TechSpot

Really annoying Sirefef virus

Solved
By Don37
Sep 11, 2012
Topic Status:
Not open for further replies.
  1. Hi, I have been infected by the virus sirefef. Music starts randomly and stops, really creepy and annoying.

    I have tried to follow as much as possible the forum guidelines.
    If I have forgotten something or done something wrong, sorry in advance and let me know.

    You expert guys who help us removing our viruses are truly good guys, thanks in advance for the help you give for free.


    MALWAREBYTES LOG

    Malwarebytes Anti-Malware 1.62.0.1300
    www.malwarebytes.org

    Database version: v2012.09.06.04

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 9.0.8112.16421
    Don :: DON-MSI [administrator]

    11/09/2012 13:28:16
    mbam-log-2012-09-11 (17-22-12).txt

    Scan type: Full scan (C:\|D:\|)
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 442001
    Time elapsed: 1 hour(s), 6 minute(s), 21 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 4
    C:\Program Files (x86)\Fortix 2\TDU500.exe (Packer.ModifiedUPX) -> No action taken.
    C:\Users\Don\AppData\Local\{5602a9de-1529-407a-030d-e41718b23532}\n (Trojan.Sirefef) -> No action taken.
    C:\Windows\Installer\{5602a9de-1529-407a-030d-e41718b23532}\U\80000000.@ (Rootkit.0Access.64) -> No action taken.
    D:\Install\fortix2\NFOviewer.exe (Malware.Packer.Krunchy) -> No action taken.

    (end)



    GMER LOG



    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit scan 2012-09-11 19:05:20
    Windows 6.1.7601 Service Pack 1
    Running: 923qgugv.exe


    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002421d23aa3
    Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002421d23aa3 (not active ControlSet)
    Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\Don\Desktop\Victorian Mysteries \x2013 Woman in White\Victorian Mysteries - Woman in White.exe 1

    ---- EOF - GMER 1.0.15 ----



    DDS LOG

    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_35
    Run by Don at 19:10:18 on 2012-09-11
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.353.1033.18.3886.2026 [GMT 2:00]
    .
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\windows\system32\wininit.exe
    C:\windows\system32\lsm.exe
    C:\windows\system32\svchost.exe -k DcomLaunch
    C:\windows\system32\svchost.exe -k RPCSS
    C:\windows\system32\atiesrxx.exe
    C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\windows\system32\svchost.exe -k netsvcs
    C:\windows\system32\svchost.exe -k LocalService
    C:\windows\system32\svchost.exe -k NetworkService
    C:\windows\system32\WLANExt.exe
    C:\windows\system32\conhost.exe
    C:\windows\System32\spoolsv.exe
    C:\Program Files\LSI SoftModem\agr64svc.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\windows\System32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Program Files (x86)\System Control Manager\MSIService.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    C:\windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Motorola\Bluetooth\obexsrv.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
    C:\windows\system32\atieclxx.exe
    C:\windows\system32\Dwm.exe
    C:\windows\system32\wbem\unsecapp.exe
    C:\windows\system32\taskhost.exe
    C:\windows\system32\wbem\wmiprvse.exe
    C:\windows\Explorer.EXE
    C:\Windows\System32\igfxpers.exe
    C:\Windows\System32\rundll32.exe
    C:\windows\system32\igfxsrvc.exe
    C:\Program Files\FSP\FspUip.exe
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
    C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
    C:\Program Files\SteelSeries Engine\SteelSeriesEngine.exe
    C:\Program Files\Motorola\Bluetooth\audiosrv.exe
    C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    C:\Program Files (x86)\VirtualCloneDrive\VCDDaemon.exe
    C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
    C:\windows\system32\conhost.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\windows\system32\wbem\unsecapp.exe
    C:\windows\system32\SearchIndexer.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\windows\system32\NOTEPAD.EXE
    C:\windows\system32\SearchProtocolHost.exe
    C:\windows\system32\SearchFilterHost.exe
    C:\windows\system32\taskhost.exe
    C:\windows\system32\DllHost.exe
    C:\windows\system32\DllHost.exe
    C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\conhost.exe
    C:\windows\SysWOW64\cscript.exe
    C:\windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = https://mail.google.com/mail/?shva=1#inbox
    uDefault_Page_URL = hxxp://msi.msn.com
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: H - No File
    mWinlogon: Userinit=userinit.exe,
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
    BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
    uRun: [Google Update] "C:\Users\Don\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    uRun: [Netvue] C:\Program Files (x86)\Netvue\Netvue.exe
    uRun: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe
    uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
    uRun: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
    uRun: [SteelSeries Engine] C:\Program Files\SteelSeries Engine\SteelSeriesEngine.exe
    uRun: [AdobeBridge]
    mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [MGSysCtrl] C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
    mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun: [VirtualCloneDrive] "C:\Program Files (x86)\VirtualCloneDrive\VCDDaemon.exe" /s
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    StartupFolder: C:\Users\Don\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\NETVUE~1.LNK - C:\Program Files (x86)\Netvue\Netvue.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
    IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
    Trusted Zone: msi.com
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
    DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
    DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    TCP: DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{54716EBA-429D-433D-A7BB-F005439613D5} : DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{54716EBA-429D-433D-A7BB-F005439613D5}\2454C4C4532373 : DhcpNameServer = 192.168.2.1
    TCP: Interfaces\{54716EBA-429D-433D-A7BB-F005439613D5}\3584F47455E4 : DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{54716EBA-429D-433D-A7BB-F005439613D5}\64259445A51224F6870264F6E60275C414E40273131333 : DhcpNameServer = 192.168.178.1
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
    BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
    BHO-X64: URLRedirectionBHO - No File
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
    mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun-x64: [MGSysCtrl] C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
    mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun-x64: [VirtualCloneDrive] "C:\Program Files (x86)\VirtualCloneDrive\VCDDaemon.exe" /s
    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun-x64: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    mRun-x64: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\oo7zp5fc.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig
    FF - prefs.js: network.proxy.ftp - 194.254.103.248
    FF - prefs.js: network.proxy.ftp_port - 3128
    FF - prefs.js: network.proxy.http_port - 3128
    FF - prefs.js: network.proxy.socks - 194.254.103.248
    FF - prefs.js: network.proxy.socks_port - 3128
    FF - prefs.js: network.proxy.ssl - 194.254.103.248
    FF - prefs.js: network.proxy.ssl_port - 3128
    FF - prefs.js: network.proxy.type - 4
    FF - component: C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\oo7zp5fc.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\WINNT_x86-msvc\components\pagespeed.dll
    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\Veetle\Player\npvlc.dll
    FF - plugin: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: C:\Program Files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
    FF - plugin: C:\Program Files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
    FF - plugin: C:\Program Files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
    FF - plugin: C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
    FF - plugin: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
    FF - plugin: C:\Program Files\ma-config.com\nphardwaredetection.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin2.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin3.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin4.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin5.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin6.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin7.dll
    FF - plugin: C:\Users\Don\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll
    FF - plugin: C:\Users\Don\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
    FF - plugin: C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\oo7zp5fc.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dll
    FF - plugin: C:\Users\Don\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
    FF - plugin: C:\Users\Don\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
    FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll
    FF - plugin: C:\windows\SysWOW64\npdeployJava1.dll
    FF - plugin: C:\windows\SysWOW64\npmproxy.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\windows\system32\DRIVERS\dtsoftbus01.sys --> C:\windows\system32\DRIVERS\dtsoftbus01.sys [?]
    R1 pfmfs_359;pfmfs_359;C:\windows\system32\Drivers\pfmfs_359.sys --> C:\windows\system32\Drivers\pfmfs_359.sys [?]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]
    R2 acedrv11;acedrv11;\??\C:\windows\system32\drivers\acedrv11.sys --> C:\windows\system32\drivers\acedrv11.sys [?]
    R2 AMD External Events Utility;AMD External Events Utility;C:\windows\system32\atiesrxx.exe --> C:\windows\system32\atiesrxx.exe [?]
    R2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files\Motorola\Bluetooth\obexsrv.exe [2010-3-16 637192]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-10-27 13336]
    R2 Micro Star SCM;Micro Star SCM;C:\Program Files (x86)\System Control Manager\MSIService.exe [2010-3-16 160768]
    R2 TurboB;Turbo Boost UI Monitor driver;C:\windows\system32\DRIVERS\TurboB.sys --> C:\windows\system32\DRIVERS\TurboB.sys [?]
    R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-3-16 2320920]
    R3 amdkmdag;amdkmdag;C:\windows\system32\DRIVERS\atipmdag.sys --> C:\windows\system32\DRIVERS\atipmdag.sys [?]
    R3 amdkmdap;amdkmdap;C:\windows\system32\DRIVERS\atikmpag.sys --> C:\windows\system32\DRIVERS\atikmpag.sys [?]
    R3 Bluetooth Device Manager;Bluetooth Device Manager;C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe [2010-3-16 4154120]
    R3 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files\Motorola\Bluetooth\audiosrv.exe [2010-3-16 1029896]
    R3 busenum;SteelBusSvc;C:\windows\system32\DRIVERS\SteelBus64.sys --> C:\windows\system32\DRIVERS\SteelBus64.sys [?]
    R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-3-16 1028096]
    R3 fspad_wlh64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_wlh64;C:\windows\system32\DRIVERS\fspad_wlh64.sys --> C:\windows\system32\DRIVERS\fspad_wlh64.sys [?]
    R3 HECIx64;Intel(R) Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]
    R3 Impcd;Impcd;C:\windows\system32\DRIVERS\Impcd.sys --> C:\windows\system32\DRIVERS\Impcd.sys [?]
    R3 IntcDAud;Intel(R) Display Audio;C:\windows\system32\DRIVERS\IntcDAud.sys --> C:\windows\system32\DRIVERS\IntcDAud.sys [?]
    R3 intelkmd;intelkmd;C:\windows\system32\DRIVERS\igdpmd64.sys --> C:\windows\system32\DRIVERS\igdpmd64.sys [?]
    R3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\windows\system32\DRIVERS\NETwNs64.sys --> C:\windows\system32\DRIVERS\NETwNs64.sys [?]
    R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-15 158856]
    S3 BTMCOM;Bluetooth Serial Port;C:\windows\system32\Drivers\btmcom.sys --> C:\windows\system32\Drivers\btmcom.sys [?]
    S3 BTMHID;BTMHID;C:\windows\system32\DRIVERS\btmhid.sys --> C:\windows\system32\DRIVERS\btmhid.sys [?]
    S3 BTMUSB;Motorola Bluetooth Radio Service;C:\windows\system32\Drivers\btmusb.sys --> C:\windows\system32\Drivers\btmusb.sys [?]
    S3 driverhardwarev2x64;driverhardwarev2x64;C:\Program Files\ma-config.com\Drivers\driverhardwarev2x64.sys [2010-8-30 15872]
    S3 enecir;ENE CIR Receiver;C:\windows\system32\DRIVERS\enecir.sys --> C:\windows\system32\DRIVERS\enecir.sys [?]
    S3 enecirhid;ENE CIR HID Receiver;C:\windows\system32\DRIVERS\enecirhid.sys --> C:\windows\system32\DRIVERS\enecirhid.sys [?]
    S3 enecirhidma;ENE CIR HIDmini Filter;C:\windows\system32\DRIVERS\enecirhidma.sys --> C:\windows\system32\DRIVERS\enecirhidma.sys [?]
    S3 fspad_xp64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_xp64;C:\windows\system32\DRIVERS\fspad_xp64.sys --> C:\windows\system32\DRIVERS\fspad_xp64.sys [?]
    S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\x64\maconfservice.exe [2011-5-1 420864]
    S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-26 114144]
    S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-11-2 340240]
    S3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\windows\system32\DRIVERS\NETw5s64.sys --> C:\windows\system32\DRIVERS\NETw5s64.sys [?]
    S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]
    S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
    S3 pbfilter;pbfilter;C:\Program Files\PeerBlock\pbfilter.sys [2011-7-1 24176]
    S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-3-16 225280]
    S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
    S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]
    S3 TurboBoost;TurboBoost;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2009-8-6 118672]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\system32\Drivers\usbaapl64.sys --> C:\windows\system32\Drivers\usbaapl64.sys [?]
    S3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\windows\system32\DRIVERS\vwifimp.sys --> C:\windows\system32\DRIVERS\vwifimp.sys [?]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]
    .
    =============== Created Last 30 ================
    .
    2012-09-11 10:27:32 73696 ----a-w- C:\Program Files (x86)\Mozilla Firefox\breakpadinjector.dll
    2012-08-20 13:01:41 -------- d-----w- C:\Users\Don\AppData\Local\SteelSeries_ApS
    2012-08-20 12:58:40 -------- d-----w- C:\Users\Don\AppData\Roaming\SteelSeries
    2012-08-20 12:58:28 -------- d-----w- C:\ProgramData\SteelSeries
    2012-08-20 12:57:48 -------- d-----w- C:\Program Files\SteelSeries Engine
    2012-08-14 16:37:57 1002728 ----a-w- C:\windows\System32\WinUSBCoInstaller2.dll
    2012-08-14 16:37:56 1721576 ----a-w- C:\windows\System32\WdfCoInstaller01009.dll
    2012-08-14 15:49:07 -------- d-----w- C:\Users\Don\android-sdks
    2012-08-14 15:48:00 -------- d-----w- C:\Users\Don\.android
    2012-08-14 15:32:20 -------- d-----w- C:\Eclipse
    2012-08-14 15:30:34 -------- d-----w- C:\Program Files (x86)\Eclipse installed
    2012-08-14 15:04:22 -------- d-----r- C:\Dropbox
    2012-08-14 14:58:04 -------- d-----w- C:\Users\Don\AppData\Roaming\Dropbox
    .
    ==================== Find3M ====================
    .
    2012-08-28 18:24:56 477168 ----a-w- C:\windows\SysWow64\npdeployJava1.dll
    2012-08-28 18:24:53 473072 ----a-w- C:\windows\SysWow64\deployJava1.dll
    2012-08-23 18:11:58 73416 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-08-23 18:11:58 696520 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe
    2012-08-09 08:03:52 9728 ---h--w- C:\Users\Don\AppData\Roaming\desktop.ini
    2012-07-03 11:46:44 24904 ----a-w- C:\windows\System32\drivers\mbam.sys
    .
    ============= FINISH: 19:10:38.73 ===============






