TechSpot

Iexplorer running in the background Firefox redirects

By megaman8x
Sep 10, 2011
  1. I recently got rid of some of the windows recovery spyware but there are some tib bits I cannot get rid of which is 2 iexplorer.exe are always running in the background and I get random pop ups for ads through ie and sometimes it tries to print and send mail and when searching with firefox my links majority of the time get redirected to some ad or random site and my browsing speed has dropped significantly, I would appreciate all the help I can get, thank you for your time.

    Malwarebytes' Anti-Malware 1.51.1.1800
    www.malwarebytes.org

    Database version: 7689

    Windows 6.1.7601 Service Pack 1
    Internet Explorer 9.0.8112.16421

    9/10/2011 10:43:32 AM
    mbam-log-2011-09-10 (10-43-32).txt

    Scan type: Quick scan
    Objects scanned: 191739
    Time elapsed: 40 minute(s), 18 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    *the gmer quick scan returned empty and gave me a blank log*


    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_22
    Run by james at 10:58:34 on 2011-09-10
    Microsoft Windows 7 Ultimate 6.1.7601.1.932.81.1033.18.4095.1945 [GMT -4:00]
    .
    AV: Emsisoft Anti-Malware *Enabled/Updated* {0ADC9F7D-20C1-240F-01E2-43466EBA893A}
    AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
    SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Emsisoft Anti-Malware *Enabled/Updated* {B1BD7E99-06FB-2B81-3B52-7834153DC387}
    FW: ZoneAlarm Firewall *Enabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\atieclxx.exe
    C:\Windows\SYSTEM32\WISPTIS.EXE
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\SysWOW64\ZoneLabs\vsmon.exe
    C:\Windows\SYSTEM32\WISPTIS.EXE
    C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\taskhost.exe
    C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files (x86)\ASUS\AI Suite II\GPU Boost\GpuBoostServer.exe
    C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\Program Files\Logitech\Gaming Software\LWEMon.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files (x86)\Steam\Steam.exe
    C:\Windows\System32\StikyNot.exe
    C:\Program Files (x86)\DAP\DAP.exe
    C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
    C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
    C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
    C:\Program Files (x86)\Xfire\Xfire.exe
    C:\Program Files (x86)\ASUS\AI Suite II\AI Direct Link\AsCmd.exe
    C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files (x86)\Xfire\xfire64.exe
    C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe
    C:\Windows\SysWOW64\PnkBstrA.exe
    C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboUnlocker\TurboInfo.exe
    C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
    C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
    C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
    C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\PROGRA~2\ASUS\AISUIT~1\Sensor\HMSERV~1\aaHM.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files (x86)\Xfire\xfire64.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
    C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\SysWOW64\NOTEPAD.EXE
    C:\Windows\explorer.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01
    uURLSearchHooks: ICQToolBar: {855f3b16-6d32-4fe6-8a56-bbb695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
    uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
    uURLSearchHooks: H - No File
    uURLSearchHooks: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files (x86)\ZoneAlarm_Security\prxtbZone.dll
    mURLSearchHooks: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files (x86)\ZoneAlarm_Security\prxtbZone.dll
    mWinlogon: Userinit=userinit.exe,
    BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitBHO.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
    BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files (x86)\ZoneAlarm_Security\prxtbZone.dll
    BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO: DAPIELoader Class: {ff6c3cf0-4b15-11d1-abed-709549c10000} - C:\PROGRA~2\DAP\DAPIEL~1.DLL
    TB: ICQToolBar: {855f3b16-6d32-4fe6-8a56-bbb695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
    TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitIEAddin.dll
    TB: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files (x86)\ZoneAlarm_Security\prxtbZone.dll
    TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
    TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
    EB: ICQToolBar: {855f3b16-6d32-4fe6-8a56-bbb695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
    uRun: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
    uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
    uRun: [DownloadAccelerator] "C:\Program Files (x86)\DAP\DAP.EXE" /STARTUP
    uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
    uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
    uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
    uRun: [Google Update] "C:\Users\james\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
    mRun: [ASUS AI Direct Link Command Execute] C:\Program Files (x86)\ASUS\AI Suite II\AI Direct Link\AsCmd.exe
    mRun: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
    mRun: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
    mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [ZoneAlarm Client] "C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe"
    mRunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    StartupFolder: C:\Users\james\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Xfire.lnk - C:\Program Files (x86)\Xfire\Xfire.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
    IE: &Clean Traces - C:\Program Files (x86)\DAP\Privacy Package\dapcleanerie.htm
    IE: &Download with &DAP - C:\Program Files (x86)\DAP\dapextie.htm
    IE: Download &all with DAP - C:\Program Files (x86)\DAP\dapextie2.htm
    IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files (x86)\Paltalk Messenger\Paltalk.exe
    IE: {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe
    IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files (x86)\AIM\aim.exe
    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.21.0.cab
    TCP: DhcpNameServer = 24.178.162.3 97.81.22.195 24.159.64.23
    TCP: Interfaces\{5C69FB95-2993-4C26-B5D6-D99281D689E6} : DhcpNameServer = 24.178.162.3 97.81.22.195 24.159.64.23
    TCP: Interfaces\{BC49BCDE-B917-423B-BF22-3DAE7B60D1AD} : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{BC49BCDE-B917-423B-BF22-3DAE7B60D1AD}\1627B65656675737 : DhcpNameServer = 24.178.162.3 97.81.22.195 24.159.64.23
    TCP: Interfaces\{BC49BCDE-B917-423B-BF22-3DAE7B60D1AD}\7554354533533393 : DhcpNameServer = 192.168.1.254 192.168.1.254
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\PROGRA~2\DAP\dapie.dll
    Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\PROGRA~2\DAP\dapie.dll
    mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
    BHO-X64: SnagIt Toolbar Loader: {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitBHO.dll
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
    BHO-X64: ZoneAlarm Security Engine Registrar: {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
    BHO-X64: ZoneAlarm Security Engine Registrar - No File
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files (x86)\ZoneAlarm_Security\prxtbZone.dll
    BHO-X64: ZoneAlarm Security - No File
    BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO-X64: DAPIELoader Class: {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~2\DAP\DAPIEL~1.DLL
    BHO-X64: DAPIELoader Class - No File
    TB-X64: ICQToolBar: {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
    TB-X64: Snagit: {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitIEAddin.dll
    TB-X64: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files (x86)\ZoneAlarm_Security\prxtbZone.dll
    TB-X64: ZoneAlarm Security Engine: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
    TB-X64: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
    EB-X64: {855F3B16-6D32-4FE6-8A56-BBB695989046} - No File
    mRun-x64: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
    mRun-x64: [ASUS AI Direct Link Command Execute] C:\Program Files (x86)\ASUS\AI Suite II\AI Direct Link\AsCmd.exe
    mRun-x64: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
    mRun-x64: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
    mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun-x64: [ZoneAlarm Client] "C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe"
    mRunOnce-x64: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    IE-X64: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files (x86)\Paltalk Messenger\Paltalk.exe
    IE-X64: {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe
    IE-X64: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files (x86)\AIM\aim.exe
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\james\AppData\Roaming\Mozilla\Firefox\Profiles\zooo9ewn.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=
    FF - prefs.js: network.proxy.type - 0
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
    FF - plugin: C:\Program Files (x86)\TabletPlugins\npwacom.dll
    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll
    FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
    FF - plugin: C:\Users\james\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll
    FF - plugin: C:\Users\james\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
    FF - plugin: C:\Users\james\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 a2injectiondriver;a2injectiondriver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2011-9-5 48216]
    R1 a2util;a-squared Malware-IDS utility driver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [2011-9-5 14720]
    R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
    R2 a2AntiMalware;Emsisoft Anti-Malware 5.1 - Service;C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2011-9-5 3029208]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
    R2 AsSysCtrlService;ASUS System Control Service;C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2011-2-11 96896]
    R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-9-29 735960]
    R2 epfwwfpr;epfwwfpr;C:\Windows\system32\DRIVERS\epfwwfpr.sys --> C:\Windows\system32\DRIVERS\epfwwfpr.sys [?]
    R2 ISWKL;ZoneAlarm Toolbar ISWKL;C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [2011-2-15 33528]
    R2 IswSvc;ZoneAlarm Toolbar IswSvc;C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe [2011-2-15 822264]
    R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-3-12 1153368]
    R2 TabletServiceWacom;TabletServiceWacom;C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe [2011-4-3 5716848]
    R3 a2acc;a2acc;C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys [2011-9-5 85800]
    R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
    R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
    R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]
