06-12 17:45:48 -------- d-----w- C:\Users\James\Tracing
    2011-06-12 17:43:05 -------- d-----w- C:\Windows\en
    2011-06-12 17:41:30 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
    2011-06-12 17:40:09 48488 ----a-w- C:\Windows\System32\drivers\fssfltr.sys
    2011-06-12 17:39:55 -------- d-----w- C:\Windows\PCHEALTH
    2011-06-12 17:39:10 -------- d-----w- C:\Program Files (x86)\Microsoft
    2011-06-12 17:39:07 -------- d-----w- C:\Program Files (x86)\MSN Toolbar
    2011-06-12 17:38:47 -------- d-----w- C:\Program Files (x86)\Bing Bar Installer
    2011-06-12 17:38:46 69464 ----a-w- C:\Windows\SysWow64\XAPOFX1_3.dll
    2011-06-12 17:38:46 515416 ----a-w- C:\Windows\SysWow64\XAudio2_5.dll
    2011-06-12 17:38:45 523088 ----a-w- C:\Windows\System32\d3dx10_42.dll
    2011-06-12 17:38:45 453456 ----a-w- C:\Windows\SysWow64\d3dx10_42.dll
    2011-06-12 17:38:12 4398360 ----a-w- C:\Windows\System32\d3dx9_32.dll
    2011-06-12 17:38:12 3426072 ----a-w- C:\Windows\SysWow64\d3dx9_32.dll
    2011-06-12 17:37:14 3860992 ----a-w- C:\Windows\System32\UIRibbon.dll
    2011-06-12 17:37:14 2983424 ----a-w- C:\Windows\SysWow64\UIRibbon.dll
    2011-06-12 17:37:14 1164800 ----a-w- C:\Windows\SysWow64\UIRibbonRes.dll
    2011-06-12 17:37:14 1164800 ----a-w- C:\Windows\System32\UIRibbonRes.dll
    2011-06-12 17:36:24 469256 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\3d942ed51cc292709\InstallManager_WLE_WLE.exe
    2011-06-12 17:36:10 15712 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\36e974301cc292708\MeshBetaRemover.exe
    2011-06-12 17:36:03 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\33cc07351cc292707\DSETUP.dll
    2011-06-12 17:36:03 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\33cc07351cc292707\DXSETUP.exe
    2011-06-12 17:36:03 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\33cc07351cc292707\dsetup32.dll
    2011-06-12 17:36:00 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\3056874f1cc292706\DSETUP.dll
    2011-06-12 17:36:00 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\3056874f1cc292706\DXSETUP.exe
    2011-06-12 17:36:00 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\3056874f1cc292706\dsetup32.dll
    2011-06-12 17:35:52 6260088 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\2b68edfe1cc292705\Silverlight.4.0.exe
    2011-06-12 17:35:00 -------- d-----w- C:\Users\James\AppData\Local\Windows Live
    2011-06-12 17:35:00 -------- d-----w- C:\Program Files (x86)\Common Files\Windows Live
    2011-06-12 17:32:27 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2011-06-12 17:32:09 -------- d--h--w- C:\Windows\AxInstSV
    2011-06-12 17:31:56 -------- d-----w- C:\Users\James\AppData\Roaming\go
    2011-06-12 17:31:55 -------- d-----w- C:\ProgramData\Easybits GO
    2011-06-12 17:10:28 -------- d-----w- C:\Program Files (x86)\Centra
    2011-06-12 16:50:47 -------- d-----w- C:\ProgramData\Skype Extras
    2011-06-12 16:47:47 -------- d-----r- C:\Program Files (x86)\Skype
    2011-06-12 16:09:59 -------- d-----w- C:\Windows\Cypress
    2011-06-12 16:04:29 -------- d-----w- C:\Windows\SysWow64\winsflte.dl1
    2011-06-12 16:04:29 -------- d-----w- C:\Windows\SysWow64\winsflt.dl1
    2011-06-12 16:03:25 -------- d-----w- C:\ProgramData\CA-SupportBridge
    2011-06-12 15:35:11 -------- d-----w- C:\Users\James\AppData\Local\Dell
    2011-06-12 15:34:29 -------- d-----w- C:\Program Files (x86)\Dell Touch Software Suite
    2011-06-12 15:24:19 -------- d-----w- C:\Users\James\AppData\Roaming\Dell Touch Zone
    2011-06-12 15:24:17 -------- d-----w- C:\Users\James\AppData\Roaming\Dell
    2011-06-12 15:24:17 -------- d-----w- C:\Program Files (x86)\Dell Stage
    2011-06-12 15:21:09 -------- d-----w- C:\Windows\SysWow64\Dell
    2011-06-12 04:56:24 -------- d-----w- C:\Windows\Panther
    2011-06-12 04:55:49 -------- d-----w- C:\Windows\System32\oem