    ATTACH LOG


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 19/10/2010 01:43:58
    System Uptime: 11/09/2012 18:16:30 (1 hours ago)
    .
    Motherboard: Micro-Star International | | GE-700
    Processor: Intel(R) Core(TM) i3 CPU M 330 @ 2.13GHz | CPU 1 | 2133/533mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 173 GiB total, 31.871 GiB free.
    D: is FIXED (NTFS) - 113 GiB total, 7.436 GiB free.
    E: is CDROM ()
    F: is CDROM ()
    G: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP256: 11/09/2012 17:24:54 - mardi 11 sept
    RP257: 11/09/2012 17:36:32 - Restore Operation
    .
    ==== Installed Programs ======================
    .
    Acrobat.com
    Adobe AIR
    Adobe Community Help
    Adobe Flash Player 11 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Photoshop CS5.1
    Adobe Reader 9.5.2
    AnyBizSoft PDF to Text (Build 1.0.1)
    AnyBizSoft PDF to Word (Build 3.0.0)
    Apple Application Support
    Apple Software Update
    µTorrent
    BurnRecovery
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    ccc-core-static
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    DAEMON Tools Lite
    dBpoweramp Music Converter
    Diablo II
    Diablo III
    Dropbox
    Echoes of the Past The Castle of Shadows Collectors Edition 1.00
    FastStone Image Viewer 4.2
    FileZilla Client 3.5.3
    Google Chrome
    Google Talk Plugin
    Hero Editor V0.96
    Impulse
    Intel(R) Management Engine Components
    Intel(R) Rapid Storage Technology
    Intel(R) Turbo Boost Technology Driver
    Java Auto Updater
    Java(TM) 6 Update 35
    jZip
    King's Bounty - Armored Princess
    King's Bounty - Crossworlds
    Malwarebytes Anti-Malware version 1.62.0.1300
    Microsoft Choice Guard
    Microsoft Office Suite Activation Assistant
    Microsoft Sync Framework Runtime Native v1.0 (x86)
    Microsoft Sync Framework Services Native v1.0 (x86)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
    Microsoft XNA Framework Redistributable 3.1
    Microsoft_VC80_ATL_x86
    Microsoft_VC80_CRT_x86
    Microsoft_VC80_MFC_x86
    Microsoft_VC80_MFCLOC_x86
    Microsoft_VC90_ATL_x86
    Microsoft_VC90_CRT_x86
    Microsoft_VC90_MFC_x86
    Microsoft_VC90_MFCLOC_x86
    Mozilla Firefox 15.0.1 (x86 en-US)
    Mozilla Maintenance Service
    msi Software Install
    MSVCRT
    Mystery Case Files - Dire Grove Collector's Edition
    Netvue
    Notepad++
    OpenOffice.org 3.2
    PDF Settings CS5
    ProtectDisc Driver, Version 11
    PX Profile Update
    QuickTime
    Realtek Ethernet Controller Driver
    Realtek HDMI Audio Driver for ATI
    Realtek High Definition Audio Driver
    Realtek USB 2.0 Card Reader
    Security Task Manager 1.8d
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
    Skype™ 5.8
    System Control Manager
    Timeless - The Forgotten Town Collector's Edition
    Ubisoft Game Launcher
    Unity Web Player
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
    Veetle TV 0.9.18
    VirtualCloneDrive
    VLC media player 1.1.8
    Winamp
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Photo Gallery
    WinRAR archiver
    .
    ==== Event Viewer Messages From Past Week ========
    .
    11/09/2012 19:09:45, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147024891
    11/09/2012 19:09:45, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: %%-2147024891
    11/09/2012 18:16:46, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
    11/09/2012 18:16:46, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
    11/09/2012 18:16:45, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
    11/09/2012 18:08:55, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    11/09/2012 18:08:17, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service Bluetooth Device Manager with arguments "" in order to run the server: {3428CA47-50B8-48C2-8839-48D3C4C59B23}
    11/09/2012 18:07:59, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service SkypeUpdate with arguments "/ComService" in order to run the server: {CC957078-B838-47C4-A7CF-626E7A82FC58}
    11/09/2012 17:46:12, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
    11/09/2012 17:46:12, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
    11/09/2012 17:46:03, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    11/09/2012 17:46:02, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    11/09/2012 17:45:59, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\windows\System32\IWMSSvc.dll Error Code: 21
    11/09/2012 17:45:54, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    11/09/2012 17:45:48, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    11/09/2012 17:45:42, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache ElbyCDIO spldr Wanarpv6
    11/09/2012 17:45:40, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    11/09/2012 17:36:19, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004
    11/09/2012 12:08:10, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
    .
    ==== End Of File ===========================

    THANKS!
  2. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Hello, and welcome to TechSpot.


    [​IMG] Please see here for the board rules and other FAQ.

    Please feel free to introduce yourself, after you follow the steps below to get started.

    Information
    • From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by a malware removal helper.
    • Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
    • If you have already asked for help somewhere, please post the link to the topic you were helped.
    • We try our best to reply quickly, but for any reason we do not reply in two days, please reply to this topic with the word BUMP!
    • Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

    Download Farbar Recovery Scan Tool and save it to a flash drive.

    Please make sure to download the 64-bit version.

    Plug the flashdrive into the infected PC.

    Enter System Recovery Options.

    To enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Choose your language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.
    To enter System Recovery Options by using Windows installation disc:
    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Choose your language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.
    On the System Recovery Options menu you will get the following options:
      • Startup Repair
        System Restore
        Windows Complete PC Restore
        Windows Memory Diagnostic Tool
        Command Prompt
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst64 and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to the disclaimer.
    • Place a check next to List Drivers MD5 as well as the default check marks that are already there (if necessary)
    • Press Scan button. It will do its scan and save a log on your flash drive.
    • Close out of the message after that, then type in the text services.exe in to the "Search:" text box. Then, press the Search file(s) button, just as below:
      [​IMG]
      When done searching, FRST makes a log, Search.txt, on the C:\ drive or on your flash drive.
    • Type exit in the Command Prompt window and reboot the computer normally
    • FRST will make a log (FRST.txt) on the flash drive and also the search.txt logfile, please copy and paste the logs in your reply.
  3. Don37

    Don37 TS Rookie Topic Starter

    Hi DMJ

    Thanks for taking time to answer and help, really appreciate it.
    I can confirm OI have posted my problem only on this forum.

    Here are the 2 logs as you asked:

    FRST.TXT

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-09-2012 01
    Ran by SYSTEM at 11-09-2012 23:33:12
    Running from H:\
    Windows 7 Home Premium (X64) OS Language: English(US)
    The current controlset is ControlSet001

    ==================== Registry (Whitelisted) ===================

    HKLM\...\Run: [BTMTrayAgent] rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp [20433160 2010-02-12] (Motorola, Inc.)
    HKLM\...\Run: [fspuip] %ProgramFiles%\FSP\fspuip.exe [3768832 2010-02-08] (Sentelic Corporation)
    HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [112512 2010-01-21] (Microsoft Corporation)
    HKLM\...\Run: [AutoKMS] C:\windows\AutoKMS.exe [615936 2011-01-30] ()
    HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11775592 2011-01-18] (Realtek Semiconductor)
    HKLM\...\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray [1933584 2010-11-02] (Intel(R) Corporation)
    HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [499608 2011-03-15] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-12-17] (Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [MGSysCtrl] C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2396160 2010-01-08] (Micro-Star International Co., Ltd.)
    HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
    HKLM-x32\...\Run: [VirtualCloneDrive] "C:\Program Files (x86)\VirtualCloneDrive\VCDDaemon.exe" /s [89456 2011-03-07] (Elaborate Bytes AG)
    HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.)
    HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [38872 2012-07-31] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [919008 2012-07-11] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.)
    HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2012-03-27] (Apple Inc.)
    HKLM-x32\...\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin [1523360 2011-01-12] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
    HKU\Don\...\Run: [Google Update] "C:\Users\Don\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2010-10-27] (Google Inc.)
    HKU\Don\...\Run: [Netvue] C:\Program Files (x86)\Netvue\Netvue.exe [528384 2006-12-13] (Codeheadz)
    HKU\Don\...\Run: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe [2646128 2010-11-06] (PeerBlock, LLC)
    HKU\Don\...\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [1305408 2011-01-20] (DT Soft Ltd)
    HKU\Don\...\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe [59240 2012-02-23] (Apple Inc.)
    HKU\Don\...\Run: [SteelSeries Engine] C:\Program Files\SteelSeries Engine\SteelSeriesEngine.exe [236032 2012-08-06] (SteelSeries ApS)
    HKU\Don\...\Run: [AdobeBridge] [x]
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Startup: C:\Users\Don\Start Menu\Programs\Startup\Netvue.exe - Shortcut.lnk
    ShortcutTarget: Netvue.exe - Shortcut.lnk -> C:\Program Files (x86)\Netvue\Netvue.exe (Codeheadz)

    ==================== Services ====================

    3 Bluetooth Device Manager; "C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe" [4154120 2010-01-25] (Motorola, Inc.)
    3 Bluetooth Media Service; "C:\Program Files\Motorola\Bluetooth\audiosrv.exe" [1029896 2010-01-25] (Motorola, Inc.)
    2 Bluetooth OBEX Service; "C:\Program Files\Motorola\Bluetooth\obexsrv.exe" [637192 2009-12-21] (Motorola, Inc.)
    3 maconfservice; "C:\Program Files\ma-config.com\x64\maconfservice.exe" [420864 2011-05-01] (CybelSoft)
    2 Micro Star SCM; C:\Program Files (x86)\System Control Manager\MSIService.exe [160768 2009-07-09] (Micro-Star International Co., Ltd.)
    3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-11-02] ()
    3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [x]

    ==================== Drivers =================================

    2 acedrv11; C:\Windows\System32\Drivers\acedrv11.sys [191616 2010-02-24] (Protect Software GmbH)
    3 BTMHID; C:\Windows\System32\Drivers\BTMHID.sys [34048 2010-01-13] (Motorola, Inc.)
    3 busenum; C:\Windows\System32\DRIVERS\SteelBus64.sys [112128 2012-05-22] (SteelSeries Corporation)
    3 driverhardwarev2x64; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2x64.sys [15872 2010-08-30] (CybelSoft)
    1 dtsoftbus01; C:\Windows\System32\Drivers\dtsoftbus01.sys [254528 2011-07-23] (DT Soft Ltd)
    3 fspad_wlh64; C:\Windows\System32\Drivers\fspad_wlh64.sys [53248 2010-02-08] (Sentelic Corporation)
    3 fspad_xp64; C:\Windows\System32\Drivers\fspad_xp64.sys [53248 2010-02-08] (Sentelic Corporation)
    3 pbfilter; \??\C:\Program Files\PeerBlock\pbfilter.sys [24176 2010-11-06] ()
    1 pfmfs_359; C:\Windows\System32\Drivers\pfmfs_359.sys [241880 2009-10-14] (Pismo Technic Inc.)
    2 TurboB; C:\Windows\System32\Drivers\TurboB.sys [13784 2009-08-06] ()
    3 smserial; C:\Windows\System32\DRIVERS\smserial.sys [x]

    ==================== NetSvcs (Whitelisted) =================


    ==================== One Month Created Files and Folders ======================

    2012-09-11 23:32 - 2012-09-11 23:33 - 00000000 ____D C:\FRST
    2012-09-11 13:21 - 2012-09-11 13:21 - 00086365 ____A C:\Users\Don\Desktop\[Active] - Really annoying Sirefef virus - TechSpot Forums.htm
    2012-09-11 13:21 - 2012-09-11 13:21 - 00000000 ____D C:\Users\Don\Desktop\[Active] - Really annoying Sirefef virus - TechSpot Forums_files
    2012-09-11 13:16 - 2012-09-11 13:16 - 01453499 ____A (Farbar) C:\Users\Don\Desktop\FRST64.exe
    2012-09-11 09:12 - 2012-09-11 09:12 - 00009259 ____A C:\Users\Don\Desktop\Attach.txt
    2012-09-11 09:11 - 2012-09-11 09:11 - 00020878 ____A C:\Users\Don\Desktop\DDS.txt
    2012-09-11 09:09 - 2012-09-11 09:09 - 00607260 ____R (Swearware) C:\Users\Don\Desktop\dds.com
    2012-09-11 08:54 - 2012-09-11 08:55 - 00000109 ____A C:\Users\Don\Desktop\path to temp ie files.txt
    2012-09-11 08:28 - 2012-09-11 09:16 - 00001110 ____A C:\Users\Don\Desktop\gmer.log
    2012-09-11 08:27 - 2012-09-11 08:27 - 00000000 ____D C:\Users\Don\Desktop\UPDATED 5-step Viruses_Spyware_Malware Preliminary Removal Instructions - TechSpot Forums_files
    2012-09-11 08:26 - 2012-09-11 08:27 - 00065588 ____A C:\Users\Don\Desktop\UPDATED 5-step Viruses_Spyware_Malware Preliminary Removal Instructions - TechSpot Forums.htm
    2012-09-11 08:25 - 2012-09-11 08:25 - 00302592 ____A C:\Users\Don\Desktop\923qgugv.exe
    2012-09-11 06:39 - 2012-09-11 06:39 - 00016048 ____A C:\Users\Don\Downloads\Android_XML.zip
    2012-09-11 06:35 - 2012-09-11 06:35 - 00016260 ____A C:\Users\Don\Downloads\Android_Fundamentals.zip
    2012-09-09 04:35 - 2012-09-09 04:35 - 01957789 ____A C:\Users\Don\Desktop\glyphish-icons.psd
    2012-09-07 01:15 - 2012-08-28 10:10 - 00157680 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe
    2012-09-07 01:15 - 2012-08-28 10:10 - 00149488 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe
    2012-09-07 01:15 - 2012-08-28 10:09 - 00149488 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe
    2012-09-07 01:14 - 2012-09-07 01:15 - 00002948 ____A C:\Windows\SysWOW64\jupdate-1.6.0_35-b10.log
    2012-08-25 00:06 - 2012-09-10 04:22 - 00000000 ____D C:\Users\Don\Desktop\Messages d'amour
    2012-08-23 04:48 - 2012-08-23 04:48 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
    2012-08-20 05:01 - 2012-08-20 05:01 - 00000000 ____D C:\Users\Don\AppData\Local\SteelSeries_ApS
    2012-08-20 04:58 - 2012-08-20 04:58 - 00000000 ____D C:\Users\Don\AppData\Roaming\SteelSeries
    2012-08-20 04:58 - 2012-08-20 04:58 - 00000000 ____D C:\Users\All Users\SteelSeries
    2012-08-20 04:57 - 2012-08-20 04:58 - 00000000 ____D C:\Program Files\SteelSeries Engine
    2012-08-20 04:03 - 2012-08-20 04:03 - 00122119 ____A C:\Users\Don\Desktop\fdghdgf.xps
    2012-08-15 03:09 - 2012-08-15 03:09 - 00000983 ____A C:\Users\Don\Desktop\Eclipse.lnk
    2012-08-14 08:37 - 2012-08-14 08:37 - 01721576 ____A (Microsoft Corporation) C:\Windows\System32\WdfCoInstaller01009.dll
    2012-08-14 08:37 - 2012-08-14 08:37 - 01002728 ____A (Microsoft Corporation) C:\Windows\System32\WinUSBCoInstaller2.dll
    2012-08-14 07:49 - 2012-09-11 04:42 - 00000000 ____D C:\Users\Don\android-sdks
    2012-08-14 07:48 - 2012-08-23 02:14 - 00000000 ____D C:\Users\Don\.android
    2012-08-14 07:32 - 2012-08-23 01:19 - 00000000 ____D C:\Eclipse
    2012-08-14 07:30 - 2012-09-11 04:49 - 00000000 ____D C:\Program Files (x86)\Eclipse installed
    2012-08-14 07:04 - 2012-09-08 00:33 - 00000000 ___RD C:\Dropbox
    2012-08-14 07:04 - 2012-08-14 07:04 - 00001048 ____A C:\Users\Don\Desktop\Dropbox.lnk
    2012-08-14 06:58 - 2012-09-08 03:12 - 00000000 ____D C:\Users\Don\AppData\Roaming\Dropbox
    2012-08-12 08:42 - 2012-08-12 08:42 - 00000000 ____D C:\Users\Don\AppData\Roaming\Garmin