    R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys --> C:\Windows\system32\DRIVERS\nusb3hub.sys [?]
    R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys --> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    S2 .EsetTrialReset;Eset Trial Reset;C:\Windows\reset.exe /s --> C:\Windows\reset.exe [?]
    S2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService --> C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?]
    S3 DKRtWrt;DKRtWrt;C:\Windows\system32\DRIVERS\DKRtWrt.sys --> C:\Windows\system32\DRIVERS\DKRtWrt.sys [?]
    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]
    S3 rt61x64;RT61 Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr6164.sys --> C:\Windows\system32\DRIVERS\netr6164.sys [?]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
    S3 wacmoumonitor;Wacom Mode Helper;C:\Windows\system32\DRIVERS\wacmoumonitor.sys --> C:\Windows\system32\DRIVERS\wacmoumonitor.sys [?]
    S4 BCUService;Browser Configuration Utility Service;C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2010-3-5 235752]
    S4 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-3-28 2111368]
    S4 ICQ Service;ICQ Service;C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [2011-2-19 247096]
    S4 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-5-4 503080]
    S4 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
    .
    =============== Created Last 30 ================
    .
    2011-09-10 14:02:33 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2011-09-08 03:17:23 -------- d-----w- C:\Users\james\AppData\Local\{63107FEB-6993-4E52-9B16-30872E4BE824}
    2011-09-08 03:16:48 -------- d-----w- C:\Users\james\AppData\Local\{52C36605-FCA7-49DB-A3C3-57F6BE9B7159}
    2011-09-07 20:35:58 -------- d-----w- C:\Users\james\AppData\Local\{89B63098-8CC9-45CE-87E5-9922DEF61310}
    2011-09-07 20:35:13 -------- d-----w- C:\Users\james\AppData\Local\{6E56EF43-E4F1-47F0-AE34-27ABDD80B97F}
    2011-09-07 16:01:54 5561216 ----a-w- C:\Windows\System32\ntoskrnl.exe
    2011-09-07 16:01:54 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2011-09-07 16:01:53 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2011-09-07 15:48:33 -------- d-----w- C:\Users\james\AppData\Local\{A3D2F8B5-99DB-4067-A871-B47D3341A9D9}
    2011-09-07 15:47:56 -------- d-----w- C:\Users\james\AppData\Local\{935AD9FD-CA6C-4322-9707-9D08EC19A634}
    2011-09-07 13:38:34 96768 ----a-w- C:\Windows\System32\fsutil.exe
    2011-09-07 13:38:34 2565632 ----a-w- C:\Windows\System32\esent.dll
    2011-09-07 13:38:34 1699328 ----a-w- C:\Windows\SysWow64\esent.dll
    2011-09-07 13:38:33 410496 ----a-w- C:\Windows\System32\drivers\iaStorV.sys
    2011-09-07 13:38:33 27008 ----a-w- C:\Windows\System32\drivers\amdxata.sys
    2011-09-07 13:38:33 189824 ----a-w- C:\Windows\System32\drivers\storport.sys
    2011-09-07 13:38:33 1659776 ----a-w- C:\Windows\System32\drivers\ntfs.sys
    2011-09-07 13:38:33 148352 ----a-w- C:\Windows\System32\drivers\nvraid.sys
    2011-09-07 13:38:33 107904 ----a-w- C:\Windows\System32\drivers\amdsata.sys
    2011-09-07 13:38:32 74240 ----a-w- C:\Windows\SysWow64\fsutil.exe
    2011-09-07 13:38:32 166272 ----a-w- C:\Windows\System32\drivers\nvstor.sys
    2011-09-07 13:33:28 -------- d-----w- C:\Users\james\AppData\Local\{1FE38C00-ACBC-45A0-A14B-FDB5DBC31D99}
    2011-09-07 13:32:57 -------- d-----w- C:\Users\james\AppData\Local\{E9F5F2F9-9785-4457-860E-32C1BC82FE3A}
    2011-09-06 23:18:26 -------- d-----w- C:\Users\james\AppData\Local\{E34F699A-72C7-4075-A94F-49B59F757BBF}
    2011-09-06 23:18:05 -------- d-----w- C:\Users\james\AppData\Local\{13FD5786-D836-4AED-9220-D14504E0159A}
    2011-09-06 23:09:20 8862544 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{918BDB04-4E10-42AD-B7F4-AEABC889A4B5}\mpengine.dll
    2011-09-06 22:36:00 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2011-09-06 22:36:00 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
    2011-09-06 22:34:36 288768 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
    2011-09-06 22:34:35 158208 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
    2011-09-06 22:34:35 128000 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
    2011-09-06 22:27:46 -------- d-----w- C:\Users\james\AppData\Local\{35CF4D60-D7D4-4C96-946E-C5C42842D583}
    2011-09-06 22:27:27 -------- d-----w- C:\Users\james\AppData\Local\{5238F12C-E37D-47E4-A98A-254330836170}
    2011-09-06 04:11:15 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2011-09-06 04:11:14 2048 ----a-w- C:\Windows\System32\tzres.dll
    2011-09-06 04:09:43 212992 ----a-w- C:\Windows\System32\odbctrac.dll
    2011-09-06 04:09:43 163840 ----a-w- C:\Windows\System32\odbccp32.dll
    2011-09-06 04:09:43 126976 ----a-w- C:\Program Files\Common Files\System\Ole DB\msdaosp.dll
    2011-09-06 04:09:43 106496 ----a-w- C:\Windows\System32\odbccu32.dll
    2011-09-06 04:09:43 106496 ----a-w- C:\Windows\System32\odbccr32.dll
    2011-09-06 04:09:42 94208 ----a-w- C:\Program Files (x86)\Common Files\System\Ole DB\msdaosp.dll
    2011-09-06 04:09:42 86016 ----a-w- C:\Windows\SysWow64\odbccu32.dll
    2011-09-06 04:09:42 81920 ----a-w- C:\Windows\SysWow64\odbccr32.dll
    2011-09-06 04:09:42 319488 ----a-w- C:\Windows\SysWow64\odbcjt32.dll
    2011-09-06 04:09:42 163840 ----a-w- C:\Windows\SysWow64\odbctrac.dll
    2011-09-06 04:09:42 122880 ----a-w- C:\Windows\SysWow64\odbccp32.dll
    2011-09-06 04:07:39 467456 ----a-w- C:\Windows\System32\drivers\srv.sys
    2011-09-06 04:07:39 410112 ----a-w- C:\Windows\System32\drivers\srv2.sys
    2011-09-06 04:07:39 168448 ----a-w- C:\Windows\System32\drivers\srvnet.sys
    2011-09-06 04:07:12 861696 ----a-w- C:\Windows\System32\oleaut32.dll
    2011-09-06 04:07:12 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
    2011-09-06 04:05:57 976896 ----a-w- C:\Windows\System32\inetcomm.dll
    2011-09-06 04:05:57 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll
    2011-09-05 22:44:02 -------- d-----w- C:\Program Files (x86)\Emsisoft Anti-Malware
    2011-09-05 16:50:15 -------- d-----w- C:\Users\james\AppData\Roaming\CheckPoint
    2011-09-05 16:49:33 0 ----a-w- C:\Windows\SysWow64\ConduitEngine.tmp
    2011-09-05 16:49:33 -------- d-----w- C:\Users\james\AppData\Local\Conduit
    2011-09-05 16:49:32 -------- d-----w- C:\Program Files (x86)\ZoneAlarm_Security
    2011-09-05 16:48:26 -------- d-----w- C:\Program Files\CheckPoint
    2011-09-05 16:48:06 1238528 ----a-w- C:\Windows\SysWow64\zpeng25.dll
    2011-09-05 16:48:06 -------- d-----w- C:\Windows\SysWow64\ZoneLabs
    2011-09-05 16:48:05 458840 ----a-w- C:\Windows\System32\drivers\~GLH0023.TMP
    2011-09-05 16:47:58 458840 ------w- C:\Windows\System32\drivers\vsdatant.sys
    2011-09-05 16:47:58 -------- d-----w- C:\Program Files (x86)\Zone Labs
    2011-09-05 16:47:23 -------- d-----w- C:\Windows\Internet Logs
    2011-09-05 16:47:23 -------- d-----w- C:\ProgramData\CheckPoint
    2011-09-05 15:51:24 -------- d-----w- C:\Users\james\AppData\Local\{991A1305-B31A-42C3-9C58-ACD64206DEA5}
    2011-09-05 07:22:47 -------- d-----w- C:\Users\james\AppData\Local\{8A5D5E52-8760-4E56-9714-4442F375E036}
    2011-09-05 07:22:25 -------- d-----w- C:\Users\james\AppData\Local\{96748304-7510-45CB-8A32-4CD36F4FC6EC}
    2011-09-05 07:22:11 -------- d-----w- C:\Users\james\AppData\Roaming\Windows Live Writer
    2011-09-05 07:22:11 -------- d-----w- C:\Users\james\AppData\Local\Windows Live Writer
    2011-09-05 02:29:06 -------- d-----w- C:\Users\james\AppData\Local\{2ECD1FCC-7BFF-4631-BFB3-2B8D60DF12F2}
    2011-09-05 02:28:39 -------- d-----w- C:\Users\james\AppData\Local\{B1EF2176-A448-49E1-9EA7-146B67C71E40}
    2011-09-05 01:24:16 5120 ---ha-w- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
    2011-09-05 01:10:14 -------- d-----w- C:\Users\james\AppData\Local\{1015C3BE-7396-4825-8205-BFEFE411485E}
    2011-09-05 01:09:54 -------- d-----w- C:\Users\james\AppData\Local\{92BA95BC-0C90-4F37-AEF7-767FD57FCC00}
    2011-09-04 23:07:38 -------- d-----w- C:\Users\james\AppData\Local\{0BC1DFBE-4962-4846-87CC-278DF79F33B8}
    2011-09-04 23:07:11 -------- d-----w- C:\Users\james\AppData\Local\{366FD15B-91BB-4551-AAF7-A9DCB04AEDBE}
    2011-09-04 21:55:23 -------- d-----w- C:\Users\james\AppData\Local\{E997FE66-7726-4FA6-8884-7F87E4984DCB}
    2011-09-04 21:55:05 -------- d-----w- C:\Users\james\AppData\Local\{284560EB-EFBD-46D3-834E-2F935C096087}
    2011-09-04 01:29:00 -------- d-----w- C:\Program Files (x86)\Codemasters
    2011-09-03 20:22:53 -------- d-----w- C:\Users\james\AppData\Local\{F4C25E2F-6B00-46CC-9F11-68C0B32263B2}
    2011-09-03 20:22:36 -------- d-----w- C:\Users\james\AppData\Local\{56BE31B0-247B-47C7-BF41-6B2F3B0A9723}
    2011-08-26 22:21:30 42392 ----a-w- C:\Windows\SysWow64\xfcodec.dll
    2011-08-26 22:21:30 28056 ----a-w- C:\Windows\System32\xfcodec64.dll
    2011-08-26 00:14:05 -------- d-----w- C:\Users\james\AppData\Local\{A6B25C57-A680-4687-BA42-5B5D8D7E9FD5}
    2011-08-26 00:13:31 -------- d-----w- C:\Users\james\AppData\Local\{E9BFB57C-324C-4A6C-91BB-5AF6977A38E5}
    2011-08-13 04:30:06 -------- d-----w- C:\Limbo.RIP.REPACK-Unleashed
    .
    ==================== Find3M ====================
    .
    2011-08-03 23:27:51 50841162 ----a-w- C:\Adobe Photoshop CS3 Portable.exe
    2011-07-22 05:42:23 2303488 ----a-w- C:\Windows\System32\jscript9.dll
    2011-07-22 05:36:16 1389056 ----a-w- C:\Windows\System32\wininet.dll
    2011-07-22 02:54:43 1797632 ----a-w- C:\Windows\SysWow64\jscript9.dll
    2011-07-22 02:48:26 1126912 ----a-w- C:\Windows\SysWow64\wininet.dll
    2011-07-16 05:41:50 362496 ----a-w- C:\Windows\System32\wow64win.dll
    2011-07-16 05:41:49 243200 ----a-w- C:\Windows\System32\wow64.dll
    2011-07-16 05:41:49 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
    2011-07-16 05:39:10 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
    2011-07-16 05:37:12 421888 ----a-w- C:\Windows\System32\KernelBase.dll
    2011-07-16 04:29:19 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
    2011-07-16 04:26:00 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
    2011-07-16 04:25:37 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
    2011-07-16 04:24:23 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
    2011-07-16 04:24:22 272384 ----a-w- C:\Windows\SysWow64\KernelBase.dll
    2011-07-16 02:21:44 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
    2011-07-16 02:21:41 2048 ----a-w- C:\Windows\SysWow64\user.exe
    2011-07-16 02:17:19 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
    2011-07-16 02:17:19 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
    2011-07-16 02:17:19 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
    2011-07-16 02:17:19 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
    2011-07-06 23:52:42 41272 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    2011-06-24 05:34:53 214528 ----a-w- C:\Windows\System32\winsrv.dll
    2011-06-24 05:25:49 338432 ----a-w- C:\Windows\System32\conhost.exe
    2011-06-21 06:34:00 1923968 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    .
    ============= FINISH: 11:07:59.60 ===============