    2011-06-12 04:36:45 -------- d-----w- C:\Users\James\AppData\Local\Google
    2011-06-12 04:36:37 -------- d-----w- C:\Users\James\AppData\Local\Apps
    2011-06-12 04:36:36 -------- d-----w- C:\Users\James\AppData\Local\Deployment
    2011-06-12 04:19:10 -------- d-----w- C:\ProgramData\Uninstall
    2011-06-12 04:17:10 55280 ------w- C:\Windows\System32\drivers\PxHlpa64.sys
    2011-06-12 04:17:10 10224 ------w- C:\Windows\System32\drivers\cdralw2k.sys
    2011-06-12 04:17:10 10224 ------w- C:\Windows\System32\drivers\cdr4_xp.sys
    2011-06-12 04:14:16 -------- d-----w- C:\Program Files (x86)\Common Files\SureThing Shared
    2011-06-12 04:13:49 -------- d-----w- C:\Program Files (x86)\Common Files\PX Storage Engine
    2011-06-12 04:13:48 -------- d-----w- C:\Program Files (x86)\Common Files\Sonic Shared
    2011-06-12 04:13:24 -------- d-----w- C:\Users\James\AppData\Local\Programs
    2011-06-12 04:13:23 -------- d-----w- C:\Program Files (x86)\Roxio
    2011-06-12 04:12:29 506728 ----a-w- C:\Windows\System32\d3dx10_33.dll
    2011-06-12 04:12:29 443752 ----a-w- C:\Windows\SysWow64\d3dx10_33.dll
    2011-06-12 04:12:28 4494184 ----a-w- C:\Windows\System32\d3dx9_33.dll
    2011-06-12 04:12:28 3495784 ----a-w- C:\Windows\SysWow64\d3dx9_33.dll
    2011-06-12 04:12:28 1400176 ----a-w- C:\Windows\System32\D3DCompiler_33.dll
    2011-06-12 04:12:28 1123696 ----a-w- C:\Windows\SysWow64\D3DCompiler_33.dll
    2011-06-12 04:11:28 -------- d-----w- C:\Users\James\AppData\Roaming\Roxio Log Files
    2011-06-12 04:07:56 -------- d-----w- C:\Program Files (x86)\Common Files\CyberLink
    2011-06-12 04:06:02 29480 ----a-w- C:\Windows\SysWow64\msxml3a.dll
    2011-06-12 04:00:03 -------- d-----w- C:\Program Files (x86)\Sensible Vision
    2011-06-12 03:55:52 14336 ----a-w- C:\Windows\System32\drivers\sffp_sd.sys
    2011-06-12 03:55:20 902656 ----a-w- C:\Windows\System32\d2d1.dll
    2011-06-12 03:55:20 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll
    2011-06-12 03:55:20 197120 ----a-w- C:\Windows\System32\d3d10_1.dll
    2011-06-12 03:55:20 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll
    2011-06-12 03:55:20 1540608 ----a-w- C:\Windows\System32\DWrite.dll
    2011-06-12 03:55:20 1135104 ----a-w- C:\Windows\System32\FntCache.dll
    2011-06-12 03:55:20 1074176 ----a-w- C:\Windows\SysWow64\DWrite.dll
    2011-06-12 03:49:49 -------- d-----w- C:\Windows\SysWow64\Wat
    2011-06-12 03:49:49 -------- d-----w- C:\Windows\System32\Wat
    2011-06-12 03:43:45 367104 ----a-w- C:\Windows\System32\wcncsvc.dll
    2011-06-12 03:43:45 276992 ----a-w- C:\Windows\SysWow64\wcncsvc.dll
    2011-06-12 03:39:47 311808 ----a-w- C:\Windows\System32\msv1_0.dll
    2011-06-12 03:39:47 257024 ----a-w- C:\Windows\SysWow64\msv1_0.dll
    2011-06-12 03:37:25 270720 ------w- C:\Windows\System32\MpSigStub.exe
    2011-06-12 03:32:35 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll
    2011-06-12 03:32:35 49472 ----a-w- C:\Windows\SysWow64\netfxperf.dll
    2011-06-12 03:32:35 48960 ----a-w- C:\Windows\System32\netfxperf.dll
    2011-06-12 03:32:35 444752 ----a-w- C:\Windows\System32\mscoree.dll
    2011-06-12 03:32:35 320352 ----a-w- C:\Windows\System32\PresentationHost.exe
    2011-06-12 03:32:35 297808 ----a-w- C:\Windows\SysWow64\mscoree.dll
    2011-06-12 03:32:35 295264 ----a-w- C:\Windows\SysWow64\PresentationHost.exe
    2011-06-12 03:32:35 1942856 ----a-w- C:\Windows\System32\dfshim.dll
    2011-06-12 03:32:35 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
    2011-06-12 03:32:35 109912 ----a-w- C:\Windows\System32\PresentationHostProxy.dll
    2011-06-12 03:28:11 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe
    2011-06-12 03:28:11 31232 ----a-w- C:\Windows\System32\prevhost.exe
    2011-06-12 03:28:10 142336 ----a-w- C:\Windows\System32\poqexec.exe
    2011-06-12 03:28:10 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe
    2011-06-12 03:28:09 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2011-06-12 03:28:09 2048 ----a-w- C:\Windows\System32\tzres.dll
    2011-06-12 03:28:03 2870272 ----a-w- C:\Windows\explorer.exe
    2011-06-12 03:28:03 2614784 ----a-w- C:\Windows\SysWow64\explorer.exe
    2011-06-12 03:26:59 4582912 ----a-w- C:\Program Files\Windows NT\Accessories\wordpad.exe
    2011-06-12 03:24:59 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
    2011-06-12 03:24:31 112000 ----a-w- C:\Windows\System32\consent.exe
    2011-06-12 03:23:29 987136 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msado15.dll
    2011-06-12 03:23:29 720896 ----a-w- C:\Windows\System32\odbc32.dll
    2011-06-12 03:23:29 573440 ----a-w- C:\Windows\SysWow64\odbc32.dll
    2011-06-12 03:23:29 495616 ----a-w- C:\Program Files\Common Files\System\ado\msadox.dll
    2011-06-12 03:23:29 466944 ----a-w- C:\Program Files\Common Files\System\ado\msadomd.dll
    2011-06-12 03:23:29 372736 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msadox.dll
    2011-06-12 03:23:29 352256 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msadomd.dll
    2011-06-12 03:23:29 258048 ----a-w- C:\Program Files\Common Files\System\msadc\msadco.dll
    2011-06-12 03:23:29 208896 ----a-w- C:\Program Files (x86)\Common Files\System\msadc\msadco.dll
    2011-06-12 03:23:29 1425408 ----a-w- C:\Program Files\Common Files\System\ado\msado15.dll
    2011-06-12 03:21:15 9728 ----a-w- C:\Windows\SysWow64\sscore.dll
    2011-06-12 03:21:15 236032 ----a-w- C:\Windows\System32\srvsvc.dll
    2011-06-12 03:14:56 -------- d-----w- C:\Users\James\AppData\Roaming\Intel Corporation
    2011-06-12 03:12:49 220672 ----a-w- C:\Windows\System32\wintrust.dll
    2011-06-12 03:12:49 172032 ----a-w- C:\Windows\SysWow64\wintrust.dll
    2011-06-12 03:12:48 139264 ----a-w- C:\Windows\System32\cabview.dll
    2011-06-12 03:12:48 132608 ----a-w- C:\Windows\SysWow64\cabview.dll
    2011-06-12 03:08:27 439320 ----a-w- C:\Windows\System32\drivers\iaStor.sys
    2011-06-12 03:04:55 -------- d-----w- C:\Windows\SysWow64\NV
    2011-06-12 03:04:55 -------- d-----w- C:\Windows\System32\NV
    2011-06-12 03:00:20 -------- d-----w- C:\Users\James\AppData\Roaming\Intel
    2011-06-12 03:00:12 -------- d-----w- C:\Users\James\Roaming
    2011-06-12 03:00:12 -------- d-----w- C:\ProgramData\Roaming
    2011-06-12 02:58:50 -------- d-----w- C:\Program Files (x86)\Cisco
    2011-06-12 02:57:25 -------- d-----w- C:\Windows\SysWow64\Atheros_L1e
    2011-06-12 02:56:58 76912 ----a-w- C:\Windows\System32\drivers\L1C62x64.sys
    2011-06-12 02:55:05 -------- d-----w- C:\ProgramData\NVIDIA Corporation
    2011-06-12 02:55:03 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation
    2011-06-12 02:48:27 -------- d-----w- C:\Program Files\Common Files\Intel
    2011-06-12 02:48:27 -------- d-----w- C:\Program Files (x86)\Common Files\Intel
    2011-06-12 02:43:09 -------- d-----w- C:\Program Files (x86)\Renesas Electronics
    2011-06-12 02:41:56 8192 ----a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll
    2011-06-12 02:41:49 -------- d-----w- C:\Program Files (x86)\Common Files\postureAgent
    2011-06-12 02:41:29 56344 ----a-w- C:\Windows\System32\drivers\HECIx64.sys
    2011-06-12 02:39:52 53248 ----a-w- C:\Windows\SysWow64\CSVer.dll
    2011-06-12 02:30:03 243712 ----a-w- C:\Windows\System32\drivers\ks.sys
    2011-06-12 02:30:03 184832 ----a-w- C:\Windows\System32\drivers\usbvideo.sys
    2011-06-12 02:29:44 78848 ----a-w- C:\Windows\System32\WUDFSvc.dll
    2011-06-12 02:29:44 687616 ----a-w- C:\Windows\System32\WUDFx.dll
    2011-06-12 02:29:44 44544 ----a-w- C:\Windows\System32\WUDFCoinstaller.dll
    2011-06-12 02:29:44 228864 ----a-w- C:\Windows\System32\WUDFHost.exe
    2011-06-12 02:29:44 183808 ----a-w- C:\Windows\System32\WUDFPlatform.dll
    2011-06-12 02:29:44 172544 ----a-w- C:\Windows\System32\drivers\WUDFRd.sys