    ==================== 3 Months Modified Files ================================

    2012-09-11 13:23 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
    2012-09-11 13:23 - 2009-07-13 20:51 - 00117138 ____A C:\Windows\setupact.log
    2012-09-11 13:21 - 2012-09-11 13:21 - 00086365 ____A C:\Users\Don\Desktop\[Active] - Really annoying Sirefef virus - TechSpot Forums.htm
    2012-09-11 13:21 - 2009-07-13 21:13 - 00726270 ____A C:\Windows\System32\PerfStringBackup.INI
    2012-09-11 13:18 - 2010-10-27 11:29 - 00000900 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3757606886-878825452-795579271-1000UA.job
    2012-09-11 13:16 - 2012-09-11 13:16 - 01453499 ____A (Farbar) C:\Users\Don\Desktop\FRST64.exe
    2012-09-11 09:16 - 2012-09-11 08:28 - 00001110 ____A C:\Users\Don\Desktop\gmer.log
    2012-09-11 09:12 - 2012-09-11 09:12 - 00009259 ____A C:\Users\Don\Desktop\Attach.txt
    2012-09-11 09:11 - 2012-09-11 09:11 - 00020878 ____A C:\Users\Don\Desktop\DDS.txt
    2012-09-11 09:09 - 2012-09-11 09:09 - 00607260 ____R (Swearware) C:\Users\Don\Desktop\dds.com
    2012-09-11 08:55 - 2012-09-11 08:54 - 00000109 ____A C:\Users\Don\Desktop\path to temp ie files.txt
    2012-09-11 08:27 - 2012-09-11 08:26 - 00065588 ____A C:\Users\Don\Desktop\UPDATED 5-step Viruses_Spyware_Malware Preliminary Removal Instructions - TechSpot Forums.htm
    2012-09-11 08:25 - 2012-09-11 08:25 - 00302592 ____A C:\Users\Don\Desktop\923qgugv.exe
    2012-09-11 08:23 - 2009-07-13 20:45 - 00017600 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2012-09-11 08:23 - 2009-07-13 20:45 - 00017600 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2012-09-11 07:37 - 2010-10-18 15:42 - 01869035 ____A C:\Windows\WindowsUpdate.log
    2012-09-11 06:39 - 2012-09-11 06:39 - 00016048 ____A C:\Users\Don\Downloads\Android_XML.zip
    2012-09-11 06:35 - 2012-09-11 06:35 - 00016260 ____A C:\Users\Don\Downloads\Android_Fundamentals.zip
    2012-09-11 06:18 - 2010-10-27 11:29 - 00000848 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3757606886-878825452-795579271-1000Core.job
    2012-09-09 23:33 - 2009-07-13 20:45 - 04955488 ____A C:\Windows\System32\FNTCACHE.DAT
    2012-09-09 08:54 - 2010-10-18 15:47 - 00101896 ____A C:\Users\Don\AppData\Local\GDIPFONTCACHEV1.DAT
    2012-09-09 04:35 - 2012-09-09 04:35 - 01957789 ____A C:\Users\Don\Desktop\glyphish-icons.psd
    2012-09-07 01:15 - 2012-09-07 01:14 - 00002948 ____A C:\Windows\SysWOW64\jupdate-1.6.0_35-b10.log
    2012-09-06 13:26 - 2012-06-03 12:15 - 00000132 ____A C:\Users\Don\AppData\Roaming\Adobe PNG Format CS5 Prefs
    2012-08-28 10:24 - 2012-06-30 23:58 - 00477168 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\npdeployJava1.dll
    2012-08-28 10:24 - 2011-06-20 18:20 - 00473072 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll
    2012-08-28 10:10 - 2012-09-07 01:15 - 00157680 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe
    2012-08-28 10:10 - 2012-09-07 01:15 - 00149488 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe
    2012-08-28 10:09 - 2012-09-07 01:15 - 00149488 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe
    2012-08-23 10:11 - 2012-04-16 06:58 - 00696520 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2012-08-23 10:11 - 2011-05-24 03:02 - 00073416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2012-08-23 04:48 - 2012-08-23 04:48 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
    2012-08-20 04:03 - 2012-08-20 04:03 - 00122119 ____A C:\Users\Don\Desktop\fdghdgf.xps
    2012-08-15 03:09 - 2012-08-15 03:09 - 00000983 ____A C:\Users\Don\Desktop\Eclipse.lnk
    2012-08-14 08:37 - 2012-08-14 08:37 - 01721576 ____A (Microsoft Corporation) C:\Windows\System32\WdfCoInstaller01009.dll
    2012-08-14 08:37 - 2012-08-14 08:37 - 01002728 ____A (Microsoft Corporation) C:\Windows\System32\WinUSBCoInstaller2.dll
    2012-08-14 07:04 - 2012-08-14 07:04 - 00001048 ____A C:\Users\Don\Desktop\Dropbox.lnk
    2012-08-09 07:23 - 2010-10-19 12:47 - 00197628 ____A C:\Windows\PFRO.log
    2012-08-09 06:53 - 2012-08-09 06:53 - 00001119 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2012-08-09 00:03 - 2012-06-26 02:03 - 00009728 ____H C:\Users\Don\AppData\Roaming\desktop.ini
    2012-07-19 23:41 - 2009-07-13 21:08 - 00032620 ____A C:\Windows\Tasks\SCHEDLGU.TXT
    2012-07-03 03:46 - 2012-08-09 06:53 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

    ZeroAccess:
    C:\Windows\Installer\{5602a9de-1529-407a-030d-e41718b23532}
    C:\Windows\Installer\{5602a9de-1529-407a-030d-e41718b23532}\@
    C:\Windows\Installer\{5602a9de-1529-407a-030d-e41718b23532}\L
    C:\Windows\Installer\{5602a9de-1529-407a-030d-e41718b23532}\U
    C:\Windows\Installer\{5602a9de-1529-407a-030d-e41718b23532}\U\00000001.@
    C:\Windows\Installer\{5602a9de-1529-407a-030d-e41718b23532}\U\80000000.@
    C:\Windows\Installer\{5602a9de-1529-407a-030d-e41718b23532}\U\800000cb.@

    ZeroAccess:
    C:\Users\Don\AppData\Local\{5602a9de-1529-407a-030d-e41718b23532}
    C:\Users\Don\AppData\Local\{5602a9de-1529-407a-030d-e41718b23532}\@
    C:\Users\Don\AppData\Local\{5602a9de-1529-407a-030d-e41718b23532}\L
    C:\Users\Don\AppData\Local\{5602a9de-1529-407a-030d-e41718b23532}\n
    C:\Users\Don\AppData\Local\{5602a9de-1529-407a-030d-e41718b23532}\U

    ==================== Known DLLs (Whitelisted) =================


    ==================== Bamital & volsnap Check =================

    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\SysWOW64\wininit.exe => MD5 is legit
    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\SysWOW64\explorer.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\SysWOW64\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\SysWOW64\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\SysWOW64\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

    ==================== EXE ASSOCIATION =====================

    HKLM\...\.exe: exefile => OK
    HKLM\...\exefile\DefaultIcon: %1 => OK
    HKLM\...\exefile\open\command: "%1" %* => OK

    ==================== Restore Points =========================

    Restore point made on: 2012-09-11 07:25:12
    Restore point made on: 2012-09-11 07:37:03

    ==================== Memory info ===========================

    Percentage of memory in use: 14%
    Total physical RAM: 3885.52 MB
    Available physical RAM: 3306.4 MB
    Total Pagefile: 3883.67 MB
    Available Pagefile: 3306.3 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.9 MB

    ==================== Partitions ============================

    1 Drive c: (OS_Install) (Fixed) (Total:172.79 GB) (Free:31.35 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    2 Drive d: (Data) (Fixed) (Total:113.2 GB) (Free:7.44 GB) NTFS
    3 Drive e: (BIOS_RVY) (Fixed) (Total:12 GB) (Free:3.9 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    4 Drive f: (System) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    6 Drive h: (AMBROOGLE) (Removable) (Total:0.94 GB) (Free:0.94 GB) FAT
    7 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

    Disk ### Status Size Free Dyn Gpt
    -------- ------------- ------- ------- --- ---
    Disk 0 Online 298 GB 0 B
    Disk 1 Online 964 MB 0 B

    Partitions of Disk 0:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Recovery 12 GB 1024 KB
    Partition 2 Recovery 100 MB 12 GB
    Partition 3 Primary 172 GB 12 GB
    Partition 4 Primary 113 GB 184 GB

    ==================================================================================

    Disk: 0
    Partition 1
    Type : 27
    Hidden: Yes
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 3 E BIOS_RVY NTFS Partition 12 GB Healthy Hidden

    ==================================================================================

    Disk: 0
    Partition 2
    Type : 27
    Hidden: Yes
    Active: Yes

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 4 F System NTFS Partition 100 MB Healthy Hidden

    ==================================================================================

    Disk: 0
    Partition 3
    Type : 07
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 1 C OS_Install NTFS Partition 172 GB Healthy

    ==================================================================================

    Disk: 0
    Partition 4
    Type : 07
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 2 D Data NTFS Partition 113 GB Healthy

    ==================================================================================

    Partitions of Disk 1:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    * Partition 1 Primary 964 MB 0 B

    ==================================================================================

    Disk: 1
    There is no partition selected.

    There is no partition selected.
    Please select a partition and try again.

    ==================================================================================

    Last Boot: 2012-09-06 00:41

    ==================== End Of Log =============================




    Search.txt

    Farbar Recovery Scan Tool (x64) Version: 11-09-2012 01
    Ran by SYSTEM at 2012-09-11 23:34:42
    Running from H:\

    ================== Search: "services.exe" ===================

    C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
    [2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

    C:\Windows\System32\services.exe
    [2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06

    ====== End Of Search ======

    Once again thanks for your help
  4. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Good job!

    FRST Fixlist

    Download the attached file, please. Save it on your flash drive in same location as FRST. Make sure it maintains its current name fixlist.txt.

    NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system

    Now, please enter System Recovery Options then select Command Prompt.

    Run FRST and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

    Now restart, let it boot normally and tell me how it went.

    Attached Files:

  5. Don37

    Don37 TS Rookie Topic Starter

    Hey DMJ, thanks for following up, I hope you have a nice day.
    It went well, here is the log :

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-09-2012 01
    Ran by SYSTEM at 2012-09-12 19:04:20 Run:1
    Running from H:\

    ==============================================

    C:\Users\Don\Desktop\923qgugv.exe moved successfully.
    C:\Windows\Installer\{5602a9de-1529-407a-030d-e41718b23532} moved successfully.
    C:\Users\Don\AppData\Local\{5602a9de-1529-407a-030d-e41718b23532} moved successfully.
    C:\Windows\System32\services.exe moved successfully.
    C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe

    ==== End of Fixlog ====

    Thanks again for your help
  6. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Back to Normal Mode...

    ComboFix

    Please download ComboFix[​IMG] by sUBs
    From BleepingComputer.com

    Please save the file to your Desktop, but rename it first to svchost.exe

    Important information about ComboFix

    Before the download:
    • Please copy and paste these instructions to Notepad and save to your Desktop, or print them - for easier access.
    • It is important to rename ComboFix before the download.
    • Please do not rename ComboFix to other names, but only the one indicated.
    After the download:
    • Close any open browsers.
    • Very Important: Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Please visit here if you don't know how.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
    • If there is no Internet connection after running ComboFix, then restart your computer to restore back your connection.
    Running ComboFix:
    • Double click on svchost.exe & follow the prompts.
    • It will attempt to install the Recovery Console:
    • When ComboFix finishes, it will produce a report for you.
    • Please post the "C:\Combo-Fix.txt" in your next reply.
    Troubleshooting ComboFix

    Safe Mode:

    If you still cannot get ComboFix to run, try booting into Safe Mode, and run it there.

    (To boot into Safe Mode, tap F8 after BIOS, and just before the Windows
    logo appears. A list of options will appear, select "Safe Mode.")

    Re-downloading:

    If this doesn't work either, try the same method (above method), but try to download it again, except name
    ComboFix.exe to iexplore.exe, explorer.exe, or winlogon.exe.

    Malware is known for blocking all "user" processes, except for its whitelist of system important processes such as iexplore.exe, explorer.exe, winlogon.exe.

    NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
  7. Don37

    Don37 TS Rookie Topic Starter

    Hi again

    Here the combofix log:

    ComboFix 12-09-12.03 - Don 12/09/2012 19:22:24.1.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.353.1033.18.3886.2406 [GMT 2:00]
    Running from: c:\users\Don\Desktop\ComboFix.exe
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\programdata\Roaming
    c:\users\Don\AppData\Local\Temp\f9ca9507-9acd-4bfb-8630-5a8a6c2ce1bc\CliSecureRT64.dll
    c:\users\Don\AppData\Roaming\desktop.ini
    c:\windows\ST6UNST.000
    c:\windows\SysWow64\logs
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-08-12 to 2012-09-12 )))))))))))))))))))))))))))))))
    .
    .
    2012-09-12 17:44 . 2012-09-12 17:44 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-09-12 07:32 . 2012-09-12 07:33 -------- d-----w- C:\FRST
    2012-09-11 10:27 . 2012-09-11 10:27 73696 ----a-w- c:\program files (x86)\Mozilla Firefox\breakpadinjector.dll
    2012-08-20 13:01 . 2012-08-20 13:01 -------- d-----w- c:\users\Don\AppData\Local\SteelSeries_ApS
    2012-08-20 12:58 . 2012-08-20 12:58 -------- d-----w- c:\users\Don\AppData\Roaming\SteelSeries
    2012-08-20 12:58 . 2012-08-20 12:58 -------- d-----w- c:\programdata\SteelSeries
    2012-08-20 12:57 . 2012-08-20 12:58 -------- d-----w- c:\program files\SteelSeries Engine
    2012-08-14 16:37 . 2012-08-14 16:37 1002728 ----a-w- c:\windows\system32\WinUSBCoInstaller2.dll
    2012-08-14 16:37 . 2012-08-14 16:37 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
    2012-08-14 15:49 . 2012-09-12 09:25 -------- d-----w- c:\users\Don\android-sdks
    2012-08-14 15:48 . 2012-08-23 10:14 -------- d-----w- c:\users\Don\.android
    2012-08-14 15:32 . 2012-08-23 09:19 -------- d-----w- C:\Eclipse
    2012-08-14 15:30 . 2012-09-12 13:08 -------- d-----w- c:\program files (x86)\Eclipse installed
    2012-08-14 15:04 . 2012-09-08 08:33 -------- d-----r- C:\Dropbox
    2012-08-14 14:58 . 2012-09-08 11:12 -------- d-----w- c:\users\Don\AppData\Roaming\Dropbox
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-08-28 18:24 . 2012-07-01 07:58 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
    2012-08-28 18:24 . 2011-06-21 02:20 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2012-08-23 18:11 . 2012-04-16 14:58 696520 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2012-08-23 18:11 . 2011-05-24 11:02 73416 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-07-03 11:46 . 2012-08-09 14:53 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 94208 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 94208 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 94208 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}]
    @="{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}"
    [HKEY_CLASSES_ROOT\CLSID\{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}]
    2009-10-14 19:41 150872 ----a-w- c:\windows\SysWOW64\pfmshx_359.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Netvue"="c:\program files (x86)\Netvue\Netvue.exe" [2006-12-13 528384]
    "PeerBlock"="c:\program files\PeerBlock\peerblock.exe" [2010-11-07 2646128]
    "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
    "MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
    "SteelSeries Engine"="c:\program files\SteelSeries Engine\SteelSeriesEngine.exe" [2012-08-06 236032]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-17 98304]
    "MGSysCtrl"="c:\program files (x86)\System Control Manager\MGSysCtrl.exe" [2010-01-08 2396160]
    "IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696]
    "VirtualCloneDrive"="c:\program files (x86)\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
    "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
    "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
    .
    c:\users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Netvue.exe - Shortcut.lnk - c:\program files (x86)\Netvue\Netvue.exe [2006-12-13 528384]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-15 158856]
    R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe [2010-01-26 1029896]
    R3 BTMCOM;Bluetooth Serial Port;c:\windows\System32\Drivers\btmcom.sys [2009-12-14 51200]
    R3 BTMHID;BTMHID;c:\windows\system32\DRIVERS\btmhid.sys [2010-01-13 34048]
    R3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\Drivers\btmusb.sys [2010-01-26 461312]
    R3 driverhardwarev2x64;driverhardwarev2x64;c:\program files\ma-config.com\Drivers\driverhardwarev2x64.sys [2010-08-30 15872]
    R3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2009-05-20 70656]
    R3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\DRIVERS\enecirhid.sys [2009-05-19 14848]
    R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\DRIVERS\enecirhidma.sys [2008-04-24 6656]
    R3 fspad_xp64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_xp64;c:\windows\system32\DRIVERS\fspad_xp64.sys [2010-02-09 53248]
    R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\x64\maconfservice.exe [2011-05-01 420864]
    R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-11 114144]
    R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-11-02 340240]
    R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-01-13 7675392]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
    R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2009-09-02 225280]
    R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
    R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
    R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-21 1255736]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-07-23 254528]
    S1 pfmfs_359;pfmfs_359;c:\windows\system32\Drivers\pfmfs_359.sys [2009-10-14 241880]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
    S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-02-24 191616]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-12-17 202752]
    S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe [2009-12-21 637192]
    S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]
    S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\System Control Manager\MSIService.exe [2009-07-09 160768]
    S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-08-06 13784]
    S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-18 2320920]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2009-12-17 6177792]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2009-12-17 156160]
    S3 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [2010-01-25 4154120]
    S3 busenum;SteelBusSvc;c:\windows\system32\DRIVERS\SteelBus64.sys [2012-05-22 112128]
    S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-03-16 1028096]
    S3 fspad_wlh64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_wlh64;c:\windows\system32\DRIVERS\fspad_wlh64.sys [2010-02-09 53248]
    S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-12-18 56344]
    S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-10 158720]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-01-07 271872]
    S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [2009-12-17 7773856]
    S3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2010-11-09 8500736]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-21 413800]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - WS2IFSL
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3757606886-878825452-795579271-1000Core.job
    - c:\users\Don\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-27 19:29]
    .
    2012-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3757606886-878825452-795579271-1000UA.job
    - c:\users\Don\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-27 19:29]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 97792 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 97792 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 97792 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 97792 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}]
    @="{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}"
    [HKEY_CLASSES_ROOT\CLSID\{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}]
    2009-10-14 19:41 170840 ----a-w- c:\windows\System32\pfmshx_359.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-12-17 166424]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-12-17 390168]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2009-12-17 409624]
    "BTMTrayAgent"="c:\program files\Motorola\Bluetooth\btmshell.dll" [2010-02-13 20433160]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 112512]
    "AutoKMS"="c:\windows\AutoKMS.exe" [2011-01-30 615936]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-18 11775592]
    "IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-11-02 1933584]
    "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = https://mail.google.com/mail/?shva=1#inbox
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
    Trusted Zone: msi.com
    TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
    FF - ProfilePath - c:\users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\oo7zp5fc.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig
    FF - prefs.js: network.proxy.ftp - 194.254.103.248
    FF - prefs.js: network.proxy.ftp_port - 3128
    FF - prefs.js: network.proxy.http_port - 3128
    FF - prefs.js: network.proxy.socks - 194.254.103.248
    FF - prefs.js: network.proxy.socks_port - 3128
    FF - prefs.js: network.proxy.ssl - 194.254.103.248
    FF - prefs.js: network.proxy.ssl_port - 3128
    FF - prefs.js: network.proxy.type - 4
    .
    - - - - ORPHANS REMOVED - - - -
    .
    URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
    Toolbar-Locked - (no file)
    Wow6432Node-HKCU-Run-AdobeBridge - (no file)
    Toolbar-Locked - (no file)
    HKLM-Run-fspuip - c:\program files (x86)\FSP\fspuip.exe
    AddRemove-dBpoweramp Music Converter - c:\windows\system32\SpoonUninstall.exe
    AddRemove-Echoes of the Past The Castle of Shadows Collectors Edition 1.00 - c:\program files (x86)\Echoes of the Past The Castle of Shadows Collectors Edition\Uninstall.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.11"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    .
    **************************************************************************
    .
    Completion time: 2012-09-12 19:53:44 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-09-12 17:53
    .
    Pre-Run: 32,258,846,720 bytes free
    Post-Run: 35,175,464,960 bytes free
    .
    - - End Of File - - 3852E1F86FAA9C3AA78AFBC780E7748B

    How bad does it look? :-/
  8. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Do these proxies look familiar:

    FF - prefs.js: network.proxy.ftp - 194.254.103.248
    FF - prefs.js: network.proxy.ftp_port - 3128
    FF - prefs.js: network.proxy.http_port - 3128
    FF - prefs.js: network.proxy.socks - 194.254.103.248
    FF - prefs.js: network.proxy.socks_port - 3128
    FF - prefs.js: network.proxy.ssl - 194.254.103.248
    FF - prefs.js: network.proxy.ssl_port - 3128
    FF - prefs.js: network.proxy.type - 4

    ???

    AdwCleaner Scan
    Please download AdwCleaner by Xplode onto your Desktop.
    • Double click on AdwCleaner.exe to run the tool.
    • Click on Search.
    • A logfile will automatically open after the scan has finished.
    • Please post the content of that logfile in your reply.
    • You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.
  9. Don37

    Don37 TS Rookie Topic Starter

    Hi DMJ,

    No, these proxies don't look familiar, but to my knowledge, I haven't manually set up any proxy on my computer. I am not aware of any software that could use a proxy, although it might be the cause without me knowing about it.

    here is the log of Adwcleaner:

    # AdwCleaner v2.001 - Logfile created 09/13/2012 at 13:21:14
    # Updated 09/09/2012 by Xplode
    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
    # User : Don - DON-MSI
    # Boot Mode : Normal
    # Running from : C:\Users\Don\Desktop\adwcleaner.exe
    # Option [Search]


    ***** [Services] *****


    ***** [Files / Folders] *****


    ***** [Registry] *****

    Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine
    Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2786678
    Key Found : HKLM\Software\Conduit

    ***** [Internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16421

    [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://mail.google.com/mail/?shva=1#inbox

    -\\ Mozilla Firefox v15.0.1 (en-US)

    Profile name : default
    File : C:\Users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\oo7zp5fc.default\prefs.js

    [OK] File is clean.

    -\\ Google Chrome v21.0.1180.89

    File : C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Preferences

    Found [l.17] : urls_to_restore_on_startup = [ "hxxps://mail.google.com/mail/#inbox" ]
    Found [l.1900] : urls_to_restore_on_startup = [ "hxxps://mail.google.com/mail/#inbox" ]

    *************************

    AdwCleaner[R1].txt - [1202 octets] - [13/09/2012 13:21:14]

    ########## EOF - C:\AdwCleaner[R1].txt - [1262 octets] ##########
  10. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    ComboFix Script

    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Open notepad and copy/paste the text in the codebox below into it:
    • Save this as CFScript.txt, in the same location as ComboFix.exe

      [​IMG]
    • Referring to the picture above, drag CFScript into ComboFix.exe
    • When finished, it shall produce a log for you at C:\ComboFix.txt
    • Please post the contents of the log in your next reply.
  11. Don37