    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Ultimate
    Boot Device: \Device\HarddiskVolume1
    Install Date: 2/10/2011 3:18:50 PM
    System Uptime: 9/7/2011 11:14:32 PM (60 hours ago)
    .
    Motherboard: ASUSTeK Computer INC. | | M4A88T-V EVO/USB3
    Processor: AMD Phenom(tm) II X2 560 Processor | AM3 | 3300/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 931 GiB total, 213.048 GiB free.
    D: is CDROM (CDFS)
    G: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Edimax 802.11g Wireless PCI Card
    Device ID: PCI\VEN_1814&DEV_0301&SUBSYS_71281432&REV_00\4&2966AB86&0&30A4
    Manufacturer: Edimax Technology Co., Ltd.
    Name: Edimax 802.11g Wireless PCI Card
    PNP Device ID: PCI\VEN_1814&DEV_0301&SUBSYS_71281432&REV_00\4&2966AB86&0&30A4
    Service: rt61x64
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Hamachi Network Interface
    Device ID: ROOT\NET\0000
    Manufacturer: LogMeIn, Inc.
    Name: Hamachi Network Interface
    PNP Device ID: ROOT\NET\0000
    Service: hamachi
    .
    ==== System Restore Points ===================
    .
    RP150: 9/6/2011 6:35:24 PM - Windows Update
    RP151: 9/7/2011 9:38:45 AM - Windows Update
    RP152: 9/7/2011 12:02:02 PM - Windows Update
    .
    ==== Installed Programs ======================
    .
    7-Zip 9.20
    Acrobat.com
    Adobe AIR
    Adobe Community Help
    Adobe Download Manager
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Flash Professional CS5
    Adobe Media Player
    Adobe Reader 9
    Advent Rising
    AI Suite II
    AOL Instant Messenger
    APB Reloaded
    Assassin's Creed
    ATI Catalyst Registration
    Back to the Future The Game - Episode 4
    Bandisoft MPEG-1 Decoder
    Batman: Arkham Asylum GOTY Edition
    BootDreams
    Borderlands
    Browser Configuration Utility
    BulletStorm
    Catalyst Control Center - Branding
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center InstallProxy
    ccc-core-static
    CCC Help English
    CDisplayEx 1.8
    Cheetah DVD Burner
    CrysisR 2
    D3DX10
    DAEMON Tools Lite
    Dead Rising 2
    Dead Space
    DiscJuggler
    Download Accelerator Plus (DAP)
    DreamCast Factory v0.9.5 (FULL)
    Dual-Core Optimizer
    DVDFab 8.0.6.7 (02/01/2011)
    Edimax RT6x Wireless LAN Card
    Emsisoft Anti-Malware 5.1
    F.E.A.R. 2: Project Origin
    FileZilla Client 3.5.0
    Free DVD Video Burner version 3.0.1.305
    GamersFirst LIVE!
    Gears of War
    Google Talk Plugin
    Grand Theft Auto IV
    Grand Theft Auto IV v1.0 Eng
    Grand Theft Auto: Episodes from Liberty City
    HiJackThis
    HydraVision
    ICQ Toolbar
    ICQ7.4
    IJC WeaponPack
    Java(TM) 6 Update 22
    Just Cause 1.00.0000
    K-Lite Codec Pack 6.9.0 (Basic)
    Kane and Lynch - Dead Men Repack by roaringlion
    League of Legends
    LightScribe System Software
    LogMeIn Hamachi
    LOST PLANET 2
    Lost Planet Extreme Condition
    Magic ISO Maker v5.5 (build 0281)
    Magicka
    Malwarebytes' Anti-Malware version 1.51.1.1800
    Mass Effect 2
    Messenger Companion
    Microsoft Games for Windows - LIVE Redistributable
    Microsoft Games for Windows Marketplace
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
    Microsoft XNA Framework Redistributable 3.1
    Microsoft_VC80_ATL_x86
    Microsoft_VC80_CRT_x86
    Microsoft_VC80_MFC_x86
    Microsoft_VC80_MFCLOC_x86
    Microsoft_VC90_ATL_x86
    Microsoft_VC90_CRT_x86
    Microsoft_VC90_MFC_x86
    Monday Night Combat
    Mozilla Firefox 4.0.1 (x86 en-US)
    MSVCRT
    Nero Burning ROM 10
    Nero BurningROM 10 Help (CHM)
    Nero BurnRights 10
    Nero BurnRights 10 Help (CHM)
    Nero Control Center 10
    Nero ControlCenter 10 Help (CHM)
    Nero Core Components 10
    Nero Update
    Network RPG Maker 2000 FR
    Nexon Game Manager
    NitroFamily
    NVIDIA PhysX
    OF Dragon Rising
    Paltalk Messenger
    Pando Media Booster
    PCSX2 - Playstation 2 Emulator
    PDF Settings CS5
    Portal 2
    PunkBuster Services
    Real Alternative 2.0.2
    Realtek Ethernet Controller Driver For Windows 7
    Realtek High Definition Audio Driver
    Renesas Electronics USB 3.0 Host Controller Driver
    RESIDENT EVIL 5
    RZ DVD Creator
    ScreenSteps 2.8
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Snagit 10
    Spider-Man Shattered Dimensions Repack
    Spybot - Search & Destroy
    Steam
    Street Fighter IV
    System Requirements Lab CYRI
    TCPEye 1.0
    The Last Remnant
    The Lord of the Rings FREE Trial
    Uninstall 1.0.0.1
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    VBReFormer 5.0 Professional Edition
    Ventrilo Client
    Viewpoint Media Player
    Vindictus
    WebTablet IE Plugin
    WebTablet Netscape Plugin
    WinAVI All in One Converter
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Messenger
    Windows Live Messenger Companion Core
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Xfire (remove only)
    Xvid MPEG-4 Video Codec
    Xvid Video Codec
    ZoneAlarm
    μTorrent
    タクティクスチャレンジ!2008夏バージョン
    ーュェZェフ
    .
    ==== Event Viewer Messages From Past Week ========
    .
    9/7/2011 9:44:54 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Modules Installer service, but this action failed with the following error: An instance of the service is already running.
    9/7/2011 9:44:32 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Installer service, but this action failed with the following error: An instance of the service is already running.
    9/7/2011 9:43:37 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package (KB2538243).
    9/7/2011 9:42:54 AM, Error: Service Control Manager [7031] - The Windows Modules Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    9/7/2011 9:42:51 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800b0100: Update for Windows 7 for x64-based Systems (KB2529073).
    9/7/2011 9:42:51 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800b0100: Security Update for Windows 7 for x64-based Systems (KB2532531).
    9/7/2011 9:42:40 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 for x64-based Systems (KB2539636).
    9/7/2011 9:42:32 AM, Error: Service Control Manager [7031] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    9/7/2011 9:39:47 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800736cc: Security Update for Windows 7 for x64-based Systems (KB2556532).
    9/7/2011 9:30:44 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffffa800491a7a7, 0x0000000000000000, 0x0000000076da0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 090711-35006-01.
    9/7/2011 11:44:56 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000076 (0x0000000000000000, 0xfffffa8003beb2c0, 0x00000000000007d1, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 090711-29125-01.
    9/7/2011 11:19:24 PM, Error: Service Control Manager [7001] - The MBAMService service depends on the MBAMProtector service which failed to start because of the following error: The system cannot find the file specified.
    9/7/2011 11:19:24 PM, Error: Service Control Manager [7000] - The MBAMProtector service failed to start due to the following error: The system cannot find the file specified.
    9/7/2011 11:15:14 PM, Error: Service Control Manager [7000] - The Eset Trial Reset service failed to start due to the following error: The system cannot find the file specified.
    9/7/2011 11:15:14 PM, Error: Service Control Manager [7000] - The AMD FUEL Service service failed to start due to the following error: The system cannot find the file specified.
    9/6/2011 7:10:37 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070005: Security Update for Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package (KB2538243).
    9/6/2011 6:26:04 PM, Error: Service Control Manager [7000] - The Eset Trial Reset service failed to start due to the following error: Eset Trial Reset is not a valid Win32 application.
    9/6/2011 3:17:04 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
    9/6/2011 11:04:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
    9/6/2011 11:04:15 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Installer service to connect.
    9/6/2011 11:04:15 PM, Error: Service Control Manager [7000] - The Windows Installer service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    9/5/2011 5:51:55 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    9/5/2011 5:51:55 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    9/5/2011 5:51:51 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    9/5/2011 5:51:49 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    9/5/2011 5:51:46 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    9/5/2011 5:51:36 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    9/5/2011 5:51:30 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AsIO AsUpIO CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
    9/5/2011 5:51:30 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    9/5/2011 5:51:30 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    9/5/2011 5:51:30 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    9/5/2011 5:51:30 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    9/5/2011 5:51:30 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    9/5/2011 5:51:30 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
    9/5/2011 5:51:30 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    9/5/2011 5:51:30 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    9/5/2011 5:51:30 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    9/5/2011 5:51:30 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    9/5/2011 5:17:23 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
    9/5/2011 12:49:49 PM, Error: Service Control Manager [7030] - The ZoneAlarm Toolbar IswSvc service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    9/5/2011 12:48:08 PM, Error: Service Control Manager [7030] - The TrueVector Internet Monitor service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    9/5/2011 11:51:01 AM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
    9/5/2011 11:49:49 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SSDP Discovery service to connect.
    9/5/2011 11:49:49 AM, Error: Service Control Manager [7000] - The SSDP Discovery service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    9/5/2011 11:48:14 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Eset Trial Reset service to connect.
    9/5/2011 11:48:14 AM, Error: Service Control Manager [7000] - The Eset Trial Reset service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    9/5/2011 10:50:24 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    9/4/2011 6:18:19 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    9/4/2011 6:11:24 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    9/4/2011 6:11:12 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AsIO AsUpIO discache spldr Wanarpv6
    9/4/2011 10:32:40 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
    9/10/2011 10:36:08 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.
    .
    ==== End Of File ===========================
     