    2011-06-12 02:29:44 112640 ----a-w- C:\Windows\System32\drivers\WUDFPf.sys
    2011-06-12 02:29:13 51712 ----a-w- C:\Windows\System32\drivers\usbehci.sys
    2011-06-12 02:29:13 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys
    2011-06-12 02:28:58 30296 ----a-w- C:\Windows\System32\drivers\msahci.sys
    2011-06-12 02:28:42 91648 ----a-w- C:\Windows\System32\isoburn.exe
    2011-06-12 02:28:42 86528 ----a-w- C:\Windows\SysWow64\isoburn.exe
    2011-06-12 02:28:23 327680 ----a-w- C:\Windows\System32\drivers\udfs.sys
    2011-06-12 02:28:08 228352 ----a-w- C:\Windows\System32\drivers\1394ohci.sys
    2011-06-12 02:27:37 -------- d-----w- C:\Program Files (x86)\Dell
    2011-06-12 02:27:11 -------- d-sh--w- C:\Windows\Installer
    2011-06-12 00:15:36 -------- d-sh--w- C:\Recovery
    2011-06-08 21:08:23 -------- d-sh--w- C:\System Recovery
    .
    ==================== Find3M ====================
    .
    2011-06-12 18:25:31 5845744 ----a-w- C:\Windows\SysWow64\win32cpr.dll
    2011-06-12 18:25:31 2385136 ----a-w- C:\Windows\System32\winsflt.dll
    2011-06-12 18:25:31 1872624 ----a-w- C:\Windows\SysWow64\winsflt.dll
    2011-05-28 03:07:01 3133952 ----a-w- C:\Windows\System32\win32k.sys
    2011-05-04 02:51:08 287744 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
    2011-05-04 02:51:08 157696 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
    2011-05-04 02:51:05 126464 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
    2011-05-03 05:21:22 976896 ----a-w- C:\Windows\System32\inetcomm.dll
    2011-05-03 04:50:29 740864 ----a-w- C:\Windows\SysWow64\inetcomm.dll
    2011-04-29 03:13:10 461312 ----a-w- C:\Windows\System32\drivers\srv.sys
    2011-04-29 03:12:54 399872 ----a-w- C:\Windows\System32\drivers\srv2.sys
    2011-04-29 03:12:37 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys
    2011-04-25 05:32:22 1896832 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2011-04-25 02:44:02 499712 ----a-w- C:\Windows\System32\drivers\afd.sys
    2011-04-23 01:29:25 2303488 ----a-w- C:\Windows\System32\jscript9.dll
    2011-04-23 01:19:19 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
    2011-04-22 23:35:56 1797632 ----a-w- C:\Windows\SysWow64\jscript9.dll
    2011-04-22 23:25:54 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2011-04-22 20:18:47 27008 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
    2011-04-09 06:45:48 5509504 ----a-w- C:\Windows\System32\ntoskrnl.exe
    2011-04-09 06:13:06 3957632 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2011-04-09 06:13:06 3901824 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2011-04-06 21:26:58 96544 ----a-w- C:\Windows\System32\dnssd.dll
    2011-04-06 21:26:58 69408 ----a-w- C:\Windows\System32\jdns_sd.dll
    2011-04-06 21:26:58 237856 ----a-w- C:\Windows\System32\dnssdX.dll
    2011-04-06 21:26:58 119584 ----a-w- C:\Windows\System32\dns-sd.exe
    2011-04-06 21:20:16 91424 ----a-w- C:\Windows\SysWow64\dnssd.dll
    2011-04-06 21:20:16 75040 ----a-w- C:\Windows\SysWow64\jdns_sd.dll
    2011-04-06 21:20:16 197920 ----a-w- C:\Windows\SysWow64\dnssdX.dll
    2011-04-06 21:20:16 107808 ----a-w- C:\Windows\SysWow64\dns-sd.exe
    2009-10-09 13:05:13 89144 ----a-w- C:\Program Files\bass.dll
    .
    ============= FINISH: 21:01:09.38 ===============
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Okay, we have a lot of work to do. There is a great deal of malware on the system. And while many enres were remove in Mbam, I can still see multiple entries remaining:
    ======================================
    I'd like you to do this special scan:
    • Make sure to use Internet Explorer for this
    • Please go to VirSCAN.org free on-line scan service
    • Copy and paste each of the following file paths into the "Suspicious files to scan" box on the top of the page, one at a time:
      Code:
          [b]c:\windows\system32\userinit.exe
      