    Don37 TS Rookie Topic Starter

    Hi, thanks for your continuous help

    Here is the log you asked, in 4 parts because it's too long

    PART 1/4



    ComboFix 12-09-12.03 - Don 14/09/2012 20:15:39.2.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.353.1033.18.3886.2308 [GMT 2:00]
    Running from: c:\users\Don\Desktop\ComboFix.exe
    Command switches used :: c:\users\Don\Desktop\CFScript.txt.txt
    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Don\AppData\Local\Temp\f9ca9507-9acd-4bfb-8630-5a8a6c2ce1bc\CliSecureRT64.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-08-14 to 2012-09-14 )))))))))))))))))))))))))))))))
    .
    .
    2012-09-14 18:45 . 2012-09-14 18:45 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-09-14 16:58 . 2012-09-14 16:58 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{39B7DDD6-EF32-4416-9505-085C128BF853}\offreg.dll
    2012-09-12 07:32 . 2012-09-12 07:33 -------- d-----w- C:\FRST
    2012-09-11 10:27 . 2012-09-11 10:27 73696 ----a-w- c:\program files (x86)\Mozilla Firefox\breakpadinjector.dll
    2012-08-20 13:01 . 2012-08-20 13:01 -------- d-----w- c:\users\Don\AppData\Local\SteelSeries_ApS
    2012-08-20 12:58 . 2012-08-20 12:58 -------- d-----w- c:\users\Don\AppData\Roaming\SteelSeries
    2012-08-20 12:58 . 2012-08-20 12:58 -------- d-----w- c:\programdata\SteelSeries
    2012-08-20 12:57 . 2012-08-20 12:58 -------- d-----w- c:\program files\SteelSeries Engine
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-08-28 18:24 . 2012-07-01 07:58 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
    2012-08-28 18:24 . 2011-06-21 02:20 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2012-08-23 18:11 . 2012-04-16 14:58 696520 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2012-08-23 18:11 . 2011-05-24 11:02 73416 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-08-14 16:37 . 2012-08-14 16:37 1002728 ----a-w- c:\windows\system32\WinUSBCoInstaller2.dll
    2012-08-14 16:37 . 2012-08-14 16:37 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
    2012-07-03 11:46 . 2012-08-09 14:53 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2012-09-12_17.46.31 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-07-13 23:49 . 2009-07-14 01:41 28672 c:\windows\system32\WindowsPowerShell\v1.0\pwrshsip.dll
    + 2009-07-13 23:49 . 2009-07-14 01:29 20480 c:\windows\system32\WindowsPowerShell\v1.0\PSEvents.dll
    + 2009-07-13 23:53 . 2009-07-14 01:41 57344 c:\windows\system32\WinBioPlugIns\winbiostorageadapter.dll
    + 2009-07-13 23:53 . 2009-07-14 01:41 13824 c:\windows\system32\WinBioPlugIns\winbiosensoradapter.dll
    + 2010-02-03 14:05 . 2012-09-13 08:04 42802 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2012-09-14 16:58 44298 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2010-10-18 23:45 . 2012-09-14 16:58 15330 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3757606886-878825452-795579271-1000_UserData.bin
    + 2009-07-13 23:47 . 2009-07-14 01:41 62976 c:\windows\system32\wbem\xml\wmi2xml.dll
    + 2009-07-13 23:47 . 2009-07-14 01:41 54272 c:\windows\system32\wbem\wmitimep.dll
    + 2009-07-13 23:47 . 2009-07-14 01:41 59904 c:\windows\system32\wbem\WMIPSESS.dll
    + 2009-07-13 23:47 . 2009-07-14 01:41 89088 c:\windows\system32\wbem\WMIPIPRT.dll
    + 2009-07-13 23:31 . 2009-07-14 01:41 64512 c:\windows\system32\wbem\WmiPerfInst.dll
    + 2009-07-13 23:47 . 2009-07-14 01:41 53760 c:\windows\system32\wbem\wmipdfs.dll
    + 2009-07-13 23:47 . 2009-07-14 01:41 96256 c:\windows\system32\wbem\WMICOOKR.dll
    + 2009-07-13 23:46 . 2009-07-14 01:39 79872 c:\windows\system32\wbem\WinMgmt.exe
    + 2009-07-13 23:22 . 2009-07-14 01:41 99840 c:\windows\system32\wbem\Win32_EncryptableVolume.dll
    + 2009-07-13 23:46 . 2009-07-14 01:41 64512 c:\windows\system32\wbem\wbemsvc.dll
    + 2009-07-13 23:46 . 2009-07-14 01:41 43520 c:\windows\system32\wbem\wbemprox.dll
    + 2009-07-13 23:46 . 2009-07-14 01:41 75776 c:\windows\system32\wbem\wbemcons.dll
    + 2009-07-13 23:47 . 2009-07-14 01:39 47104 c:\windows\system32\wbem\unsecapp.exe
    + 2009-07-13 23:46 . 2009-07-14 01:41 48128 c:\windows\system32\wbem\SMTPCons.dll
    + 2009-07-13 23:47 . 2009-07-14 01:39 48128 c:\windows\system32\wbem\scrcons.exe
    + 2009-07-13 23:47 . 2009-07-14 01:41 78336 c:\windows\system32\wbem\NCProv.dll
    + 2009-07-13 23:47 . 2009-07-14 01:41 76288 c:\windows\system32\wbem\mofinstall.dll
    + 2009-07-13 23:47 . 2009-07-14 01:39 22528 c:\windows\system32\wbem\mofcomp.exe
    + 2009-07-13 23:47 . 2009-07-14 01:41 20480 c:\windows\system32\wbem\MMFUtil.dll
    + 2009-07-13 23:47 . 2009-07-14 01:41 44544 c:\windows\system32\wbem\KrnlProv.dll
    + 2011-04-15 09:26 . 2010-11-20 13:27 39424 c:\windows\system32\spool\prtprocs\x64\winprint.dll
    + 2009-07-14 00:03 . 2009-07-14 01:41 27648 c:\windows\system32\spool\prtprocs\x64\jnwppr.dll
    + 2012-06-15 10:07 . 2009-07-14 01:40 84992 c:\windows\system32\spool\prtprocs\x64\CNBPP4.DLL
    + 2011-01-30 14:11 . 2010-03-29 20:30 60288 c:\windows\system32\spool\drivers\x64\SendToOneNoteUI.dll
    + 2010-03-16 19:47 . 2008-11-10 11:41 67472 c:\windows\system32\spool\drivers\x64\msonpui.dll
    + 2009-07-14 00:03 . 2009-07-14 01:41 98816 c:\windows\system32\spool\drivers\x64\3\jnwdui.dll
    + 2009-07-14 01:20 . 2009-07-14 01:40 13824 c:\windows\system32\spool\drivers\x64\3\CNBWI4.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 59392 c:\windows\system32\spool\drivers\x64\3\CNBSS4.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 44544 c:\windows\system32\spool\drivers\x64\3\CNBSQ4.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 49664 c:\windows\system32\spool\drivers\x64\3\CNBSD4.DLL
    + 2009-07-14 01:20 . 2009-06-10 20:43 30320 c:\windows\system32\spool\drivers\x64\3\CNBP42.DAT
    + 2009-07-14 01:20 . 2009-06-10 20:43 27140 c:\windows\system32\spool\drivers\x64\3\CNBP41.DAT
    + 2009-07-14 01:19 . 2009-06-10 20:43 23280 c:\windows\system32\spool\drivers\x64\3\CNBP40.DAT
    + 2009-07-14 01:20 . 2009-07-14 01:40 71680 c:\windows\system32\spool\drivers\x64\3\CNBLH4.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 89088 c:\windows\system32\spool\drivers\x64\3\CNBIC4_2.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 10240 c:\windows\system32\spool\drivers\x64\3\CNBFUS4.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 34304 c:\windows\system32\spool\drivers\x64\3\CNBEI4.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 47104 c:\windows\system32\spool\drivers\x64\3\CNBBR312.DLL
    + 2009-07-14 00:34 . 2009-07-14 01:41 40448 c:\windows\system32\Speech\SpeechUX\SpeechUXPS.DLL
    + 2009-07-14 00:16 . 2009-07-14 01:41 67584 c:\windows\system32\Setup\tssysprep.dll
    + 2011-04-15 09:26 . 2010-11-20 13:27 57856 c:\windows\system32\Setup\pbkmigr.dll
    + 2009-07-13 23:59 . 2009-07-14 01:41 67072 c:\windows\system32\Setup\msdtcstp.dll
    + 2009-07-14 00:36 . 2009-07-14 01:40 35328 c:\windows\system32\Setup\FXSOCM.dll
    + 2009-07-14 00:09 . 2009-07-14 01:40 64000 c:\windows\system32\Setup\cmmigr.dll
    + 2009-07-14 05:35 . 2009-07-14 02:29 51462 c:\windows\system32\Printing_Admin_Scripts\en-US\prnqctl.vbs
    + 2009-07-14 05:35 . 2009-07-14 02:25 56756 c:\windows\system32\Printing_Admin_Scripts\en-US\prnport.vbs
    + 2009-07-14 05:35 . 2009-07-14 02:24 81048 c:\windows\system32\Printing_Admin_Scripts\en-US\prnmngr.vbs
    + 2009-07-14 05:35 . 2009-07-14 02:28 69882 c:\windows\system32\Printing_Admin_Scripts\en-US\prnjobs.vbs
    + 2009-07-14 05:35 . 2009-07-14 02:26 51312 c:\windows\system32\Printing_Admin_Scripts\en-US\prndrvr.vbs
    + 2009-07-13 23:31 . 2009-07-14 01:41 59392 c:\windows\system32\oobe\WinLGDep.dll
    + 2009-07-13 23:28 . 2009-07-14 01:41 58368 c:\windows\system32\oobe\wdsutil.dll
    + 2011-04-15 09:25 . 2010-11-20 13:27 57856 c:\windows\system32\oobe\spprgrss.dll
    + 2009-07-13 23:31 . 2009-07-14 01:39 24064 c:\windows\system32\oobe\setupsqm.exe
    + 2009-07-13 23:27 . 2009-07-14 01:41 81920 c:\windows\system32\oobe\pnpibs.dll
    + 2009-07-13 23:29 . 2009-07-14 01:39 59904 c:\windows\system32\oobe\oobeldr.exe
    + 2011-04-15 09:26 . 2010-11-20 13:24 71168 c:\windows\system32\oobe\msoobe.exe
    + 2009-07-13 23:31 . 2009-07-14 01:40 91136 c:\windows\system32\oobe\DU.dll
    + 2009-07-13 23:30 . 2009-07-14 01:41 38912 c:\windows\system32\oobe\diagER.dll
    + 2009-07-13 23:29 . 2009-07-14 01:38 74240 c:\windows\system32\oobe\audit.exe
    + 2011-04-15 09:26 . 2010-11-05 01:57 11600 c:\windows\system32\MUI\0409\mscorees.dll
    + 2009-07-13 21:51 . 2009-06-10 20:31 19429 c:\windows\system32\Msdtc\Trace\msdtcvtr.bat
    + 2009-07-14 00:29 . 2009-07-14 01:41 78336 c:\windows\system32\migwiz\replacementmanifests\WindowsSearchEngine\WSearchMigPlugin.dll
    + 2009-07-14 00:06 . 2009-07-14 01:41 79872 c:\windows\system32\migwiz\replacementmanifests\Usb\usbmigplugin.dll
    + 2009-07-13 23:55 . 2009-07-14 01:41 23552 c:\windows\system32\migwiz\replacementmanifests\Microsoft-Windows-GameUXMig\gameuxmig.dll
    + 2009-07-14 00:18 . 2009-07-14 01:41 76288 c:\windows\system32\migwiz\replacementmanifests\microsoft-windows-audio-mmecore-other\audmigplugin.dll
    + 2009-07-13 23:49 . 2009-07-14 01:41 85504 c:\windows\system32\migwiz\replacementmanifests\microsoft-activedirectory-webservices\adwsmigrate.dll
    + 2009-07-13 23:40 . 2009-07-14 01:41 40960 c:\windows\system32\migwiz\dlmanifests\Microsoft-Windows-TextServicesFramework-Migration-DL\TableTextServiceMig.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 24064 c:\windows\system32\migwiz\dlmanifests\Microsoft-Windows-TextServicesFramework-Migration-DL\imtcmig.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 36864 c:\windows\system32\migwiz\dlmanifests\Microsoft-Windows-TextServicesFramework-Migration-DL\imscmig.dll
    + 2009-07-13 23:40 . 2009-07-14 01:41 47104 c:\windows\system32\migwiz\dlmanifests\Microsoft-Windows-TextServicesFramework-Migration-DL\imkrmig.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 40448 c:\windows\system32\migwiz\dlmanifests\Microsoft-Windows-TextServicesFramework-Migration-DL\imjpmig.dll
    + 2009-07-14 00:10 . 2009-07-14 01:41 64000 c:\windows\system32\migwiz\dlmanifests\Microsoft-Windows-RasConnectionManager\cmmigr.dll
    + 2009-07-14 00:08 . 2009-07-14 01:41 82432 c:\windows\system32\migwiz\dlmanifests\Microsoft-Windows-NetworkBridge\bridgemigplugin.dll
    + 2009-07-13 23:59 . 2009-07-14 01:41 67072 c:\windows\system32\migwiz\dlmanifests\Microsoft-Windows-COM-DTC-Setup-DL\msdtcstp.dll
    + 2009-07-13 23:59 . 2009-07-14 01:41 59392 c:\windows\system32\migwiz\dlmanifests\Microsoft-Windows-COM-ComPlus-Setup-DL\commig.dll
    + 2009-07-14 00:06 . 2009-07-14 01:41 86016 c:\windows\system32\migwiz\dlmanifests\Microsoft-Windows-Bluetooth-Config\BthMigPlugin.dll
    + 2009-07-13 23:52 . 2009-07-14 01:41 90112 c:\windows\system32\migwiz\dlmanifests\Microsoft-Windows-ADFS-DL\adfsmig.dll
    + 2009-07-13 23:49 . 2009-07-14 01:41 85504 c:\windows\system32\migwiz\dlmanifests\Microsoft-ActiveDirectory-WebServices-DL\adwsmigrate.dll
    + 2009-07-13 23:46 . 2009-07-14 01:41 80384 c:\windows\system32\migwiz\dlmanifests\BITSExtensions-Server\bitsmig.dll
    + 2011-04-15 09:26 . 2010-11-20 13:27 57856 c:\windows\system32\migration\WSMT\rras\replacementmanifests\Microsoft-Windows-RasApi-MigPlugin\pbkmigr-Mig.dll
    + 2009-07-14 00:29 . 2009-07-14 01:41 78336 c:\windows\system32\migration\WSearchMigPlugin.dll
    + 2012-06-14 01:06 . 2012-05-18 01:56 86528 c:\windows\system32\migration\WininetPlugin.dll
    + 2009-07-14 00:06 . 2009-07-14 01:41 79872 c:\windows\system32\migration\usbmigplugin.dll
    + 2009-07-13 23:40 . 2009-07-14 01:41 40960 c:\windows\system32\migration\TableTextServiceMig.dll
    + 2009-07-14 00:34 . 2009-07-14 01:41 52736 c:\windows\system32\migration\SCGMigPlugin.dll
    + 2009-07-14 00:09 . 2009-07-14 01:41 72192 c:\windows\system32\migration\netiomig.dll
    + 2009-07-14 00:09 . 2009-07-14 01:41 60416 c:\windows\system32\migration\IphlpsvcMigPlugin.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 24064 c:\windows\system32\migration\imtcmig.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 36864 c:\windows\system32\migration\imscmig.dll
    + 2009-07-13 23:40 . 2009-07-14 01:41 47104 c:\windows\system32\migration\imkrmig.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 40448 c:\windows\system32\migration\imjpmig.dll
    + 2009-07-13 23:55 . 2009-07-14 01:40 23552 c:\windows\system32\migration\gameuxmig.dll
    + 2009-07-13 23:59 . 2009-07-14 01:40 59392 c:\windows\system32\migration\commig.dll
    + 2009-07-14 00:06 . 2009-07-14 01:40 86016 c:\windows\system32\migration\bthmigplugin.dll
    + 2009-07-14 00:08 . 2009-07-14 01:40 82432 c:\windows\system32\migration\bridgemigplugin.dll
    + 2009-07-14 00:18 . 2009-07-14 01:40 76288 c:\windows\system32\migration\audmigplugin.dll
    + 2011-05-16 02:26 . 2011-05-15 17:09 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat
    + 2009-07-13 23:39 . 2009-07-14 01:41 14336 c:\windows\system32\IME\shared\res\padrs804.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 22016 c:\windows\system32\IME\shared\res\padrs412.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 23552 c:\windows\system32\IME\shared\res\padrs411.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 13824 c:\windows\system32\IME\shared\res\padrs404.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 19968 c:\windows\system32\IME\shared\imever.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 45568 c:\windows\system32\IME\shared\IMEPADSM.DLL
    + 2009-07-13 23:39 . 2009-07-14 01:41 40448 c:\windows\system32\IME\shared\imecfm.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 68608 c:\windows\system32\IME\shared\IMEAPIS.DLL
    + 2009-07-13 23:39 . 2009-07-14 01:41 60928 c:\windows\system32\IME\IMETC10\applets\IMTCDIC.dll
    + 2009-07-13 23:39 . 2009-07-14 01:41 69632 c:\windows\system32\IME\IMESC5\PMIGRATE.dll
    + 2009-07-13 23:40 . 2009-07-14 01:41 64000 c:\windows\system32\IME\imekr8\imkrudt.dll
    + 2009-07-13 23:40 . 2009-07-14 01:41 99840 c:\windows\system32\IME\imekr8\dicts\imkrhjd.dll
    + 2009-07-13 23:39 . 2009-07-14 01:39 61952 c:\windows\system32\IME\IMEJP10\IMJPUEX.EXE
    + 2009-07-13 23:40 . 2009-07-14 01:39 30208 c:\windows\system32\IME\IMEJP10\imjppdmg.exe
    + 2009-07-13 23:39 . 2009-07-14 01:39 79360 c:\windows\system32\IME\IMEJP10\IMJPMGR.EXE
    + 2009-07-13 23:39 . 2009-07-14 01:39 82432 c:\windows\system32\IME\IMEJP10\IMJPDSVR.EXE
    + 2009-07-13 23:39 . 2009-07-14 01:41 46080 c:\windows\system32\IME\IMEJP10\IMJPDCTP.DLL
    + 2009-07-13 23:39 . 2009-07-14 01:39 18432 c:\windows\system32\IME\IMEJP10\IMJPDADM.EXE
    + 2011-04-15 09:31 . 2011-04-15 09:31 13312 c:\windows\system32\EventProviders\spcmsg.dll
    + 2009-07-14 05:35 . 2009-07-14 02:32 69632 c:\windows\system32\en\AuthFWWizFwk.Resources.dll
    + 2011-07-01 20:50 . 2009-05-18 17:17 34152 c:\windows\system32\DRVSTORE\GEARAspiWD_B60A2DA9F47E0A7F3329B57AA751F1789961A8BE\x64\GEARAspiWDM.sys
    + 2009-07-14 05:30 . 2012-08-23 12:48 86016 c:\windows\system32\DriverStore\infpub.dat
    + 2009-07-14 00:39 . 2009-07-14 00:39 23040 c:\windows\system32\DriverStore\FileRepository\wsdprint.inf_amd64_neutral_f91980f20f3112ed\WSDPrint.sys
    + 2009-07-14 00:21 . 2009-07-14 01:41 88064 c:\windows\system32\DriverStore\FileRepository\wpdmtp.inf_amd64_neutral_28f06ca2e38e8979\WpdMtpUS.dll
    + 2009-07-14 00:21 . 2009-07-14 01:41 83968 c:\windows\system32\DriverStore\FileRepository\wpdmtp.inf_amd64_neutral_28f06ca2e38e8979\WpdMtpIP.dll
    + 2009-07-14 00:21 . 2009-07-14 01:41 95744 c:\windows\system32\DriverStore\FileRepository\wpdmtp.inf_amd64_neutral_28f06ca2e38e8979\WpdMtpbt.dll
     