  2. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ==================================================================

    You're running two AV programs, Emisoft and NOD.
    One of them has to go.
    I suggest Emisoft goes.

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan:
    [​IMG]

    On completion of the scan click "Save log", save it to your desktop and post in your next reply:
    [​IMG]

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    ===============================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  3. megaman8x

    megaman8x TS Rookie Topic Starter

    request

    here are the logs you requested:

    aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
    Run date: 2011-09-10 17:12:01
    -----------------------------
    17:12:01.786 OS Version: Windows x64 6.1.7601 Service Pack 1
    17:12:01.786 Number of processors: 2 586 0x403
    17:12:01.787 ComputerName: ALBATROSS UserName: james
    17:12:03.103 Initialize success
    17:12:06.627 AVAST engine defs: 11091002
    17:12:16.171 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
    17:12:16.173 Disk 0 Vendor: WDC_WD1002FAEX-00Y9A0 05.01D05 Size: 953869MB BusType: 3
    17:12:18.188 Disk 0 MBR read successfully
    17:12:18.190 Disk 0 MBR scan
    17:12:18.194 Disk 0 MBR:Alureon-I [Rtk]
    17:12:18.195 Disk 0 TDL4@MBR code has been found
    17:12:18.197 Disk 0 Windows 7 default MBR code found via API
    17:12:18.199 Disk 0 MBR hidden
    17:12:18.202 Disk 0 MBR [TDL4] **ROOTKIT**
    17:12:18.204 Disk 0 trace - called modules:
    17:12:18.207 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa800493c254]<<
    17:12:18.211 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800490e2d0]
    17:12:18.214 3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> [0xfffffa8003ad6520]
    17:12:18.217 5 ACPI.sys[fffff88000f567a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8003ac3060]
    17:12:18.220 \Driver\atapi[0xfffffa8003aa8640] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xfffffa800493c254
    17:12:19.338 AVAST engine scan C:\Windows
    17:12:24.977 AVAST engine scan C:\Windows\system32
    17:14:02.439 AVAST engine scan C:\Windows\system32\drivers
    17:14:13.414 AVAST engine scan C:\Users\james
    17:24:58.482 AVAST engine scan C:\ProgramData
    17:26:03.714 Scan finished successfully
    17:31:30.245 Disk 0 MBR has been saved successfully to "C:\MBR.dat"
    17:31:30.249 The log file has been saved successfully to "C:\aswMBRxxxx.txt"

    *combofix never actually disabled my internet but a couple of files tried to access it according to my firewall, im not sure if i was suppose to so i allowed access*