          c:\windows\explorer.exe
      
          c:\window\system32\svchost.exe[/b]
      
    • Click on the Upload button
    • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
    • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
    • Paste the contents of the Clipboard in your next reply.
    ========================================
    • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESETOnlineScan
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      [o] Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
      [o] Double click on the [​IMG]on your desktop.
    • Check 'Yes I accept terms of use.'
    • Click Start button
    • Accept any security warnings from your browser.
      [​IMG]
    • Uncheck 'Remove found threats'
    • Check 'Scan archives/
    • Leave remaining settings as is.
    • Press the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    • When the scan completes, press List of found threats
    • Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    • Push the Back button
    • Push Finish

    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
    =========================================
    Please note: If you have Combofix on the desktop already, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    --------------------------------------
    Download Combofix from HERE or HERE and save to the desktop
    • Double click combofix.exe & follow the prompts.
    • ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [​IMG]
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.

    Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    Note 2: ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    Note 3: Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    Note 4: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    Note 5: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart computer to fix the issue.
     
  5. Chronogo

    Chronogo TS Rookie Topic Starter

    Alright

    Alright I've done what I can.

    Here are the results of the first three scans. The first two finished successfully with nothing found, the third reached the box that has the ReScan button, but the button was grayed out and I couldn't select it.

    However, the second scanner installed and began scanning..and then stalled at 23%. I let it hang for ~10 minutes. Retried and got the same result.

    The third scan I also began only to have it hang a short way in on a file named C:\32788R22FWJFW I decided to get the other results up...I'll restart this third scan once I close this browser and just leave it sitting.



    VirSCAN.org Scanned Report :
    Scanned time : 2011/06/28 22:28:05 (CDT)
    Scanner results: Scanners did not find malware!
    File Name : userinit.exe
    File Size : 26112 byte
    File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
    MD5 : 6de80f60d7de9ce6b8c2ddfdf79ef175
    SHA1 : 8d439a6186ff526403989ac217dfe8e3a2d8bc2c
    Online report : http://file.virscan.org/report/bf0bdd8254188966e9ae2d13aba81445.html