  12. Don37

    Don37 TS Rookie Topic Starter

    + 2011-04-15 09:25 . 2010-11-20 13:27 83968 c:\windows\system32\DriverStore\FileRepository\wpdcomp.inf_amd64_neutral_11bbf54c8508434e\Wpdcomp.dll
    + 2011-04-15 09:26 . 2010-11-20 10:43 41984 c:\windows\system32\DriverStore\FileRepository\winusb.inf_amd64_neutral_6cb50ae9f480775b\winusb.sys
    + 2009-07-14 00:00 . 2009-07-14 01:40 66048 c:\windows\system32\DriverStore\FileRepository\windowssideshowenhanceddriver.inf_amd64_neutral_184a2ef2a8f57c33\AuxiliaryDisplayEnhancedDriver.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 20992 c:\windows\system32\DriverStore\FileRepository\wiaxx002.inf_amd64_neutral_fbe080a7dd77c4a3\xrWPpb4.dll
    + 2009-07-14 01:18 . 2009-07-14 01:41 58368 c:\windows\system32\DriverStore\FileRepository\wiaxx002.inf_amd64_neutral_fbe080a7dd77c4a3\xrWCbgnd.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 11776 c:\windows\system32\DriverStore\FileRepository\wiasa002.inf_amd64_neutral_6429a42f1243419a\SaSegFlt.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 33280 c:\windows\system32\DriverStore\FileRepository\wiasa002.inf_amd64_neutral_6429a42f1243419a\SaImgFlt.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 10752 c:\windows\system32\DriverStore\FileRepository\wiasa002.inf_amd64_neutral_6429a42f1243419a\SaErHdlr.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 75776 c:\windows\system32\DriverStore\FileRepository\wialx004.inf_amd64_neutral_0a3a62ae6ed43127\lxa3WIA.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 75776 c:\windows\system32\DriverStore\FileRepository\wialx003.inf_amd64_neutral_db618863f9347f9a\lxa2WIA.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:41 77312 c:\windows\system32\DriverStore\FileRepository\wialx002.inf_amd64_neutral_71f4aacee1aa9f06\lxa1WIA.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 13824 c:\windows\system32\DriverStore\FileRepository\wiaky002.inf_amd64_neutral_b898f5982403f3cb\kyweds10.dll
    + 2009-07-14 01:20 . 2009-07-14 01:40 86528 c:\windows\system32\DriverStore\FileRepository\wiaep003.inf_amd64_neutral_c2a98813147bf34e\ep0icd1.dll
    + 2009-07-14 01:20 . 2009-07-14 01:40 59904 c:\windows\system32\DriverStore\FileRepository\wiaep003.inf_amd64_neutral_c2a98813147bf34e\ep0icb1.dll
    + 2009-07-14 01:19 . 2009-07-14 01:40 84480 c:\windows\system32\DriverStore\FileRepository\wiaep002.inf_amd64_neutral_0a982dec66379cb0\ep0icd0.dll
    + 2009-07-14 01:17 . 2009-07-14 01:41 73216 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHW900.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:41 77312 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHW830.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:41 73216 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHW760S.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:41 77824 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHW750S.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:41 78336 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHW730S.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:41 68096 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHW500.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:41 72192 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHW370S.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:41 73728 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHW170S.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 83456 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHL830.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 26624 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHL750S.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 17920 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHL730S.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 55808 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHL500.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 18432 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHL370S.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 55296 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHL170S.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 20992 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHIPRO.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 87040 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHC750S.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 73216 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHC730S.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 76288 c:\windows\system32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHC370S.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 18432 c:\windows\system32\DriverStore\FileRepository\wiaca00i.inf_amd64_neutral_de104aaa48ee4b00\CNHMCA6.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 18432 c:\windows\system32\DriverStore\FileRepository\wiaca00i.inf_amd64_neutral_de104aaa48ee4b00\CNHMCA.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 30208 c:\windows\system32\DriverStore\FileRepository\wiaca00i.inf_amd64_neutral_de104aaa48ee4b00\CNHI08A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 88576 c:\windows\system32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\CNHL950.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 90624 c:\windows\system32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\CNHL800R.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 88576 c:\windows\system32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\CNHL800.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 90624 c:\windows\system32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\CNHL530.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 78848 c:\windows\system32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\CNHL510.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 34816 c:\windows\system32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\CNHI06S.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 34816 c:\windows\system32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\CNHI06A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 34816 c:\windows\system32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\CNHI05A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 83968 c:\windows\system32\DriverStore\FileRepository\wiaca00e.inf_amd64_neutral_5a376e6a7cb007d5\CNHL960.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 83456 c:\windows\system32\DriverStore\FileRepository\wiaca00e.inf_amd64_neutral_5a376e6a7cb007d5\CNHL810.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 79360 c:\windows\system32\DriverStore\FileRepository\wiaca00e.inf_amd64_neutral_5a376e6a7cb007d5\CNHL600R.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 79360 c:\windows\system32\DriverStore\FileRepository\wiaca00e.inf_amd64_neutral_5a376e6a7cb007d5\CNHL600.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 34816 c:\windows\system32\DriverStore\FileRepository\wiaca00e.inf_amd64_neutral_5a376e6a7cb007d5\CNHI06A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 78848 c:\windows\system32\DriverStore\FileRepository\wiaca00d.inf_amd64_neutral_2c3623fa97b0c28e\CNHL460.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 78848 c:\windows\system32\DriverStore\FileRepository\wiaca00d.inf_amd64_neutral_2c3623fa97b0c28e\CNHL180.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 78336 c:\windows\system32\DriverStore\FileRepository\wiaca00d.inf_amd64_neutral_2c3623fa97b0c28e\CNHL160.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 34816 c:\windows\system32\DriverStore\FileRepository\wiaca00d.inf_amd64_neutral_2c3623fa97b0c28e\CNHI06A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 96768 c:\windows\system32\DriverStore\FileRepository\wiaca00c.inf_amd64_neutral_27f4ad26fea72eb1\CNHLX310.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 95232 c:\windows\system32\DriverStore\FileRepository\wiaca00c.inf_amd64_neutral_27f4ad26fea72eb1\CNHLX300.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 96256 c:\windows\system32\DriverStore\FileRepository\wiaca00c.inf_amd64_neutral_27f4ad26fea72eb1\CNHL470.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 96256 c:\windows\system32\DriverStore\FileRepository\wiaca00c.inf_amd64_neutral_27f4ad26fea72eb1\CNHL220.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 95232 c:\windows\system32\DriverStore\FileRepository\wiaca00c.inf_amd64_neutral_27f4ad26fea72eb1\CNHL210.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 78336 c:\windows\system32\DriverStore\FileRepository\wiaca00c.inf_amd64_neutral_27f4ad26fea72eb1\CNHL140.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 29696 c:\windows\system32\DriverStore\FileRepository\wiaca00c.inf_amd64_neutral_27f4ad26fea72eb1\CNHI07A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 34816 c:\windows\system32\DriverStore\FileRepository\wiaca00c.inf_amd64_neutral_27f4ad26fea72eb1\CNHI06A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 18432 c:\windows\system32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNHMCA6.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 18432 c:\windows\system32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNHMCA.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 98816 c:\windows\system32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNHLX850.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 98816 c:\windows\system32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNHL7600.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 95232 c:\windows\system32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNHL190.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 29696 c:\windows\system32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNHI08S.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 30208 c:\windows\system32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNHI08A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 29696 c:\windows\system32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNHI07A.DLL
    + 2009-07-14 01:19 . 2009-06-10 20:43 59232 c:\windows\system32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNC980W.DAT
    + 2009-07-14 01:20 . 2009-07-14 01:40 18944 c:\windows\system32\DriverStore\FileRepository\wiaca00a.inf_amd64_neutral_163313056d8f34ab\CNHMWL6.dll
    + 2009-07-14 01:19 . 2009-07-14 01:40 18944 c:\windows\system32\DriverStore\FileRepository\wiaca00a.inf_amd64_neutral_163313056d8f34ab\CNHMWL.dll
    + 2009-07-14 01:20 . 2009-07-14 01:40 97280 c:\windows\system32\DriverStore\FileRepository\wiaca00a.inf_amd64_neutral_163313056d8f34ab\CNHLX700.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 96768 c:\windows\system32\DriverStore\FileRepository\wiaca00a.inf_amd64_neutral_163313056d8f34ab\CNHL610.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 96256 c:\windows\system32\DriverStore\FileRepository\wiaca00a.inf_amd64_neutral_163313056d8f34ab\CNHL520.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 29696 c:\windows\system32\DriverStore\FileRepository\wiaca00a.inf_amd64_neutral_163313056d8f34ab\CNHI07A.DLL
    + 2009-07-14 01:20 . 2009-06-10 20:43 24648 c:\windows\system32\DriverStore\FileRepository\wiaca00a.inf_amd64_neutral_163313056d8f34ab\CNC970W.DAT
    + 2009-07-14 01:19 . 2009-07-14 01:40 38400 c:\windows\system32\DriverStore\FileRepository\wiabr00a.inf_amd64_neutral_6033065925bcc882\BrUs2Sti.dll
    + 2009-07-14 01:19 . 2009-07-14 01:40 38400 c:\windows\system32\DriverStore\FileRepository\wiabr009.inf_amd64_neutral_2d7b3edfda95df40\BrUs2Sti.dll
    + 2009-07-14 01:19 . 2009-07-14 01:40 38400 c:\windows\system32\DriverStore\FileRepository\wiabr008.inf_amd64_neutral_27d1c9a28eac4eed\BrUs2Sti.dll
    + 2009-07-14 01:19 . 2009-07-14 01:40 38400 c:\windows\system32\DriverStore\FileRepository\wiabr007.inf_amd64_neutral_442d902f3f3dd5b7\BrUs2Sti.dll
    + 2009-07-14 01:19 . 2009-07-14 01:40 38400 c:\windows\system32\DriverStore\FileRepository\wiabr006.inf_amd64_neutral_0232ca4f23224d01\BrUs2Sti.dll
    + 2009-07-14 01:19 . 2009-07-14 01:40 38400 c:\windows\system32\DriverStore\FileRepository\wiabr005.inf_amd64_neutral_e14a0514f37611d8\BrUs2Sti.dll
    + 2009-07-14 01:19 . 2009-07-14 01:40 38400 c:\windows\system32\DriverStore\FileRepository\wiabr004.inf_amd64_neutral_b1d90b3749c5e6a6\BrUs2Sti.dll
    + 2009-07-14 01:19 . 2009-07-14 01:40 38400 c:\windows\system32\DriverStore\FileRepository\wiabr002.inf_amd64_neutral_b4ea26a49ad66560\BrUs2Sti.dll
    + 2009-07-13 23:19 . 2009-07-14 01:45 21056 c:\windows\system32\DriverStore\FileRepository\wd.inf_amd64_neutral_759109899b486d47\wd.sys
    + 2011-01-15 16:21 . 2011-01-15 16:21 36352 c:\windows\system32\DriverStore\FileRepository\vclone.inf_amd64_neutral_90052917d000700d\Vista64\VClone.sys
    + 2011-04-27 10:20 . 2011-03-11 04:37 91648 c:\windows\system32\DriverStore\FileRepository\usbstor.inf_amd64_neutral_26b33263a639795d\USBSTOR.SYS
    + 2011-04-15 09:26 . 2010-11-20 10:44 91648 c:\windows\system32\DriverStore\FileRepository\usbstor.inf_amd64_neutral_0725c2806a159a9d\USBSTOR.SYS
    + 2009-07-14 00:38 . 2009-07-14 00:38 25088 c:\windows\system32\DriverStore\FileRepository\usbprint.inf_amd64_neutral_54948be2bc4bcdd1\usbprint.sys
    + 2009-07-14 00:06 . 2009-07-14 00:06 30720 c:\windows\system32\DriverStore\FileRepository\usbport.inf_amd64_neutral_f935002f367d5bb0\usbuhci.sys
    + 2009-07-14 00:06 . 2009-07-14 00:06 25600 c:\windows\system32\DriverStore\FileRepository\usbport.inf_amd64_neutral_f935002f367d5bb0\usbohci.sys
    + 2011-04-15 09:26 . 2010-11-20 10:43 52224 c:\windows\system32\DriverStore\FileRepository\usbport.inf_amd64_neutral_f935002f367d5bb0\usbehci.sys
    + 2011-05-11 11:16 . 2011-03-25 03:29 30720 c:\windows\system32\DriverStore\FileRepository\usbport.inf_amd64_neutral_189259810882aaea\usbuhci.sys
    + 2011-05-11 11:16 . 2011-03-25 03:29 25600 c:\windows\system32\DriverStore\FileRepository\usbport.inf_amd64_neutral_189259810882aaea\usbohci.sys
    + 2011-05-11 11:16 . 2011-03-25 03:29 52736 c:\windows\system32\DriverStore\FileRepository\usbport.inf_amd64_neutral_189259810882aaea\usbehci.sys
    + 2012-02-15 15:01 . 2012-02-15 15:01 52736 c:\windows\system32\DriverStore\FileRepository\usbaapl64.inf_amd64_neutral_c111aaecb61e9a2b\usbaapl64.sys
    + 2011-04-15 09:25 . 2010-11-20 10:44 98816 c:\windows\system32\DriverStore\FileRepository\usb.inf_amd64_neutral_269d7150439b3372\usbccgp.sys
    + 2011-05-11 11:16 . 2011-03-25 03:29 98816 c:\windows\system32\DriverStore\FileRepository\usb.inf_amd64_neutral_153b489118ee37b8\usbccgp.sys
    + 2011-04-15 09:26 . 2010-11-20 10:44 48640 c:\windows\system32\DriverStore\FileRepository\umbus.inf_amd64_neutral_2d4257afa2e35253\umbus.sys
    + 2011-04-15 09:27 . 2010-11-20 11:07 31232 c:\windows\system32\DriverStore\FileRepository\tsgenericusbdriver.inf_amd64_neutral_24c807694f614911\TsUsbGD.sys
    + 2011-04-15 09:26 . 2010-11-20 10:43 41984 c:\windows\system32\DriverStore\FileRepository\transfercable.inf_amd64_neutral_82f4c743c8996d67\amd64\winusb.sys
    + 2009-07-13 23:21 . 2009-07-13 23:21 38400 c:\windows\system32\DriverStore\FileRepository\tpm.inf_amd64_neutral_d5bb6575cf91cd73\tpm.sys
    + 2009-07-14 00:01 . 2009-07-14 00:01 10752 c:\windows\system32\DriverStore\FileRepository\tape.inf_amd64_neutral_c6a6811d3d827dba\sonyait.sys
    + 2009-07-14 00:01 . 2009-07-14 00:01 10240 c:\windows\system32\DriverStore\FileRepository\tape.inf_amd64_neutral_c6a6811d3d827dba\mammoth.sys
    + 2009-07-14 00:01 . 2009-07-14 00:01 10240 c:\windows\system32\DriverStore\FileRepository\tape.inf_amd64_neutral_c6a6811d3d827dba\exabyte2.sys
    + 2009-07-14 00:01 . 2009-07-14 00:01 11776 c:\windows\system32\DriverStore\FileRepository\tape.inf_amd64_neutral_c6a6811d3d827dba\dlttape.sys
    + 2009-07-14 00:01 . 2009-07-14 00:01 16384 c:\windows\system32\DriverStore\FileRepository\tape.inf_amd64_neutral_c6a6811d3d827dba\4mmdat.sys
    + 2009-07-14 00:35 . 2009-07-14 00:35 25088 c:\windows\system32\DriverStore\FileRepository\sti.inf_amd64_neutral_9d9a7113099a28a2\WSDScan.sys
    + 2009-07-14 00:35 . 2009-07-14 00:35 41984 c:\windows\system32\DriverStore\FileRepository\sti.inf_amd64_neutral_9d9a7113099a28a2\usbscan.sys
    + 2009-07-14 00:35 . 2009-07-14 00:35 12288 c:\windows\system32\DriverStore\FileRepository\sti.inf_amd64_neutral_9d9a7113099a28a2\serscan.sys
    + 2009-07-14 00:35 . 2009-07-14 00:35 17920 c:\windows\system32\DriverStore\FileRepository\sti.inf_amd64_neutral_9d9a7113099a28a2\scsiscan.sys
    + 2009-07-13 21:59 . 2009-07-14 01:45 24656 c:\windows\system32\DriverStore\FileRepository\stexstor.inf_amd64_neutral_80ee226e29362f51\stexstor.sys
    + 2009-07-13 21:59 . 2009-06-10 20:37 26112 c:\windows\system32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\stcusb.sys
    + 2009-07-13 21:59 . 2009-06-10 20:37 26112 c:\windows\system32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\SCR111.sys
    + 2009-06-10 20:37 . 2009-06-10 20:37 25600 c:\windows\system32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\scmstcs.sys
    + 2009-07-14 00:00 . 2009-07-14 00:00 23552 c:\windows\system32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\pscr.sys
    + 2009-06-10 20:37 . 2009-06-10 20:37 38400 c:\windows\system32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\grserial.sys
    + 2009-07-13 21:59 . 2009-06-10 20:37 84560 c:\windows\system32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\cxbp0wdm.sys
    + 2009-06-10 20:37 . 2009-06-10 20:37 23936 c:\windows\system32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\cmbp0wdm.sys
    + 2009-07-13 21:59 . 2009-07-14 01:45 80464 c:\windows\system32\DriverStore\FileRepository\sisraid4.inf_amd64_neutral_65ab84e9830f6f4b\sisraid4.sys
    + 2009-06-10 20:37 . 2009-07-14 01:45 43584 c:\windows\system32\DriverStore\FileRepository\sisraid2.inf_amd64_neutral_845e008c32615283\sisraid2.sys
    + 2011-04-15 09:25 . 2010-11-20 10:34 14336 c:\windows\system32\DriverStore\FileRepository\sffdisk.inf_amd64_neutral_d2425e60845d17d3\sffp_sd.sys
    + 2009-07-14 00:01 . 2009-07-14 00:01 13824 c:\windows\system32\DriverStore\FileRepository\sffdisk.inf_amd64_neutral_d2425e60845d17d3\sffp_mmc.sys
    + 2009-07-14 00:01 . 2009-07-14 00:01 14336 c:\windows\system32\DriverStore\FileRepository\sffdisk.inf_amd64_neutral_d2425e60845d17d3\sffdisk.sys
    + 2009-07-14 07:43 . 2009-07-14 01:41 44544 c:\windows\system32\DriverStore\FileRepository\sensorsalsdriver.inf_amd64_neutral_1c5bc8e71eb90127\SensorsAlsDriver.dll
    + 2012-05-21 15:14 . 2012-05-21 15:14 34944 c:\windows\system32\DriverStore\FileRepository\salphamhid.inf_amd64_neutral_9077b43301fd1366\SAlpham64.sys
    + 2009-12-03 09:27 . 2009-12-03 09:27 74272 c:\windows\system32\DriverStore\FileRepository\rt64win7.inf_amd64_neutral_62cb6bec0444b008\RtNicProp64.dll
    + 2011-01-21 06:36 . 2011-01-21 06:36 74272 c:\windows\system32\DriverStore\FileRepository\rt64win7.inf_amd64_neutral_459032c4bd93f93d\RtNicProp64.dll
    + 2009-07-14 01:19 . 2009-07-14 01:41 77312 c:\windows\system32\DriverStore\FileRepository\ricoh.inf_amd64_neutral_66b4504d1fb1c857\RW430Ext.dll
  13. Don37