    ComboFix 11-09-10.03 - james 0/2011 Sat 18:00:39.1.2 - x64
    Microsoft Windows 7 Ultimate 6.1.7601.1.932.81.1033.18.4095.1658 [GMT -4:00]
    Running from: c:\users\james\Desktop\ComboFix.exe
    AV: Emsisoft Anti-Malware *Disabled/Updated* {0ADC9F7D-20C1-240F-01E2-43466EBA893A}
    AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
    FW: ZoneAlarm Firewall *Enabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
    SP: Emsisoft Anti-Malware *Disabled/Updated* {B1BD7E99-06FB-2B81-3B52-7834153DC387}
    SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    C:\Install.exe
    c:\windows\SysWow64\14_43260.dll
    c:\windows\SysWow64\28_83260.dll
    c:\windows\SysWow64\mfc100deu.dll
    c:\windows\SysWow64\vid_conv2.dll
    c:\windows\SysWow64\vid_core2.dll
    c:\windows\SysWow64\vid_format2.dll
    c:\windows\SysWow64\vid_multi2.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-08-10 to 2011-09-10 )))))))))))))))))))))))))))))))
    .
    .
    2011-09-10 22:37 . 2011-09-10 22:37 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-09-10 15:44 . 2011-09-10 15:57 -------- d-----w- C:\Dead Island
    2011-09-10 15:37 . 2011-09-10 15:37 -------- d-----w- C:\rld-deis
    2011-09-07 16:01 . 2011-06-23 05:43 5561216 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-09-07 16:01 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
    2011-09-07 16:01 . 2011-06-23 04:33 3967872 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
    2011-09-07 13:38 . 2011-03-11 06:33 2565632 ----a-w- c:\windows\system32\esent.dll
    2011-09-07 13:38 . 2011-03-11 06:30 96768 ----a-w- c:\windows\system32\fsutil.exe
    2011-09-07 13:38 . 2011-03-11 05:33 1699328 ----a-w- c:\windows\SysWow64\esent.dll
    2011-09-07 13:38 . 2011-03-11 06:41 189824 ----a-w- c:\windows\system32\drivers\storport.sys
    2011-09-07 13:38 . 2011-03-11 06:41 1659776 ----a-w- c:\windows\system32\drivers\ntfs.sys
    2011-09-07 13:38 . 2011-03-11 06:41 148352 ----a-w- c:\windows\system32\drivers\nvraid.sys
    2011-09-07 13:38 . 2011-03-11 06:41 410496 ----a-w- c:\windows\system32\drivers\iaStorV.sys
    2011-09-07 13:38 . 2011-03-11 06:41 27008 ----a-w- c:\windows\system32\drivers\amdxata.sys
    2011-09-07 13:38 . 2011-03-11 06:41 107904 ----a-w- c:\windows\system32\drivers\amdsata.sys
    2011-09-07 13:38 . 2011-03-11 06:41 166272 ----a-w- c:\windows\system32\drivers\nvstor.sys
    2011-09-07 13:38 . 2011-03-11 05:31 74240 ----a-w- c:\windows\SysWow64\fsutil.exe
    2011-09-06 23:09 . 2011-08-16 12:48 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{918BDB04-4E10-42AD-B7F4-AEABC889A4B5}\mpengine.dll
    2011-09-06 22:36 . 2011-07-22 05:32 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2011-09-06 22:36 . 2011-07-22 02:44 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
    2011-09-06 22:34 . 2011-07-09 02:46 288768 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2011-09-06 22:34 . 2011-04-27 02:40 158208 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-09-06 22:34 . 2011-04-27 02:39 128000 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
    2011-09-06 04:11 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2011-09-06 04:11 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-09-06 04:09 . 2011-06-15 10:02 212992 ----a-w- c:\windows\system32\odbctrac.dll
    2011-09-06 04:09 . 2011-06-15 10:02 163840 ----a-w- c:\windows\system32\odbccp32.dll
    2011-09-06 04:09 . 2011-06-15 10:02 106496 ----a-w- c:\windows\system32\odbccu32.dll
    2011-09-06 04:09 . 2011-06-15 10:02 106496 ----a-w- c:\windows\system32\odbccr32.dll
    2011-09-06 04:09 . 2011-06-15 09:59 126976 ----a-w- c:\program files\Common Files\System\Ole DB\msdaosp.dll
    2011-09-06 04:09 . 2011-06-15 08:55 86016 ----a-w- c:\windows\SysWow64\odbccu32.dll
    2011-09-06 04:09 . 2011-06-15 08:55 81920 ----a-w- c:\windows\SysWow64\odbccr32.dll
    2011-09-06 04:09 . 2011-06-15 08:55 319488 ----a-w- c:\windows\SysWow64\odbcjt32.dll
    2011-09-06 04:09 . 2011-06-15 08:55 163840 ----a-w- c:\windows\SysWow64\odbctrac.dll
    2011-09-06 04:09 . 2011-06-15 08:55 122880 ----a-w- c:\windows\SysWow64\odbccp32.dll
    2011-09-06 04:09 . 2011-06-15 08:54 94208 ----a-w- c:\program files (x86)\Common Files\System\Ole DB\msdaosp.dll
    2011-09-06 04:07 . 2011-04-29 03:06 467456 ----a-w- c:\windows\system32\drivers\srv.sys
    2011-09-06 04:07 . 2011-04-29 03:05 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
    2011-09-06 04:07 . 2011-04-29 03:05 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2011-09-06 04:07 . 2011-02-25 06:22 861696 ----a-w- c:\windows\system32\oleaut32.dll
    2011-09-06 04:07 . 2011-02-25 05:34 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
    2011-09-06 04:05 . 2011-05-03 05:29 976896 ----a-w- c:\windows\system32\inetcomm.dll
    2011-09-06 04:05 . 2011-05-03 04:30 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
    2011-09-05 22:44 . 2011-09-10 14:21 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
    2011-09-05 16:50 . 2011-09-05 16:50 -------- d-----w- c:\users\james\AppData\Roaming\CheckPoint
    2011-09-05 16:49 . 2011-09-05 16:49 0 ----a-w- c:\windows\SysWow64\ConduitEngine.tmp
    2011-09-05 16:49 . 2011-09-05 16:49 -------- d-----w- c:\users\james\AppData\Local\Conduit
    2011-09-05 16:49 . 2011-09-05 16:49 -------- d-----w- c:\program files (x86)\ZoneAlarm_Security
    2011-09-05 16:48 . 2011-09-05 16:48 -------- d-----w- c:\program files\CheckPoint
    2011-09-05 16:48 . 2011-03-18 05:24 69120 ----a-w- c:\windows\SysWow64\zlcomm.dll
    2011-09-05 16:48 . 2011-03-18 05:24 104448 ----a-w- c:\windows\SysWow64\zlcommdb.dll
    2011-09-05 16:48 . 2011-09-05 16:50 -------- d-----w- c:\windows\SysWow64\ZoneLabs
    2011-09-05 16:48 . 2011-03-18 05:24 1238528 ----a-w- c:\windows\SysWow64\zpeng25.dll
    2011-09-05 16:48 . 2010-05-15 20:30 458840 ----a-w- c:\windows\system32\drivers\~GLH0023.TMP
    2011-09-05 16:47 . 2011-09-05 16:47 -------- d-----w- c:\program files (x86)\Zone Labs
    2011-09-05 16:47 . 2010-05-15 20:30 458840 ------w- c:\windows\system32\drivers\vsdatant.sys
    2011-09-05 16:47 . 2011-09-10 22:45 -------- d-----w- c:\windows\Internet Logs
    2011-09-05 16:47 . 2011-09-05 16:47 -------- d-----w- c:\programdata\CheckPoint
    2011-09-05 07:22 . 2011-09-05 07:22 -------- d-----w- c:\users\james\AppData\Local\Windows Live Writer
    2011-09-05 07:22 . 2011-09-05 07:22 -------- d-----w- c:\users\james\AppData\Roaming\Windows Live Writer
    2011-09-05 01:24 . 2011-07-16 05:21 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
    2011-09-04 01:29 . 2011-09-05 15:17 -------- d-----w- c:\program files (x86)\Codemasters
    2011-08-26 22:21 . 2011-08-26 22:21 42392 ----a-w- c:\windows\SysWow64\xfcodec.dll
    2011-08-26 22:21 . 2011-08-26 22:21 28056 ----a-w- c:\windows\system32\xfcodec64.dll
    2011-08-13 04:30 . 2011-09-05 15:12 -------- d-----w- C:\Limbo.RIP.REPACK-Unleashed
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-08-03 23:27 . 2011-08-03 23:24 50841162 ----a-w- C:\Adobe Photoshop CS3 Portable.exe
    2011-07-16 04:26 . 2011-09-06 04:06 44032 ----a-w- c:\windows\apppatch\acwow64.dll
    2011-07-06 23:52 . 2011-05-21 02:26 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files (x86)\ZoneAlarm_Security\prxtbZone.dll" [2011-03-28 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
    2011-03-28 16:22 176936 ----a-w- c:\program files (x86)\ZoneAlarm_Security\prxtbZone.dll
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
    "{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files (x86)\ZoneAlarm_Security\prxtbZone.dll" [2011-03-28 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Steam"="c:\program files (x86)\Steam\steam.exe" [2011-08-02 1242448]
    "DownloadAccelerator"="c:\program files (x86)\DAP\DAP.EXE" [2010-09-07 3432098]
    "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
    "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
    "ASUS AI Direct Link Command Execute"="c:\program files (x86)\ASUS\AI Suite II\AI Direct Link\AsCmd.exe" [2010-05-19 383104]
    "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
    "ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-05 311296]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-26 98304]
    "ZoneAlarm Client"="c:\program files (x86)\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]
    .
    c:\users\james\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Xfire.lnk - c:\program files (x86)\Xfire\Xfire.exe [2011-8-26 3510680]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoActiveDesktop"= 1 (0x1)
    "ForceActiveDesktopOn"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    SetupExecute REG_MULTI_SZ \0
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    R2 .EsetTrialReset;Eset Trial Reset;c:\windows\reset.exe [x]
    R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
    R3 ALSysIO;ALSysIO;c:\users\james\AppData\Local\Temp\ALSysIO64.sys [x]
    R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
    R3 DKRtWrt;DKRtWrt;c:\windows\system32\DRIVERS\DKRtWrt.sys [x]
    R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
    R3 rt61x64;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr6164.sys [x]
    R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
    R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
    R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [x]
    R4 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2010-03-05 235752]
    R4 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-03-28 2111368]
    R4 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-09-06 247096]
    R4 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
    R4 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
    S1 a2injectiondriver;a2injectiondriver;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2010-09-05 48216]
    S1 a2util;a-squared Malware-IDS utility driver;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys [2010-05-05 14720]
    S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 a2AntiMalware;Emsisoft Anti-Malware 5.1 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [2011-06-30 3029208]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-12-28 96896]
    S2 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
    S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-09-29 735960]
    S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
    S2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2011-02-15 33528]
    S2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2011-02-15 822264]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2010-11-15 5716848]
    S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [2011-02-21 85800]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
    S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
    S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
    S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
    S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
    nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94a08c5f-36e9-11e0-bb39-bcaec5abace6}]
    \shell\AutoRun\command - G:\steambackup2.EXE
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2009-06-17 17:11 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-09-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4079991190-3454297349-2113980778-1000Core.job
    - c:\users\james\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-13 00:21]
    .
    2011-09-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4079991190-3454297349-2113980778-1000UA.job
    - c:\users\james\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-13 00:21]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}]
    2010-07-28 23:05 397312 ----a-w- c:\program files (x86)\DAP\DAPIELoader64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-06 11057768]
    "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-02-12 2715704]
    "Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2010-06-14 190536]
    "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-11-11 2345848]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632]
    "ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-02-15 1123320]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: &Clean Traces - c:\program files (x86)\DAP\Privacy Package\dapcleanerie.htm
    IE: &Download with &DAP - c:\program files (x86)\DAP\dapextie.htm
    IE: Download &all with DAP - c:\program files (x86)\DAP\dapextie2.htm
    IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
    Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~2\DAP\dapie.dll
    Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~2\DAP\dapie.dll
    FF - ProfilePath - c:\users\james\AppData\Roaming\Mozilla\Firefox\Profiles\zooo9ewn.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=
    FF - prefs.js: network.proxy.type - 0
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
    WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
    AddRemove-Adobe Flash Player Plugin - c:\windows\SysWOW64\Macromed\Flash\FlashUtil10n_Plugin.exe
    AddRemove-Grand Theft Auto IV_is1 - c:\games\Grand Theft Auto IV\unins000.exe
    AddRemove-{E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\program files (x86)\NOS\bin\getPlusUninst_Adobe.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    @Allowed: (Read) (RestrictedCode)
    "?慴"=hex:5a,5c,e0,73,03,fa,20,59,39,6d,90,d6,fc,b1,d0,e2,af,cd,26,8d,57,9a,28,
    3b,ba,9c,6f,b2,59,a6,d3,5e,59,d4,13,10,77,c8,f7,74,c1,a3,00,53,8a,37,ad,fc,\
    "?祥"=hex:87,c0,85,e9,02,32,ff,29,8d,ab,f8,27,4f,7c,07,e3
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000\Software\SecuROM\License information*]
    "datasecu"=hex:72,10,5a,a2,5d,c3,b5,6e,7e,1e,e9,35,7e,77,7e,9a,40,3d,ee,85,4f,
    59,78,40,56,dd,e7,6f,4a,b7,fc,fa,65,62,43,f6,76,26,e9,d3,5c,94,f6,c1,2c,d0,\
    "rkeysecu"=hex:b9,db,97,70,69,de,91,b5,43,94,df,b5,c3,db,fb,d6
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000_Classes\T*A*C*T*I*C*S*ム0テ0ア0・ク0\CLSID]
    @="{B2FD448E-6846-438E-9450-8E2F5EEC1BD1}"
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000_Classes\T*A*C*T*I*C*S*ム0テ0ア0・ク0\DefaultIcon]
    @=expand:"%APPDATA%\\Microsoft\\Installer\\{688FBB5D-C462-488C-B07E-B3CA8D3B4C1D}\\_61526c10.exe,0"
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000_Classes\T*A*C*T*I*C*S*ム0テ0ア0・ク0\shell]
    @="open"
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000_Classes\T*A*C*T*I*C*S*ム0テ0ア0・ク0\shell\open]
    @="開く(&O)"
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000_Classes\T*A*C*T*I*C*S*ム0テ0ア0・ク0\shell\open\command]
    @="\"c:\\Program Files (x86)\\タクティクスチャレンジ!\\TC3Boot.exe\" \"%1\""
    "command"=multi:"5kR[IzQ}B?&XX0jZWHK,>FIUjHUBZ9?vmhl5hhE}R \"%1\"\00\00"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info]
    @Denied: (2) (LocalSystem)
    "AppDataDir"="c:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\"
    "DataDir"="ESET\\ESET NOD32 Antivirus\\"
    "EditionName"=" "
    "InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\"
    "LanguageId"=dword:00000409
    "PackageTag"=dword:00000000
    "ProductBase"=dword:00000000
    "ProductCode"="{4183655A-5FC6-4A23-A804-7764145EC57C}"
    "ProductName"="ESET NOD32 Antivirus"
    "ProductType"="eav"
    "ProductVersion"="4.0.468.0"
    "UniqueId"="0185B5614D56D958"
    "ScannerBuild"=dword:00002210
    "ScannerVersionId"=dword:000016ec
    "ScannerVersion"="Open window for status."
    "FixId"=dword:00000009
    "ei2"=hex(b):ed,68,27,30,a8,1f,0b,2b
    "ei1"=hex(b):bc,ae,c5,ab,ac,e6,00,00
    "ei3"=hex(b):16,e7,56,4d,00,00,00,00
    "ei4"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
    c:\program files (x86)\ASUS\AI Suite II\GPU Boost\GpuBoostServer.exe
    c:\program files (x86)\ASUS\AI Suite II\AsRoutineController.exe
    c:\windows\SysWOW64\PnkBstrA.exe
    c:\program files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe
    c:\program files (x86)\ASUS\AI Suite II\TurboV EVO\TurboUnlocker\TurboInfo.exe
    c:\program files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
    c:\program files (x86)\ASUS\AI Suite II\AI Suite II.exe
    c:\progra~2\ASUS\AISUIT~1\Sensor\HMSERV~1\aaHM.exe
    .
    **************************************************************************
    .
    Completion time: 2011-09-10 19:07:03 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-09-10 23:06
    .
    Pre-Run: 223,267,553,280 bytes free
    Post-Run: 222,875,525,120 bytes free
    .
    - - End Of File - - 397E3C1FB4D703535D90B35C99B8396C
     