    Scanner Engine Ver Sig Ver Sig Date Time Scan result
    a-squared 5.1.0.2 20110629040730 2011-06-29 0.80 -
    AhnLab V3 2011.06.29.00 2011.06.29 2011-06-29 1.78 -
    AntiVir 8.2.5.24 7.11.10.142 2011-06-29 0.28 -
    Antiy 2.0.18 20110205.7694535 2011-02-05 0.07 -
    Arcavir 2011 201105080215 2011-05-08 0.04 -
    Authentium 5.1.1 201106281013 2011-06-28 1.59 -
    AVAST! 4.7.4 110628-1 2011-06-28 0.08 -
    AVG 8.5.850 271.1.1/3732 2011-06-29 0.59 -
    BitDefender 7.90123.8403362 7.38084 2011-06-29 4.17 -
    ClamAV 0.96.5 13244 2011-06-28 0.02 -
    Comodo 4.0 9216 2011-06-28 1.35 -
    CP Secure 1.3.0.5 2011.06.28 2011-06-28 0.43 -
    Dr.Web 5.0.2.3300 2011.06.29 2011-06-29 14.10 -
    F-Prot 4.4.4.56 20110628 2011-06-28 1.48 -
    F-Secure 7.02.73807 2011.06.28.05 2011-06-28 0.18 -
    Fortinet 4.2.257 13.375 2011-06-28 0.21 -
    GData 22.752/22.191 20110629 2011-06-29 7.94 -
    ViRobot 20110628 2011.06.28 2011-06-28 0.39 -
    Ikarus T3.1.32.20.0 2011.06.29.78698 2011-06-29 5.23 -
    JiangMin 13.0.900 2011.06.28 2011-06-28 1.61 -
    Kaspersky 5.5.10 2011.06.29 2011-06-29 0.11 -
    KingSoft 2009.2.5.15 2011.6.28.18 2011-06-28 1.56 -
    McAfee 5400.1158 6391 2011-06-28 9.30 -
    Microsoft 1.7000 2011.06.28 2011-06-28 4.04 -
    NOD32 3.0.21 6248 2011-06-28 0.01 -
    Norman 6.07.10 6.07.00 2011-06-28 14.02 -
    Panda 9.05.01 2011.06.28 2011-06-28 9.23 -
    Trend Micro 9.200-1012 8.256.01 2011-06-28 0.04 -
    Quick Heal 11.00 2011.06.28 2011-06-28 1.24 -
    Rising 20.0 23.64.01.03 2011-06-28 2.17 -
    Sophos 3.20.2 4.66 2011-06-29 3.69 -
    Sunbelt 3.9.2496.2 9723 2011-06-28 0.65 -
    Symantec 1.3.0.24 20110628.002 2011-06-28 0.06 -
    nProtect 20110601.01 3460661 2011-06-01 6.45 -
    The Hacker 6.7.0.1 v00244 2011-06-28 0.49 -
    VBA32 3.12.16.3 20110628.0459 2011-06-28 4.52 -
    VirusBuster 5.3.0.4 14.0.100.0/54834332011-06-28 0.00 -






    VirSCAN.org Scanned Report :
    Scanned time : 2011/06/28 22:34:20 (CDT)
    Scanner results: Scanners did not find malware!
    File Name : explorer.exe
    File Size : 2870272 byte
    File Type : PE32+ executable for MS Windows (GUI)
    MD5 : 0862495e0c825893db75ef44faea8e93
    SHA1 : e4b9a40fa341bcb82f20c9c3cefad84825e0d194
    Online report : http://file.virscan.org/report/42ba4dfa62879058ada1ce8825fba9b7.html