    Don37 TS Rookie Topic Starter

    + 2009-07-14 01:18 . 2009-07-14 01:41 97280 c:\windows\system32\DriverStore\FileRepository\ricoh.inf_amd64_neutral_66b4504d1fb1c857\RW001Ext.dll
    + 2009-07-14 00:17 . 2009-07-14 00:17 24064 c:\windows\system32\DriverStore\FileRepository\rdpbus.inf_amd64_neutral_3b741ca76444b9c3\rdpbus.sys
    + 2009-07-14 00:01 . 2009-07-14 00:01 27648 c:\windows\system32\DriverStore\FileRepository\ramdisk.inf_amd64_neutral_798b5d4dd3f22a07\ramdisk.sys
    + 2009-07-14 01:20 . 2009-07-14 01:41 80896 c:\windows\system32\DriverStore\FileRepository\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\Amd64\SODPPUN2.DLL
    + 2009-07-14 01:18 . 2009-07-14 01:41 83456 c:\windows\system32\DriverStore\FileRepository\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\Amd64\SODPPUI2.DLL
    + 2009-07-14 01:18 . 2009-07-14 01:41 94208 c:\windows\system32\DriverStore\FileRepository\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\Amd64\SODPPLM2.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 43008 c:\windows\system32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smpsrd1.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 40960 c:\windows\system32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smpclrd1.dll
    + 2009-07-14 01:18 . 2009-07-14 01:41 99840 c:\windows\system32\DriverStore\FileRepository\prnlx00z.inf_amd64_neutral_aea50acf04a2db1d\Amd64\LXKPTPRC.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 26624 c:\windows\system32\DriverStore\FileRepository\prnlx00y.inf_amd64_neutral_977318f2317f5ddd\Amd64\LXKXLRD.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 34304 c:\windows\system32\DriverStore\FileRepository\prnlx00x.inf_amd64_neutral_808baf4e08594a59\Amd64\lxkpsrd.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 26112 c:\windows\system32\DriverStore\FileRepository\prnlx00v.inf_amd64_neutral_86ff307c66080d00\Amd64\lxkpclrd.dll
    + 2009-07-14 01:17 . 2009-07-14 01:30 92160 c:\windows\system32\DriverStore\FileRepository\prnky009.inf_amd64_neutral_8e54c9ff272b72f1\Amd64\KYW7FRES.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 92160 c:\windows\system32\DriverStore\FileRepository\prnky007.inf_amd64_neutral_e637699044f367f3\Amd64\kyw7fr04.dll
    + 2009-07-14 01:17 . 2009-07-14 01:30 92160 c:\windows\system32\DriverStore\FileRepository\prnky004.inf_amd64_neutral_5db759db19acd3ae\Amd64\kyw7fr03.dll
    + 2009-07-14 01:17 . 2009-07-14 01:30 92160 c:\windows\system32\DriverStore\FileRepository\prnky003.inf_amd64_neutral_fe7ea176f20ab839\Amd64\KYW7FRES.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 94720 c:\windows\system32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpfrsw73.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 60928 c:\windows\system32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpfllw73.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 48640 c:\windows\system32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpf3lw73.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 46080 c:\windows\system32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpz3lw72.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 22528 c:\windows\system32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpfrsw71.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 53248 c:\windows\system32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpzllw71.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 46080 c:\windows\system32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpz3lw71.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 22528 c:\windows\system32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpfrsw71.dll
    + 2009-07-14 01:20 . 2009-07-14 01:41 51712 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPZLLWN7.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 23552 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPZISN12.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 38400 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPZIPT12.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 45056 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPZIPR12.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 64512 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPZIPM12.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:41 49664 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPZINW12.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 65024 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPZIDR12.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 36352 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPZ3LWN7.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 18944 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPFRES50.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 13312 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPBPROPS.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 48128 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPBPRO.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 12800 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPBOIDPS.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 32256 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPBOID.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:41 30720 c:\windows\system32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPBMIAPI.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:30 70656 c:\windows\system32\DriverStore\FileRepository\prnge001.inf_amd64_neutral_cfffa4143b3c4592\Amd64\TTYRES.DLL
    + 2009-07-14 00:38 . 2009-07-14 01:41 13824 c:\windows\system32\DriverStore\FileRepository\prnge001.inf_amd64_neutral_cfffa4143b3c4592\Amd64\TTY.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 68096 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVRAH.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 68096 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVRAG.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 41472 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVRAF.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 41472 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVRAE.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 40960 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVRAD.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 41472 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVRAC.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 41472 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVRAB.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 40960 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVRAA.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 46592 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1T.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 49664 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1S.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 58880 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1R.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 49664 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1Q.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 46592 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1P.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 46592 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1O.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 46592 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1N.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 46592 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1M.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 57856 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1L.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 47616 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1K.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 47104 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1J.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 46592 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1I.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 57856 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1H.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 47104 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1G.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 45568 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1F.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 45568 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1E.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 46080 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1D.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 45568 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1C.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 45568 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1B.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 46592 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 50688 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR18.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 50688 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR17.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 50688 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR16.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 44032 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR15.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 50688 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR14.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 50688 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR13.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 44032 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR12.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 44032 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR11.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 44032 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR10.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 41472 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LPP01.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 39424 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LPP00.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 34816 c:\windows\system32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LLP00.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 65536 c:\windows\system32\DriverStore\FileRepository\prnep00g.inf_amd64_neutral_2926840e245f88f6\Amd64\EP0NM4RC.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 67072 c:\windows\system32\DriverStore\FileRepository\prnep00f.inf_amd64_neutral_a5f6001b957bd7e0\Amd64\EP0NM4RB.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 66048 c:\windows\system32\DriverStore\FileRepository\prnep00e.inf_amd64_neutral_edc631ff41a34218\Amd64\EP0NMF7B.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 67584 c:\windows\system32\DriverStore\FileRepository\prnep00e.inf_amd64_neutral_edc631ff41a34218\Amd64\EP0NMF7A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 69120 c:\windows\system32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\Amd64\EP0NM40F.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 53760 c:\windows\system32\DriverStore\FileRepository\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\Amd64\EP0NM4R0.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 72704 c:\windows\system32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\Amd64\EP0NMF6C.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 64000 c:\windows\system32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\Amd64\EP0NM4RI.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 72704 c:\windows\system32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\Amd64\EP0NM46A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 69120 c:\windows\system32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\Amd64\EP0NM40J.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 72192 c:\windows\system32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\EP0NSF11.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 68096 c:\windows\system32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\EP0NS421.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 68608 c:\windows\system32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\EP0NS411.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 38912 c:\windows\system32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\EP0NPP01.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 65024 c:\windows\system32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\EP0NM4RE.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 62464 c:\windows\system32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\EP0NM400.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 93696 c:\windows\system32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\EP0NIP47.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 93184 c:\windows\system32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\EP0NIP46.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 98816 c:\windows\system32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\EP0NH431.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 26624 c:\windows\system32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\EP0NAR00.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 95232 c:\windows\system32\DriverStore\FileRepository\prnep005.inf_amd64_neutral_f2fbc5759618d8fb\Amd64\EP7RDP00.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 39424 c:\windows\system32\DriverStore\FileRepository\prnep003.inf_amd64_neutral_92ed2d842e0dd4ea\Amd64\EP0LB03F.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnep003.inf_amd64_neutral_92ed2d842e0dd4ea\Amd64\EP0LB02A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnep003.inf_amd64_neutral_92ed2d842e0dd4ea\Amd64\EP0LB01A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 55808 c:\windows\system32\DriverStore\FileRepository\prnep002.inf_amd64_neutral_efc4a7485b172c07\Amd64\EP0SLP01.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 77824 c:\windows\system32\DriverStore\FileRepository\prnep002.inf_amd64_neutral_efc4a7485b172c07\Amd64\EP0SLM01.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 13824 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBWI4.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 59392 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBSS4.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 44544 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBSQ4.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 49664 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBSD4.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 84992 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBPP4.DLL
    + 2009-07-14 01:20 . 2009-06-10 20:43 30320 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBP42.DAT
    + 2009-07-14 01:20 . 2009-06-10 20:43 27140 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBP41.DAT
    + 2009-07-14 01:19 . 2009-06-10 20:43 23280 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBP40.DAT
    + 2009-07-14 01:20 . 2009-07-14 01:40 71680 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBLH4.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 86528 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBIC4_8.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 86528 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBIC4_5.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 89088 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBIC4_2.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 10240 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBFUS4.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 34304 c:\windows\system32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBEI4.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 13312 c:\windows\system32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\CNBWI3.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 54784 c:\windows\system32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\CNBSS3.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 44544 c:\windows\system32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\CNBSQ3.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 48128 c:\windows\system32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\CNBSD3.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 83968 c:\windows\system32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\CNBPP3.DLL
    + 2009-07-14 01:20 . 2009-06-10 20:43 30320 c:\windows\system32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\CNBP2.DAT
    + 2009-07-14 01:20 . 2009-06-10 20:43 27140 c:\windows\system32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\CNBP1.DAT
    + 2009-07-14 01:20 . 2009-06-10 20:43 23280 c:\windows\system32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\CNBP0.DAT
    + 2009-07-14 01:20 . 2009-07-14 01:40 10240 c:\windows\system32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\CNBFUS.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 30720 c:\windows\system32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\Amd64\CNBJOP9F.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\Amd64\CNBJOP9A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\Amd64\CNBJOP99.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 76288 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNBP_301.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNBJOP8E.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 26624 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNBJOP7F.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 25088 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNBJOP7D.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 28672 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNBJOP7B.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 40448 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNBBR302.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 37888 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNBBR301.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 89600 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNBBR288.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 44032 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNBBR286.DLL
  14. Don37