  4. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Download TDSSKiller and save it to your desktop.
    • Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
  5. megaman8x

    megaman8x TS Rookie Topic Starter

    report log

    here is the log you requested:

    2011/09/11 02:36:59.0328 6112 TDSS rootkit removing tool 2.5.20.0 Sep 7 2011 16:44:34
    2011/09/11 02:37:00.0491 6112 ================================================================================
    2011/09/11 02:37:00.0492 6112 SystemInfo:
    2011/09/11 02:37:00.0492 6112
    2011/09/11 02:37:00.0492 6112 OS Version: 6.1.7601 ServicePack: 1.0
    2011/09/11 02:37:00.0492 6112 Product type: Workstation
    2011/09/11 02:37:00.0492 6112 ComputerName: ALBATROSS
    2011/09/11 02:37:00.0492 6112 UserName: james
    2011/09/11 02:37:00.0492 6112 Windows directory: C:\Windows
    2011/09/11 02:37:00.0492 6112 System windows directory: C:\Windows
    2011/09/11 02:37:00.0492 6112 Running under WOW64
    2011/09/11 02:37:00.0492 6112 Processor architecture: Intel x64
    2011/09/11 02:37:00.0492 6112 Number of processors: 2
    2011/09/11 02:37:00.0492 6112 Page size: 0x1000
    2011/09/11 02:37:00.0492 6112 Boot type: Normal boot
    2011/09/11 02:37:00.0492 6112 ================================================================================
    2011/09/11 02:37:01.0557 6112 Initialize success
    2011/09/11 02:37:04.0305 2884 ================================================================================
    2011/09/11 02:37:04.0305 2884 Scan started
    2011/09/11 02:37:04.0305 2884 Mode: Manual;
    2011/09/11 02:37:04.0305 2884 ================================================================================
    2011/09/11 02:37:06.0278 2884 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
    2011/09/11 02:37:06.0366 2884 a2acc (0b8ed3de81ec30ad50873f033b34b39e) C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys
    2011/09/11 02:37:06.0414 2884 a2injectiondriver (f75ddc4047aa1ac85164445cba7601ef) C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys
    2011/09/11 02:37:06.0487 2884 a2util (e41d79682a209f72f4f578cfd4a53952) C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys
    2011/09/11 02:37:06.0535 2884 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
    2011/09/11 02:37:06.0579 2884 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
    2011/09/11 02:37:06.0645 2884 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
    2011/09/11 02:37:06.0721 2884 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
    2011/09/11 02:37:06.0776 2884 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
    2011/09/11 02:37:06.0831 2884 AFD (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
    2011/09/11 02:37:06.0879 2884 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
    2011/09/11 02:37:06.0919 2884 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
    2011/09/11 02:37:07.0075 2884 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
    2011/09/11 02:37:07.0138 2884 amdiox64 (6a2eeb0c4133b20773bb3dd0b7b377b4) C:\Windows\system32\DRIVERS\amdiox64.sys
    2011/09/11 02:37:07.0177 2884 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
    2011/09/11 02:37:07.0355 2884 amdkmdag (60216b0e704584de6d5a9f59e9c34c47) C:\Windows\system32\DRIVERS\atikmdag.sys
    2011/09/11 02:37:07.0522 2884 amdkmdap (6b4e9261b613b047a9a145f328889968) C:\Windows\system32\DRIVERS\atikmpag.sys
    2011/09/11 02:37:07.0559 2884 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
    2011/09/11 02:37:07.0605 2884 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
    2011/09/11 02:37:07.0654 2884 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
    2011/09/11 02:37:07.0695 2884 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
    2011/09/11 02:37:07.0752 2884 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
    2011/09/11 02:37:07.0825 2884 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
    2011/09/11 02:37:07.0852 2884 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
    2011/09/11 02:37:07.0928 2884 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
    2011/09/11 02:37:07.0959 2884 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
    2011/09/11 02:37:07.0999 2884 AtiHDAudioService (4bf5bca6e2608cd8a00bc4a6673a9f47) C:\Windows\system32\drivers\AtihdW76.sys
    2011/09/11 02:37:08.0063 2884 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
    2011/09/11 02:37:08.0091 2884 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
    2011/09/11 02:37:08.0149 2884 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
    2011/09/11 02:37:08.0192 2884 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
    2011/09/11 02:37:08.0239 2884 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
    2011/09/11 02:37:08.0265 2884 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
    2011/09/11 02:37:08.0293 2884 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
    2011/09/11 02:37:08.0325 2884 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
    2011/09/11 02:37:08.0354 2884 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
    2011/09/11 02:37:08.0389 2884 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
    2011/09/11 02:37:08.0414 2884 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
    2011/09/11 02:37:08.0446 2884 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
    2011/09/11 02:37:08.0604 2884 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
    2011/09/11 02:37:08.0645 2884 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
    2011/09/11 02:37:08.0671 2884 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
    2011/09/11 02:37:08.0700 2884 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
    2011/09/11 02:37:08.0758 2884 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
    2011/09/11 02:37:08.0794 2884 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
    2011/09/11 02:37:08.0834 2884 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
    2011/09/11 02:37:08.0860 2884 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
    2011/09/11 02:37:08.0890 2884 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
    2011/09/11 02:37:08.0923 2884 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
    2011/09/11 02:37:08.0966 2884 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
    2011/09/11 02:37:09.0011 2884 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
    2011/09/11 02:37:09.0045 2884 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
    2011/09/11 02:37:09.0088 2884 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
    2011/09/11 02:37:09.0137 2884 DKRtWrt (0172038dabf0df25b2d95cd886b8aa56) C:\Windows\system32\DRIVERS\DKRtWrt.sys
    2011/09/11 02:37:09.0197 2884 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
    2011/09/11 02:37:09.0250 2884 dtsoftbus01 (fb9bef3401ee5ecc2603311b9c64f44a) C:\Windows\system32\DRIVERS\dtsoftbus01.sys
    2011/09/11 02:37:09.0328 2884 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
    2011/09/11 02:37:09.0450 2884 E1G60 (edc6e9c057c9d7f83eea22b4cef5dcad) C:\Windows\system32\DRIVERS\E1G6032E.sys
    2011/09/11 02:37:09.0532 2884 eamon (082dab566f704d258d35ba89f21239ca) C:\Windows\system32\DRIVERS\eamon.sys
    2011/09/11 02:37:09.0625 2884 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
    2011/09/11 02:37:09.0713 2884 ehdrv (4ff6f92f170550e226b4595766c4d6a6) C:\Windows\system32\DRIVERS\ehdrv.sys
    2011/09/11 02:37:09.0785 2884 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
    2011/09/11 02:37:09.0813 2884 epfwwfpr (71c8cbde6b18f90f19e9c7cb884f87c8) C:\Windows\system32\DRIVERS\epfwwfpr.sys
    2011/09/11 02:37:09.0865 2884 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
    2011/09/11 02:37:09.0914 2884 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
    2011/09/11 02:37:09.0960 2884 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
    2011/09/11 02:37:10.0028 2884 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
    2011/09/11 02:37:10.0068 2884 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
    2011/09/11 02:37:10.0110 2884 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
    2011/09/11 02:37:10.0135 2884 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
    2011/09/11 02:37:10.0160 2884 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
    2011/09/11 02:37:10.0192 2884 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
    2011/09/11 02:37:10.0215 2884 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
    2011/09/11 02:37:10.0247 2884 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
    2011/09/11 02:37:10.0297 2884 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
    2011/09/11 02:37:10.0369 2884 hamachi (1e6438d4ea6e1174a3b3b1edc4de660b) C:\Windows\system32\DRIVERS\hamachi.sys
    2011/09/11 02:37:10.0404 2884 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
    2011/09/11 02:37:10.0462 2884 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
    2011/09/11 02:37:10.0492 2884 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
    2011/09/11 02:37:10.0519 2884 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
    2011/09/11 02:37:10.0564 2884 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
    2011/09/11 02:37:10.0589 2884 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
    2011/09/11 02:37:10.0653 2884 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
    2011/09/11 02:37:10.0717 2884 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
    2011/09/11 02:37:10.0766 2884 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
    2011/09/11 02:37:10.0803 2884 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
    2011/09/11 02:37:10.0833 2884 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
    2011/09/11 02:37:10.0879 2884 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
    2011/09/11 02:37:10.0951 2884 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
    2011/09/11 02:37:11.0018 2884 IntcAzAudAddService (f5872a11eb4f6db170d636cd4e53ca9f) C:\Windows\system32\drivers\RTKVHD64.sys
    2011/09/11 02:37:11.0102 2884 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
    2011/09/11 02:37:11.0120 2884 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
    2011/09/11 02:37:11.0179 2884 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
    2011/09/11 02:37:11.0227 2884 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
    2011/09/11 02:37:11.0253 2884 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
    2011/09/11 02:37:11.0295 2884 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
    2011/09/11 02:37:11.0326 2884 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
    2011/09/11 02:37:11.0375 2884 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
    2011/09/11 02:37:11.0466 2884 ISWKL (9d7ac39e2f3a45d6fc277ec10c2732eb) C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys
    2011/09/11 02:37:11.0499 2884 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
    2011/09/11 02:37:11.0531 2884 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
    2011/09/11 02:37:11.0548 2884 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
    2011/09/11 02:37:11.0562 2884 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
    2011/09/11 02:37:11.0577 2884 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
    2011/09/11 02:37:11.0639 2884 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
    2011/09/11 02:37:11.0685 2884 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
    2011/09/11 02:37:11.0711 2884 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
    2011/09/11 02:37:11.0745 2884 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
    2011/09/11 02:37:11.0775 2884 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
    2011/09/11 02:37:11.0799 2884 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
    2011/09/11 02:37:11.0871 2884 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
    2011/09/11 02:37:11.0912 2884 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
    2011/09/11 02:37:11.0954 2884 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
    2011/09/11 02:37:11.0986 2884 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
    2011/09/11 02:37:12.0019 2884 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
    2011/09/11 02:37:12.0035 2884 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
    2011/09/11 02:37:12.0058 2884 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
    2011/09/11 02:37:12.0102 2884 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
    2011/09/11 02:37:12.0131 2884 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
    2011/09/11 02:37:12.0188 2884 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
    2011/09/11 02:37:12.0220 2884 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
    2011/09/11 02:37:12.0248 2884 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
    2011/09/11 02:37:12.0295 2884 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
    2011/09/11 02:37:12.0328 2884 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
    2011/09/11 02:37:12.0359 2884 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
    2011/09/11 02:37:12.0421 2884 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
    2011/09/11 02:37:12.0442 2884 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
    2011/09/11 02:37:12.0454 2884 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
    2011/09/11 02:37:12.0509 2884 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
    2011/09/11 02:37:12.0559 2884 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
    2011/09/11 02:37:12.0576 2884 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
    2011/09/11 02:37:12.0630 2884 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
    2011/09/11 02:37:12.0655 2884 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
    2011/09/11 02:37:12.0667 2884 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
    2011/09/11 02:37:12.0680 2884 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
    2011/09/11 02:37:12.0711 2884 MTsensor (19b006b181e3875fd254f7b67acf1e7c) C:\Windows\system32\DRIVERS\ASACPI.sys
    2011/09/11 02:37:12.0741 2884 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
    2011/09/11 02:37:12.0776 2884 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
    2011/09/11 02:37:12.0863 2884 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
    2011/09/11 02:37:12.0897 2884 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
    2011/09/11 02:37:12.0936 2884 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
    2011/09/11 02:37:12.0950 2884 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
    2011/09/11 02:37:12.0974 2884 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
    2011/09/11 02:37:13.0014 2884 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
    2011/09/11 02:37:13.0051 2884 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
    2011/09/11 02:37:13.0088 2884 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
    2011/09/11 02:37:13.0155 2884 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
    2011/09/11 02:37:13.0208 2884 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
    2011/09/11 02:37:13.0238 2884 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
    2011/09/11 02:37:13.0305 2884 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
    2011/09/11 02:37:13.0357 2884 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
    2011/09/11 02:37:13.0394 2884 nusb3hub (285acec1b13a15ba520aae06bacb9cff) C:\Windows\system32\DRIVERS\nusb3hub.sys
    2011/09/11 02:37:13.0410 2884 nusb3xhc (f6d625ff7b56bb6ea063f0d3a5bbc996) C:\Windows\system32\DRIVERS\nusb3xhc.sys
    2011/09/11 02:37:13.0461 2884 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
    2011/09/11 02:37:13.0517 2884 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
    2011/09/11 02:37:13.0570 2884 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
    2011/09/11 02:37:13.0624 2884 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
    2011/09/11 02:37:13.0659 2884 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
    2011/09/11 02:37:13.0681 2884 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
    2011/09/11 02:37:13.0710 2884 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
    2011/09/11 02:37:13.0739 2884 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
    2011/09/11 02:37:13.0777 2884 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
    2011/09/11 02:37:13.0820 2884 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
    2011/09/11 02:37:13.0860 2884 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
    2011/09/11 02:37:13.0977 2884 Point64 (33328fa8a580885ab0065be6db266e9f) C:\Windows\system32\DRIVERS\point64.sys
    2011/09/11 02:37:14.0032 2884 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
    2011/09/11 02:37:14.0089 2884 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
    2011/09/11 02:37:14.0164 2884 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
    2011/09/11 02:37:14.0218 2884 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
    2011/09/11 02:37:14.0250 2884 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
    2011/09/11 02:37:14.0279 2884 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
    2011/09/11 02:37:14.0315 2884 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
    2011/09/11 02:37:14.0367 2884 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
    2011/09/11 02:37:14.0406 2884 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
    2011/09/11 02:37:14.0471 2884 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
    2011/09/11 02:37:14.0484 2884 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
    2011/09/11 02:37:14.0517 2884 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
    2011/09/11 02:37:14.0541 2884 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
    2011/09/11 02:37:14.0578 2884 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
    2011/09/11 02:37:14.0600 2884 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
    2011/09/11 02:37:14.0662 2884 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
    2011/09/11 02:37:14.0678 2884 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
    2011/09/11 02:37:14.0727 2884 RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys
    2011/09/11 02:37:14.0782 2884 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
    2011/09/11 02:37:14.0821 2884 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
    2011/09/11 02:37:14.0863 2884 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
    2011/09/11 02:37:14.0908 2884 rt61x64 (60eb8a87357ca5b088b422d1e55a2405) C:\Windows\system32\DRIVERS\netr6164.sys
    2011/09/11 02:37:14.0952 2884 RTL8167 (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys
    2011/09/11 02:37:15.0003 2884 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
    2011/09/11 02:37:15.0046 2884 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
    2011/09/11 02:37:15.0108 2884 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
    2011/09/11 02:37:15.0150 2884 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
    2011/09/11 02:37:15.0193 2884 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
    2011/09/11 02:37:15.0223 2884 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
    2011/09/11 02:37:15.0292 2884 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
    2011/09/11 02:37:15.0355 2884 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
    2011/09/11 02:37:15.0379 2884 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
    2011/09/11 02:37:15.0400 2884 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
    2011/09/11 02:37:15.0422 2884 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
    2011/09/11 02:37:15.0459 2884 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
    2011/09/11 02:37:15.0501 2884 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
    2011/09/11 02:37:15.0561 2884 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
    2011/09/11 02:37:15.0584 2884 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
    2011/09/11 02:37:15.0635 2884 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
    2011/09/11 02:37:15.0693 2884 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
    2011/09/11 02:37:15.0747 2884 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
    2011/09/11 02:37:15.0808 2884 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
    2011/09/11 02:37:15.0863 2884 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
    2011/09/11 02:37:15.0896 2884 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
    2011/09/11 02:37:15.0933 2884 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
    2011/09/11 02:37:16.0049 2884 Tcpip (f0e98c00a09fdf791525829a1d14240f) C:\Windows\system32\drivers\tcpip.sys
    2011/09/11 02:37:16.0118 2884 TCPIP6 (f0e98c00a09fdf791525829a1d14240f) C:\Windows\system32\DRIVERS\tcpip.sys
    2011/09/11 02:37:16.0160 2884 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
    2011/09/11 02:37:16.0196 2884 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
    2011/09/11 02:37:16.0226 2884 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
    2011/09/11 02:37:16.0273 2884 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
    2011/09/11 02:37:16.0296 2884 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
    2011/09/11 02:37:16.0356 2884 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
    2011/09/11 02:37:16.0397 2884 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
    2011/09/11 02:37:16.0465 2884 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
    2011/09/11 02:37:16.0506 2884 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
    2011/09/11 02:37:16.0556 2884 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
    2011/09/11 02:37:16.0597 2884 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
    2011/09/11 02:37:16.0635 2884 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
    2011/09/11 02:37:16.0679 2884 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
    2011/09/11 02:37:16.0745 2884 usbccgp (481dff26b4dca8f4cbac1f7dce1d6829) C:\Windows\system32\drivers\usbccgp.sys
    2011/09/11 02:37:16.0794 2884 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
    2011/09/11 02:37:16.0823 2884 usbehci (2ea4aff7be7eb4632e3aa8595b0803b5) C:\Windows\system32\DRIVERS\usbehci.sys
    2011/09/11 02:37:16.0843 2884 usbhub (dc96bd9ccb8403251bcf25047573558e) C:\Windows\system32\drivers\usbhub.sys
    2011/09/11 02:37:16.0872 2884 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
    2011/09/11 02:37:16.0911 2884 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
    2011/09/11 02:37:16.0959 2884 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\drivers\USBSTOR.SYS
    2011/09/11 02:37:17.0012 2884 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys
    2011/09/11 02:37:17.0054 2884 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
    2011/09/11 02:37:17.0094 2884 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
    2011/09/11 02:37:17.0114 2884 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
    2011/09/11 02:37:17.0172 2884 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
    2011/09/11 02:37:17.0219 2884 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
    2011/09/11 02:37:17.0245 2884 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
    2011/09/11 02:37:17.0291 2884 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
    2011/09/11 02:37:17.0312 2884 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
    2011/09/11 02:37:17.0348 2884 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
    2011/09/11 02:37:17.0369 2884 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
    2011/09/11 02:37:17.0436 2884 Vsdatant (48bfa6276bcc0535f5f8898107ed489a) C:\Windows\system32\DRIVERS\vsdatant.sys
    2011/09/11 02:37:17.0481 2884 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
    2011/09/11 02:37:17.0524 2884 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
    2011/09/11 02:37:17.0553 2884 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
    2011/09/11 02:37:17.0599 2884 wacmoumonitor (fe75777289278a4941fe6139e82b3bd9) C:\Windows\system32\DRIVERS\wacmoumonitor.sys
    2011/09/11 02:37:17.0668 2884 wacommousefilter (e04d43c7d1641e95d35cae6086c7e350) C:\Windows\system32\DRIVERS\wacommousefilter.sys
    2011/09/11 02:37:17.0689 2884 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
    2011/09/11 02:37:17.0719 2884 wacomvhid (ec1ceb237e365330c1fcfc4876aa0ac0) C:\Windows\system32\DRIVERS\wacomvhid.sys
    2011/09/11 02:37:17.0766 2884 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
    2011/09/11 02:37:17.0786 2884 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
    2011/09/11 02:37:17.0829 2884 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
    2011/09/11 02:37:17.0851 2884 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
    2011/09/11 02:37:17.0905 2884 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
    2011/09/11 02:37:17.0946 2884 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
    2011/09/11 02:37:18.0034 2884 WmBEnum (680a7846370000d20d7e74917d5b7936) C:\Windows\system32\drivers\WmBEnum.sys
    2011/09/11 02:37:18.0089 2884 WmFilter (14c35ba8189c6f65d839163aa285e954) C:\Windows\system32\drivers\WmFilter.sys
    2011/09/11 02:37:18.0123 2884 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
    2011/09/11 02:37:18.0167 2884 WmVirHid (8488dd91a3ee54a8e29f02ad7bb8201e) C:\Windows\system32\drivers\WmVirHid.sys
    2011/09/11 02:37:18.0197 2884 WmXlCore (14802b3a30aa849c97cb968ccc813bf3) C:\Windows\system32\drivers\WmXlCore.sys
    2011/09/11 02:37:18.0253 2884 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
    2011/09/11 02:37:18.0312 2884 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
    2011/09/11 02:37:18.0358 2884 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
    2011/09/11 02:37:18.0417 2884 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
    2011/09/11 02:37:18.0428 2884 Boot (0x1200) (7c210a1b4e0d4e93f01559cddc5b6910) \Device\Harddisk0\DR0\Partition0
    2011/09/11 02:37:18.0443 2884 Boot (0x1200) (7aa7d819303a58c5a18a8638aa9bc7a4) \Device\Harddisk0\DR0\Partition1
    2011/09/11 02:37:18.0447 2884 ================================================================================
    2011/09/11 02:37:18.0447 2884 Scan finished
    2011/09/11 02:37:18.0447 2884 ================================================================================
    2011/09/11 02:37:18.0456 4888 Detected object count: 0
    2011/09/11 02:37:18.0456 4888 Actual detected object count: 0
     