    Scanner Engine Ver Sig Ver Sig Date Time Scan result
    a-squared 5.1.0.2 20110629040730 2011-06-29 3.50 -
    AhnLab V3 2011.06.29.00 2011.06.29 2011-06-29 6.37 -
    AntiVir 8.2.5.24 7.11.10.142 2011-06-29 0.28 -
    Antiy 2.0.18 20110205.7694535 2011-02-05 0.02 -
    Arcavir 2011 201105080215 2011-05-08 0.04 -
    Authentium 5.1.1 201106281013 2011-06-28 1.45 -
    AVAST! 4.7.4 110628-1 2011-06-28 0.14 -
    AVG 8.5.850 271.1.1/3732 2011-06-29 0.26 -
    BitDefender 7.90123.8403362 7.38084 2011-06-29 4.11 -
    ClamAV 0.96.5 13244 2011-06-28 0.82 -
    Comodo 4.0 9216 2011-06-28 1.31 -
    CP Secure 1.3.0.5 2011.06.28 2011-06-28 0.50 -
    Dr.Web 5.0.2.3300 2011.06.29 2011-06-29 13.18 -
    F-Prot 4.4.4.56 20110628 2011-06-28 1.49 -
    F-Secure 7.02.73807 2011.06.28.05 2011-06-28 14.01 -
    Fortinet 4.2.257 13.375 2011-06-28 0.22 -
    GData 22.753/22.191 20110629 2011-06-29 7.46 -
    ViRobot 20110628 2011.06.28 2011-06-28 0.40 -
    Ikarus T3.1.32.20.0 2011.06.29.78698 2011-06-29 4.71 -
    JiangMin 13.0.900 2011.06.28 2011-06-28 1.55 -
    Kaspersky 5.5.10 2011.06.29 2011-06-29 0.11 -
    KingSoft 2009.2.5.15 2011.6.28.18 2011-06-28 0.85 -
    McAfee 5400.1158 6391 2011-06-28 9.36 -
    Microsoft 1.7000 2011.06.28 2011-06-28 7.56 -
    NOD32 3.0.21 6248 2011-06-28 0.01 -
    Norman 6.07.10 6.07.00 2011-06-28 14.03 -
    Panda 9.05.01 2011.06.28 2011-06-28 2.34 -
    Trend Micro 9.200-1012 8.256.01 2011-06-28 0.03 -
    Quick Heal 11.00 2011.06.28 2011-06-28 1.00 -
    Rising 20.0 23.64.01.03 2011-06-28 0.24 -
    Sophos 3.20.2 4.66 2011-06-29 3.71 -
    Sunbelt 3.9.2496.2 9723 2011-06-28 0.78 -
    Symantec 1.3.0.24 20110628.002 2011-06-28 0.08 -
    nProtect 20110601.01 3460661 2011-06-01 6.54 -
    The Hacker 6.7.0.1 v00244 2011-06-28 0.71 -
    VBA32 3.12.16.3 20110628.0459 2011-06-28 4.30 -
    VirusBuster 5.3.0.4 14.0.100.0/54834332011-06-28 0.00 -




    VirSCAN.org Scanned Report :
    Scanned time : 2011/03/27 10:43:51 (CDT)
    Scanner results: Scanners did not find malware!
    File Name : svchost.exe
    File Size : 20992 byte
    File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
    MD5 : 54a47f6b5e09a77e61649109c6a08866
    SHA1 : 4af001b3c3816b860660cf2de2c0fd3c1dfb4878
    Online report : http://file.virscan.org/report/a547c9efcc301cbeb3513c54a17493d3.html

    Scanner Engine Ver Sig Ver Sig Date Time Scan result
    a-squared 5.1.0.2 20110327010737 2011-03-27 5.25 -
    AhnLab V3 2011.03.27.01 2011.03.27 2011-03-27 1.57 -
    AntiVir 8.2.4.192 7.11.5.80 2011-03-27 0.30 -
    Antiy 2.0.18 20110205.7694535 2011-02-05 0.02 -
    Arcavir 2010 201103240801 2011-03-24 0.00 -
    Authentium 5.1.1 201103271446 2011-03-27 1.48 -
    AVAST! 4.7.4 110327-0 2011-03-27 0.01 -
    AVG 8.5.850 271.1.1/3516 2011-03-19 0.25 -
    BitDefender 7.90123.7001104 7.36817 2011-03-27 6.33 -
    ClamAV 0.96.5 12911 2011-03-26 0.01 -
    Comodo 4.0 8126 2011-03-27 1.13 -
    CP Secure 1.3.0.5 2011.03.27 2011-03-27 0.04 -
    Dr.Web 5.0.2.3300 2011.03.27 2011-03-27 11.14 -
    F-Prot 4.4.4.56 20110326 2011-03-26 1.47 -
    F-Secure 7.02.73807 2011.03.27.01 2011-03-27 0.07 -
    Fortinet 4.2.254 13.48 2011-03-26 0.48 -
    GData 21.2141/21.773 20110327 2011-03-27 8.92 -
    ViRobot 20110326 2011.03.26 2011-03-26 0.43 -
    Ikarus T3.1.32.20.0 2011.03.27.78032 2011-03-27 5.46 -
    JiangMin 13.0.900 2011.03.27 2011-03-27 1.45 -
    Kaspersky 5.5.10 2011.03.27 2011-03-27 0.10 -
    KingSoft 2009.2.5.15 2011.3.27.9 2011-03-27 0.76 -
    McAfee 5400.1158 6297 2011-03-26 8.14 -
    Microsoft 1.6702 2011.03.27 2011-03-27 4.08 -
    NOD32 3.0.21 5988 2011-03-26 0.01 -
    Norman 6.07.03 6.07.00 2011-03-26 10.02 -
    Panda 9.05.01 2011.03.27 2011-03-27 3.69 -
    Trend Micro 9.200-1012 7.930.07 2011-03-27 0.03 -
    Quick Heal 11.00 2011.03.26 2011-03-26 0.97 -
    Rising 20.0 23.50.05.05 2011-03-26 2.12 -
    Sophos 3.16.1 4.62 2011-03-27 3.21 -
    Sunbelt 3.9.2486.2 8831 2011-03-26 0.64 -
    Symantec 1.3.0.24 20110326.002 2011-03-26 0.06 -
    nProtect 20110326.01 3275801 2011-03-26 7.25 -
    The Hacker 6.7.0.1 v00159 2011-03-26 0.82 -
    VBA32 3.12.14.3 20110325.1219 2011-03-25 3.65 -
    VirusBuster 5.2.0.28 13.6.272.0/48565992011-03-27 0.00 -
     