  6. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    You didn't:
    Why?

    How is computer doing?
     
  7. megaman8x

    megaman8x TS Rookie Topic Starter

    I misunderstood I didn't know you meant immediately, I thought you were referring to the near future.

    Everything is still the same keep getting misdirects and multiple iexplore.exe still running but now ive gotten 2 blue screens after running combofix
     
  8. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    I didn't say "in the near future", so please do it now.

    Then delete your Combofix file, download new one, run it and post new log.
     
  9. megaman8x

    megaman8x TS Rookie Topic Starter

    update

    uninstalled emisoft and here is the log your requested
    ComboFix 11-09-12.03 - james 2/2011 Mon 18:05:07.2.2 - x64
    Microsoft Windows 7 Ultimate 6.1.7601.1.932.81.1033.18.4095.2440 [GMT -4:00]
    Running from: c:\users\james\Desktop\ComboFixes.exe
    AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
    FW: ZoneAlarm Firewall *Enabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
    SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-08-12 to 2011-09-12 )))))))))))))))))))))))))))))))
    .
    .
    2011-09-12 22:39 . 2011-09-12 22:39 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-09-11 20:48 . 2011-09-12 22:43 -------- d-----w- c:\users\james\AppData\Local\LogMeIn Hamachi
    2011-09-11 20:47 . 2011-09-11 20:47 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
    2011-09-11 18:47 . 2011-09-11 20:55 -------- d-----w- C:\Dead Island via Smartsteam
    2011-09-10 21:50 . 2011-09-12 21:59 -------- d-----w- C:\ComboFix
    2011-09-10 15:44 . 2011-09-11 20:56 -------- d-----w- C:\Dead Island
    2011-09-10 15:37 . 2011-09-10 15:37 -------- d-----w- C:\rld-deis
    2011-09-07 16:01 . 2011-06-23 05:43 5561216 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-09-07 16:01 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
    2011-09-07 16:01 . 2011-06-23 04:33 3967872 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
    2011-09-07 13:38 . 2011-03-11 06:33 2565632 ----a-w- c:\windows\system32\esent.dll
    2011-09-07 13:38 . 2011-03-11 06:30 96768 ----a-w- c:\windows\system32\fsutil.exe
    2011-09-07 13:38 . 2011-03-11 05:33 1699328 ----a-w- c:\windows\SysWow64\esent.dll
    2011-09-07 13:38 . 2011-03-11 06:41 189824 ----a-w- c:\windows\system32\drivers\storport.sys
    2011-09-07 13:38 . 2011-03-11 06:41 1659776 ----a-w- c:\windows\system32\drivers\ntfs.sys
    2011-09-07 13:38 . 2011-03-11 06:41 148352 ----a-w- c:\windows\system32\drivers\nvraid.sys
    2011-09-07 13:38 . 2011-03-11 06:41 410496 ----a-w- c:\windows\system32\drivers\iaStorV.sys
    2011-09-07 13:38 . 2011-03-11 06:41 27008 ----a-w- c:\windows\system32\drivers\amdxata.sys
    2011-09-07 13:38 . 2011-03-11 06:41 107904 ----a-w- c:\windows\system32\drivers\amdsata.sys
    2011-09-07 13:38 . 2011-03-11 06:41 166272 ----a-w- c:\windows\system32\drivers\nvstor.sys
    2011-09-07 13:38 . 2011-03-11 05:31 74240 ----a-w- c:\windows\SysWow64\fsutil.exe
    2011-09-06 23:09 . 2011-08-16 12:48 8862544 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{918BDB04-4E10-42AD-B7F4-AEABC889A4B5}\mpengine.dll
    2011-09-06 22:36 . 2011-07-22 05:32 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2011-09-06 22:36 . 2011-07-22 02:44 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
    2011-09-06 22:34 . 2011-07-09 02:46 288768 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2011-09-06 22:34 . 2011-04-27 02:40 158208 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-09-06 22:34 . 2011-04-27 02:39 128000 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
    2011-09-06 04:11 . 2011-07-09 04:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2011-09-06 04:11 . 2011-07-09 05:26 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-09-06 04:09 . 2011-06-15 10:02 212992 ----a-w- c:\windows\system32\odbctrac.dll
    2011-09-06 04:09 . 2011-06-15 10:02 163840 ----a-w- c:\windows\system32\odbccp32.dll
    2011-09-06 04:09 . 2011-06-15 10:02 106496 ----a-w- c:\windows\system32\odbccu32.dll
    2011-09-06 04:09 . 2011-06-15 10:02 106496 ----a-w- c:\windows\system32\odbccr32.dll
    2011-09-06 04:09 . 2011-06-15 09:59 126976 ----a-w- c:\program files\Common Files\System\Ole DB\msdaosp.dll
    2011-09-06 04:09 . 2011-06-15 08:55 86016 ----a-w- c:\windows\SysWow64\odbccu32.dll
    2011-09-06 04:09 . 2011-06-15 08:55 81920 ----a-w- c:\windows\SysWow64\odbccr32.dll
    2011-09-06 04:09 . 2011-06-15 08:55 319488 ----a-w- c:\windows\SysWow64\odbcjt32.dll
    2011-09-06 04:09 . 2011-06-15 08:55 163840 ----a-w- c:\windows\SysWow64\odbctrac.dll
    2011-09-06 04:09 . 2011-06-15 08:55 122880 ----a-w- c:\windows\SysWow64\odbccp32.dll
    2011-09-06 04:09 . 2011-06-15 08:54 94208 ----a-w- c:\program files (x86)\Common Files\System\Ole DB\msdaosp.dll
    2011-09-06 04:07 . 2011-04-29 03:06 467456 ----a-w- c:\windows\system32\drivers\srv.sys
    2011-09-06 04:07 . 2011-04-29 03:05 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
    2011-09-06 04:07 . 2011-04-29 03:05 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2011-09-06 04:07 . 2011-02-25 06:22 861696 ----a-w- c:\windows\system32\oleaut32.dll
    2011-09-06 04:07 . 2011-02-25 05:34 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
    2011-09-06 04:05 . 2011-05-03 05:29 976896 ----a-w- c:\windows\system32\inetcomm.dll
    2011-09-06 04:05 . 2011-05-03 04:30 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
    2011-09-05 22:44 . 2011-09-11 20:26 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
    2011-09-05 16:50 . 2011-09-05 16:50 -------- d-----w- c:\users\james\AppData\Roaming\CheckPoint
    2011-09-05 16:49 . 2011-09-05 16:49 0 ----a-w- c:\windows\SysWow64\ConduitEngine.tmp
    2011-09-05 16:49 . 2011-09-05 16:49 -------- d-----w- c:\users\james\AppData\Local\Conduit
    2011-09-05 16:49 . 2011-09-05 16:49 -------- d-----w- c:\program files (x86)\ZoneAlarm_Security
    2011-09-05 16:48 . 2011-09-05 16:48 -------- d-----w- c:\program files\CheckPoint
    2011-09-05 16:48 . 2011-03-18 05:24 69120 ----a-w- c:\windows\SysWow64\zlcomm.dll
    2011-09-05 16:48 . 2011-03-18 05:24 104448 ----a-w- c:\windows\SysWow64\zlcommdb.dll
    2011-09-05 16:48 . 2011-09-05 16:50 -------- d-----w- c:\windows\SysWow64\ZoneLabs
    2011-09-05 16:48 . 2011-03-18 05:24 1238528 ----a-w- c:\windows\SysWow64\zpeng25.dll
    2011-09-05 16:48 . 2010-05-15 20:30 458840 ----a-w- c:\windows\system32\drivers\~GLH0023.TMP
    2011-09-05 16:47 . 2011-09-05 16:47 -------- d-----w- c:\program files (x86)\Zone Labs
    2011-09-05 16:47 . 2010-05-15 20:30 458840 ------w- c:\windows\system32\drivers\vsdatant.sys
    2011-09-05 16:47 . 2011-09-12 22:44 -------- d-----w- c:\windows\Internet Logs
    2011-09-05 16:47 . 2011-09-05 16:47 -------- d-----w- c:\programdata\CheckPoint
    2011-09-05 07:22 . 2011-09-05 07:22 -------- d-----w- c:\users\james\AppData\Local\Windows Live Writer
    2011-09-05 07:22 . 2011-09-05 07:22 -------- d-----w- c:\users\james\AppData\Roaming\Windows Live Writer
    2011-09-05 01:24 . 2011-07-16 05:21 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
    2011-09-04 01:29 . 2011-09-05 15:17 -------- d-----w- c:\program files (x86)\Codemasters
    2011-08-26 22:21 . 2011-08-26 22:21 42392 ----a-w- c:\windows\SysWow64\xfcodec.dll
    2011-08-26 22:21 . 2011-08-26 22:21 28056 ----a-w- c:\windows\system32\xfcodec64.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-08-03 23:27 . 2011-08-03 23:24 50841162 ----a-w- C:\Adobe Photoshop CS3 Portable.exe
    2011-07-16 04:26 . 2011-09-06 04:06 44032 ----a-w- c:\windows\apppatch\acwow64.dll
    2011-07-06 23:52 . 2011-05-21 02:26 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2011-09-10_22.46.03 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2009-07-14 04:54 . 2011-09-10 22:42 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-07-14 04:54 . 2011-09-12 22:42 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-07-14 04:54 . 2011-09-10 22:42 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:54 . 2011-09-12 22:42 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2011-02-10 20:29 . 2011-09-12 22:44 53120 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2011-09-12 22:44 43910 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2011-02-10 20:24 . 2011-09-12 22:44 10454 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4079991190-3454297349-2113980778-1000_UserData.bin
    + 2011-09-12 22:42 . 2011-09-12 22:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2011-09-10 22:42 . 2011-09-10 22:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2011-09-12 22:42 . 2011-09-12 22:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2011-09-10 22:42 . 2011-09-10 22:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2009-07-14 04:54 . 2011-09-12 22:42 114688 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2011-09-10 22:42 114688 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-07-14 05:01 . 2011-09-12 22:41 230752 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    - 2009-07-14 05:01 . 2011-09-10 22:41 230752 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2011-09-09 19:59 . 2011-09-09 19:59 5423104 c:\windows\Installer\344413.msi
    + 2011-09-11 20:05 . 2011-09-11 20:05 3819520 c:\windows\Installer\12bc8a.msi
    + 2011-02-12 20:45 . 2011-09-12 22:41 23696572 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4079991190-3454297349-2113980778-1000-12288.dat
    - 2011-02-12 20:45 . 2011-09-10 22:41 23696572 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4079991190-3454297349-2113980778-1000-12288.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files (x86)\ZoneAlarm_Security\prxtbZone.dll" [2011-03-28 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
    2011-03-28 16:22 176936 ----a-w- c:\program files (x86)\ZoneAlarm_Security\prxtbZone.dll
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
    "{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files (x86)\ZoneAlarm_Security\prxtbZone.dll" [2011-03-28 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Steam"="c:\program files (x86)\Steam\steam.exe" [2011-08-02 1242448]
    "DownloadAccelerator"="c:\program files (x86)\DAP\DAP.EXE" [2010-09-07 3432098]
    "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
    "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
    "ASUS AI Direct Link Command Execute"="c:\program files (x86)\ASUS\AI Suite II\AI Direct Link\AsCmd.exe" [2010-05-19 383104]
    "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
    "ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-05 311296]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-26 98304]
    "ZoneAlarm Client"="c:\program files (x86)\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]
    "LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-15 1955208]
    .
    c:\users\james\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Xfire.lnk - c:\program files (x86)\Xfire\Xfire.exe [2011-8-26 3510680]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    R2 .EsetTrialReset;Eset Trial Reset;c:\windows\reset.exe [x]
    R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
    R3 ALSysIO;ALSysIO;c:\users\james\AppData\Local\Temp\ALSysIO64.sys [x]
    R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
    R3 DKRtWrt;DKRtWrt;c:\windows\system32\DRIVERS\DKRtWrt.sys [x]
    R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
    R3 rt61x64;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr6164.sys [x]
    R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
    R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
    R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [x]
    R4 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2010-03-05 235752]
    R4 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-09-06 247096]
    R4 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
    R4 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
    S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-12-28 96896]
    S2 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
    S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-09-29 735960]
    S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
    S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 2329480]
    S2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2011-02-15 33528]
    S2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2011-02-15 822264]
    S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2010-11-15 5716848]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
    S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
    S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
    S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
    S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
    nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94a08c5f-36e9-11e0-bb39-bcaec5abace6}]
    \shell\AutoRun\command - G:\steambackup2.EXE
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2009-06-17 17:11 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4079991190-3454297349-2113980778-1000Core.job
    - c:\users\james\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-13 00:21]
    .
    2011-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4079991190-3454297349-2113980778-1000UA.job
    - c:\users\james\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-13 00:21]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}]
    2010-07-28 23:05 397312 ----a-w- c:\program files (x86)\DAP\DAPIELoader64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-06 11057768]
    "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-02-12 2715704]
    "Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2010-06-14 190536]
    "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-11-11 2345848]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632]
    "ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-02-15 1123320]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: &Clean Traces - c:\program files (x86)\DAP\Privacy Package\dapcleanerie.htm
    IE: &Download with &DAP - c:\program files (x86)\DAP\dapextie.htm
    IE: Download &all with DAP - c:\program files (x86)\DAP\dapextie2.htm
    IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe
    Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~2\DAP\dapie.dll
    Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~2\DAP\dapie.dll
    FF - ProfilePath - c:\users\james\AppData\Roaming\Mozilla\Firefox\Profiles\zooo9ewn.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=
    FF - prefs.js: network.proxy.type - 0
    .
    - - - - ORPHANS REMOVED - - - -
    .
    WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    @Allowed: (Read) (RestrictedCode)
    "?慴"=hex:5a,5c,e0,73,03,fa,20,59,39,6d,90,d6,fc,b1,d0,e2,af,cd,26,8d,57,9a,28,
    3b,ba,9c,6f,b2,59,a6,d3,5e,59,d4,13,10,77,c8,f7,74,c1,a3,00,53,8a,37,ad,fc,\
    "?祥"=hex:87,c0,85,e9,02,32,ff,29,8d,ab,f8,27,4f,7c,07,e3
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000\Software\SecuROM\License information*]
    "datasecu"=hex:72,10,5a,a2,5d,c3,b5,6e,7e,1e,e9,35,7e,77,7e,9a,40,3d,ee,85,4f,
    59,78,40,56,dd,e7,6f,4a,b7,fc,fa,65,62,43,f6,76,26,e9,d3,5c,94,f6,c1,2c,d0,\
    "rkeysecu"=hex:b9,db,97,70,69,de,91,b5,43,94,df,b5,c3,db,fb,d6
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000_Classes\T*A*C*T*I*C*S*ム0テ0ア0・ク0\CLSID]
    @="{B2FD448E-6846-438E-9450-8E2F5EEC1BD1}"
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000_Classes\T*A*C*T*I*C*S*ム0テ0ア0・ク0\DefaultIcon]
    @=expand:"%APPDATA%\\Microsoft\\Installer\\{688FBB5D-C462-488C-B07E-B3CA8D3B4C1D}\\_61526c10.exe,0"
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000_Classes\T*A*C*T*I*C*S*ム0テ0ア0・ク0\shell]
    @="open"
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000_Classes\T*A*C*T*I*C*S*ム0テ0ア0・ク0\shell\open]
    @="開く(&O)"
    .
    [HKEY_USERS\S-1-5-21-4079991190-3454297349-2113980778-1000_Classes\T*A*C*T*I*C*S*ム0テ0ア0・ク0\shell\open\command]
    @="\"c:\\Program Files (x86)\\タクティクスチャレンジ!\\TC3Boot.exe\" \"%1\""
    "command"=multi:"5kR[IzQ}B?&XX0jZWHK,>FIUjHUBZ9?vmhl5hhE}R \"%1\"\00\00"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info]
    @Denied: (2) (LocalSystem)
    "AppDataDir"="c:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\"
    "DataDir"="ESET\\ESET NOD32 Antivirus\\"
    "EditionName"=" "
    "InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\"
    "LanguageId"=dword:00000409
    "PackageTag"=dword:00000000
    "ProductBase"=dword:00000000
    "ProductCode"="{4183655A-5FC6-4A23-A804-7764145EC57C}"
    "ProductName"="ESET NOD32 Antivirus"
    "ProductType"="eav"
    "ProductVersion"="4.0.468.0"
    "UniqueId"="0185B5614D56D958"
    "ScannerBuild"=dword:00002210
    "ScannerVersionId"=dword:000016ec
    "ScannerVersion"="Open window for status."
    "FixId"=dword:00000009
    "ei2"=hex(b):ed,68,27,30,a8,1f,0b,2b
    "ei1"=hex(b):bc,ae,c5,ab,ac,e6,00,00
    "ei3"=hex(b):16,e7,56,4d,00,00,00,00
    "ei4"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
    c:\program files (x86)\ASUS\AI Suite II\GPU Boost\GpuBoostServer.exe
    c:\program files (x86)\ASUS\AI Suite II\AsRoutineController.exe
    c:\program files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe
    c:\program files (x86)\ASUS\AI Suite II\TurboV EVO\TurboUnlocker\TurboInfo.exe
    c:\program files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
    c:\windows\SysWOW64\PnkBstrA.exe
    c:\program files (x86)\ASUS\AI Suite II\AI Suite II.exe
    c:\progra~2\ASUS\AISUIT~1\Sensor\HMSERV~1\aaHM.exe
    .
    **************************************************************************
    .
    Completion time: 2011-09-12 19:04:39 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-09-12 23:04
    ComboFix2.txt 2011-09-10 23:07
    .
    Pre-Run: 227,438,182,400 bytes free
    Post-Run: 227,149,172,736 bytes free
    .
    - - End Of File - - 9B781F639C6C83DA472F2BB7F0CE8BA9
     
  10. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Is it with IE open, or closed?
     
  11. megaman8x

    megaman8x TS Rookie Topic Starter

    its closed
     
  12. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Post new aswMBR log.
     
  13. megaman8x

    megaman8x TS Rookie Topic Starter

    heres the new log:

    aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
    Run date: 2011-09-20 10:59:11
    -----------------------------
    10:59:11.556 OS Version: Windows x64 6.1.7601 Service Pack 1
    10:59:11.556 Number of processors: 2 586 0x403
    10:59:11.557 ComputerName: ALBATROSS UserName: james
    10:59:15.387 Initialize success
    11:01:01.165 AVAST engine defs: 11092000
    11:01:38.503 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
    11:01:38.504 Disk 0 Vendor: WDC_WD1002FAEX-00Y9A0 05.01D05 Size: 953869MB BusType: 3
    11:01:40.514 Disk 0 MBR read successfully
    11:01:40.516 Disk 0 MBR scan
    11:01:40.520 Disk 0 MBR:Alureon-I [Rtk]
    11:01:40.525 Disk 0 TDL4@MBR code has been found
    11:01:40.527 Disk 0 Windows 7 default MBR code found via API
    11:01:40.529 Disk 0 MBR hidden
    11:01:40.531 Disk 0 MBR [TDL4] **ROOTKIT**
    11:01:40.533 Disk 0 trace - called modules:
    11:01:40.537 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa8004916254]<<
    11:01:40.924 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80048ed5e0]
    11:01:40.929 3 CLASSPNP.SYS[fffff8800161743f] -> nt!IofCallDriver -> [0xfffffa8003ac6520]
    11:01:40.932 5 ACPI.sys[fffff88000f997a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8003acf060]
    11:01:40.935 \Driver\atapi[0xfffffa8003ab3730] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xfffffa8004916254
    11:01:42.861 AVAST engine scan C:\Windows
    11:01:47.272 AVAST engine scan C:\Windows\system32
    11:03:19.857 AVAST engine scan C:\Windows\system32\drivers
    11:03:31.824 AVAST engine scan C:\Users\james
    11:16:47.627 AVAST engine scan C:\ProgramData
    11:18:04.033 Scan finished successfully
    11:19:09.474 Disk 0 MBR has been saved successfully to "C:\MBR.dat"
    11:19:09.478 The log file has been saved successfully to "C:\aswMBRzz.txt"
     
  14. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Please Boot to the System Recovery Options
    If you have Windows 7 installation disc, just insert a DVD to the drive, restart computer and it should load automatically (option two presented in the article).
    It's possible also that your computer has a pre-installed recovery partition instead - in such a case use a method one (by pressing F8 before Windows starts loading)...

    On the System Recovery Options menu you will get the following options:

    • Startup Repair
    • System Restore
    • Windows Complete PC Restore
    • Windows Memory Diagnostic Tool
    • Command Prompt

    Choose Command Prompt
    You should see X:\SOURCES>...

    Execute the following commands in bold.
    Press Enter after every one of them.

    bootrec /fixmbr (<--- there is a "space" after "bootrec")

    exit


    Post new aswMBR log.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...