  6. Chronogo

    Chronogo TS Rookie Topic Starter

    Combofix

    Apologies for the double post, but an update on the combofix scan.


    I let it sit for ~20 minutes and it finally moved past the point it was stuck on. It opened up a window saying something about a problem opening some file, the green bar sped to the end and the entire process closed without opening the said txt
     
  7. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    It's very good the the VirScan came back with no malware found. Malware on those particular entries would be having me send you to reformat/reinstall!

    NOTE: If, for some reason, Combofix refuses to run, try one of the following:
    1. Run Combofix from Safe Mode.
    2. Delete Combofix file, download fresh one, but rename combofix.exe to
    chrono.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    3. Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
    There are 4 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
    • Rkill.com
    • Rkill.scr
    • Rkill.pif
    • Rkill.exe
    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run then try to immediately run the following>>>>.

    Please download exeHelper by Raktor and save it to your desktop.
    • Double-click on exeHelper.com or exeHelper.scr to run the fix tool.
    • A black window should pop up, press any key to close once the fix is completed.
    • A log file called exehelperlog.txt will be created and should open at the end of the scan)
    • A copy of that log will also be saved in the directory where you ran exeHelper.com
    • Copy and paste the contents of exehelperlog.txt in your next reply.

    Note: If the window shows a message that says "Error deleting file", please re-run the tool again before posting a log and then post the two logs together (they both will be in the one file).

    Rkill instructions
    *************************************
    Once you've gotten one of them to run, immediately run

    chrono.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.
    =============================================
    Note: If you are able to do #1> run Combofix in Safe Mode, you don't need to continue with #2.
     
  8. Chronogo

    Chronogo TS Rookie Topic Starter

    No luck

    Combofix ran successfully in safemode but It reached a point saying that it detected CA Anti-Virus plus as active. I tried to find a means to disable the scanner..but nowhere in the CA program does it give you the option. So I ended the process casc.exe in the manager and attempted to run the program. I clicked ok to continue but the window just disappeared and nothing happened.


    edit: I got one of the four links to work running as admin in safe mode. Will now proceed with the next step
     
  9. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    See if this will work for CA:

    CA Internet Security Suite 2010

    * To turn off the Firewall, right-click on the CA Shield icon in the system tray, click My Internet, then click Disable Firewall.
    * To turn it back on, right click system tray icon, click My Internet, then click Enable Firewall.


    * To temporarily disable the Antivirus, right-click the CA Shield icon in the system tray, click My Computer, then click Enable Snooze.
    * Enter the snooze time in minutes (up to 999, approx 16 2/3 hours) in the box and click Snooze.
    * To end snooze, follow the same procedure and click Wake Now on the page for entering snooze time.
    * To disable Antivirus on a longer basis, double-click the CA Shield icon in the system tray.
    * When Security Center comes up, click Update Settings in the My Computer tab.
    * Then click the red X next to Auto Scan.
    * To re-enable, follow the same procedure and click the green checkmark.

    Instructions courtesy bleepingcomputer.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...