    Don37 TS Rookie Topic Starter

    + 2009-07-14 01:20 . 2009-07-14 01:40 71168 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNB_0302.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 67072 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNB_0301.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 98816 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNB_0287.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 98816 c:\windows\system32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNB_0286.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 96256 c:\windows\system32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNBP_282.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 31744 c:\windows\system32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNBJOP7U.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 29696 c:\windows\system32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNBJOP7T.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 65536 c:\windows\system32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNBBR282.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 67584 c:\windows\system32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNBBR281.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 58880 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBP_283.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 58880 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBP_280.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 26624 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBJOP84.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 26624 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBJOP7S.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 27648 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBJOP7E.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 34816 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBJOP79.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 33280 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBJOP78.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 97280 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBBR293.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 73216 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBBR292.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 51200 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBBR283.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 51200 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBBR280.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 94720 c:\windows\system32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBBR276.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnca00e.inf_amd64_neutral_651eeed98428be5e\Amd64\CNBJOP8B.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnca00e.inf_amd64_neutral_651eeed98428be5e\Amd64\CNBJOP89.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 37888 c:\windows\system32\DriverStore\FileRepository\prnca00e.inf_amd64_neutral_651eeed98428be5e\Amd64\CNBJOP86.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 96768 c:\windows\system32\DriverStore\FileRepository\prnca00e.inf_amd64_neutral_651eeed98428be5e\Amd64\CNBBR300.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 97280 c:\windows\system32\DriverStore\FileRepository\prnca00e.inf_amd64_neutral_651eeed98428be5e\Amd64\CNBBR297.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 93696 c:\windows\system32\DriverStore\FileRepository\prnca00e.inf_amd64_neutral_651eeed98428be5e\Amd64\CNBBR294.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 30208 c:\windows\system32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\CNBJOP7I.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 47104 c:\windows\system32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\CNBBR312.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 47104 c:\windows\system32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\CNBBR311.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 58880 c:\windows\system32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\CNBBR310.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 47616 c:\windows\system32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\CNBBR290.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 47616 c:\windows\system32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\CNBBR289.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 54272 c:\windows\system32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\CNBBR285.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 47104 c:\windows\system32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\CNBBR284.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\CNBJOP8W.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 30720 c:\windows\system32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\CNBJOP8S.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 30208 c:\windows\system32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\CNBJOP7I.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 59904 c:\windows\system32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\CNBBR323.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 40448 c:\windows\system32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\CNBBR320.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 59904 c:\windows\system32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\CNBBR318.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 59904 c:\windows\system32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\CNBBR316.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 47616 c:\windows\system32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\CNBBR315.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 75776 c:\windows\system32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\CNB_0321.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 75776 c:\windows\system32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\CNB_0320.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 30720 c:\windows\system32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBJOP9I.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 29696 c:\windows\system32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBJOP9B.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBJOP98.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBJOP8L.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 32768 c:\windows\system32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBJOP8F.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 59392 c:\windows\system32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBBR331.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 61952 c:\windows\system32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBBR303.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 93696 c:\windows\system32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNB_0309.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\CNBJOP92.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 28160 c:\windows\system32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\CNBJOP91.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 26624 c:\windows\system32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\CNBJOP8V.DLL
    + 2009-07-14 01:17 . 2009-07-14 01:30 85504 c:\windows\system32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\CNBBR319.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 97792 c:\windows\system32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\CNB_0329.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 97792 c:\windows\system32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\CNB_0328.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:40 97792 c:\windows\system32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\CNB_0319.DLL
    + 2009-07-14 01:19 . 2009-07-14 01:41 61440 c:\windows\system32\DriverStore\FileRepository\prnbr00a.inf_amd64_neutral_e7f3f91e6832ef5c\Amd64\brmzui13.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 22528 c:\windows\system32\DriverStore\FileRepository\prnbr00a.inf_amd64_neutral_e7f3f91e6832ef5c\Amd64\brmzrd13.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 58880 c:\windows\system32\DriverStore\FileRepository\prnbr006.inf_amd64_neutral_f156853def526447\Amd64\BRURD23A.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 25088 c:\windows\system32\DriverStore\FileRepository\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\Amd64\BRPTUNI2.DLL
    + 2009-07-14 01:20 . 2009-07-14 01:40 17408 c:\windows\system32\DriverStore\FileRepository\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\Amd64\BRMWUNI2.DLL
    + 2009-07-13 22:53 . 2009-07-14 01:41 17920 c:\windows\system32\DriverStore\FileRepository\ph6xib64c1.inf_amd64_neutral_68c99681343e9b68\Ph6xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 17920 c:\windows\system32\DriverStore\FileRepository\ph6xib64c0.inf_amd64_neutral_a43df8f7441e1c61\Ph6xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc9.inf_amd64_neutral_ff3a566e4b6ba035\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc8.inf_amd64_neutral_c93e7023ef90e637\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc7.inf_amd64_neutral_348f512722c79525\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc6.inf_amd64_neutral_2818f7b3b62bdd39\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc5.inf_amd64_neutral_2270382453de2dbb\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc4.inf_amd64_neutral_310871d800afa82a\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc3.inf_amd64_neutral_1da6abc36a79974f\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc2.inf_amd64_neutral_7621f5d62d77f42e\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc12.inf_amd64_neutral_ff7295ba5a46d63f\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc11.inf_amd64_neutral_bb18e5f134c40c68\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc10.inf_amd64_neutral_2c5d0c618dbfaf2a\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc1.inf_amd64_neutral_662220c3016bb4d0\Ph3xIB64MV.dll
    + 2009-07-13 22:53 . 2009-07-14 01:41 15872 c:\windows\system32\DriverStore\FileRepository\ph3xibc0.inf_amd64_neutral_c24bcc939e6dfc23\Ph3xIB64MV.dll
    + 2011-04-15 09:25 . 2010-11-20 13:27 22016 c:\windows\system32\DriverStore\FileRepository\ntprint.inf_amd64_neutral_4616c3de1949be6d\Amd64\PJLMON.DLL
    + 2009-07-13 21:59 . 2009-07-14 01:48 51264 c:\windows\system32\DriverStore\FileRepository\nfrd960.inf_amd64_neutral_cfc8c0013e9ede68\nfrd960.sys
    + 2009-06-10 20:35 . 2009-06-10 20:35 96664 c:\windows\system32\DriverStore\FileRepository\netxfx64.inf_amd64_neutral_3336ecb2950fdc45\xfrmx64.sys
    + 2009-07-14 00:07 . 2009-07-14 00:07 24576 c:\windows\system32\DriverStore\FileRepository\netvwifibus.inf_amd64_neutral_9d0740f32ce81d24\vwifibus.sys
    + 2009-06-10 20:35 . 2009-06-10 20:35 51968 c:\windows\system32\DriverStore\FileRepository\netvg62a.inf_amd64_neutral_5817ae5135655364\getn62a.sys
    + 2009-06-10 20:35 . 2009-06-10 20:35 47872 c:\windows\system32\DriverStore\FileRepository\netvfx64.inf_amd64_neutral_194cb6d2ea3a486e\fet6x64.sys
    + 2010-03-16 19:30 . 2010-01-06 08:25 97792 c:\windows\system32\DriverStore\FileRepository\netrtx64.inf_amd64_neutral_12f90a8df55b3478\RTNUninst64.dll
    + 2010-03-16 19:30 . 2010-01-06 08:25 67584 c:\windows\system32\DriverStore\FileRepository\netrtx64.inf_amd64_neutral_12f90a8df55b3478\RtNicProp64.dll
    + 2009-06-10 20:35 . 2009-06-10 20:35 51712 c:\windows\system32\DriverStore\FileRepository\netrtl64.inf_amd64_neutral_0383c5de75359695\Rtnic64.sys
    + 2009-07-14 00:09 . 2009-07-14 00:09 19968 c:\windows\system32\DriverStore\FileRepository\netrndis.inf_amd64_neutral_4c56d83f6e4d75b0\usb8023x.sys
    + 2009-07-14 00:09 . 2009-07-14 00:09 19968 c:\windows\system32\DriverStore\FileRepository\netrndis.inf_amd64_neutral_4c56d83f6e4d75b0\usb80236.sys
    + 2009-07-14 00:09 . 2009-07-14 00:09 41472 c:\windows\system32\DriverStore\FileRepository\netrndis.inf_amd64_neutral_4c56d83f6e4d75b0\rndismpx.sys
    + 2009-07-14 00:09 . 2009-07-14 00:09 35840 c:\windows\system32\DriverStore\FileRepository\netrndis.inf_amd64_neutral_4c56d83f6e4d75b0\rndismp6.sys
    + 2009-06-10 20:34 . 2009-06-10 20:34 34304 c:\windows\system32\DriverStore\FileRepository\netl260a.inf_amd64_neutral_085226e1dfe76c55\l260x64.sys
    + 2009-06-20 02:09 . 2009-06-20 02:09 54272 c:\windows\system32\DriverStore\FileRepository\netl1e64.inf_amd64_neutral_22118b1072f57433\L1E62x64.sys
    + 2009-06-10 20:34 . 2009-06-10 20:34 57344 c:\windows\system32\DriverStore\FileRepository\netl1c64.inf_amd64_neutral_30b0b06f47cab8cf\L1C62x64.sys
    + 2009-06-25 02:14 . 2009-06-25 02:14 58368 c:\windows\system32\DriverStore\FileRepository\netl160a.inf_amd64_neutral_f8bdd2cbac28a8fd\l160x64.sys
    + 2009-06-10 20:35 . 2009-06-10 20:35 56832 c:\windows\system32\DriverStore\FileRepository\netg664.inf_amd64_neutral_b4e8ccc6ba210e97\SiSG664.sys
    + 2009-06-10 20:34 . 2009-06-10 20:34 71680 c:\windows\system32\DriverStore\FileRepository\netbxnda.inf_amd64_neutral_c81780c5dcabd0a0\bxnd60a.sys
    + 2011-05-10 12:06 . 2011-05-10 12:06 22528 c:\windows\system32\DriverStore\FileRepository\netaapl64.inf_amd64_neutral_dc2cbd989eec1514\netaapl64.sys
    + 2009-06-10 20:34 . 2009-06-10 20:34 87552 c:\windows\system32\DriverStore\FileRepository\net44amd.inf_amd64_neutral_db76873d4261eb11\b44amd64.sys
    + 2009-07-14 00:02 . 2009-07-14 00:02 15360 c:\windows\system32\DriverStore\FileRepository\mtconfig.inf_amd64_neutral_4de24f49b5e60c45\MTConfig.sys
    + 2009-07-14 00:06 . 2009-07-14 00:06 56448 c:\windows\system32\DriverStore\FileRepository\mstape.inf_amd64_neutral_c2bb3ef1c45cd5a1\mstape.sys
    + 2009-07-14 00:00 . 2009-07-14 00:00 94208 c:\windows\system32\DriverStore\FileRepository\msports.inf_amd64_neutral_fdcfb86ce78678d1\serial.sys
    + 2009-07-14 00:00 . 2009-07-14 00:00 23552 c:\windows\system32\DriverStore\FileRepository\msports.inf_amd64_neutral_fdcfb86ce78678d1\serenum.sys
    + 2009-07-14 00:00 . 2009-07-14 00:00 97280 c:\windows\system32\DriverStore\FileRepository\msports.inf_amd64_neutral_fdcfb86ce78678d1\parport.sys
    + 2009-07-14 00:00 . 2009-07-14 00:00 26624 c:\windows\system32\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\sermouse.sys
    + 2009-07-14 00:00 . 2009-07-14 00:00 31232 c:\windows\system32\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\mouhid.sys
    + 2009-07-13 23:19 . 2009-07-14 01:48 49216 c:\windows\system32\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\mouclass.sys
    + 2009-07-13 23:19 . 2009-07-14 01:45 17488 c:\windows\system32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\viaide.sys
    + 2009-07-13 23:19 . 2009-07-14 01:45 48720 c:\windows\system32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\pciidex.sys
    + 2009-07-13 23:19 . 2009-07-14 01:45 12352 c:\windows\system32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\pciide.sys
    + 2011-04-15 09:26 . 2010-11-20 13:33 31104 c:\windows\system32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\msahci.sys
    + 2009-07-13 23:19 . 2009-07-14 01:48 16960 c:\windows\system32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\intelide.sys
    + 2009-07-13 23:19 . 2009-07-14 01:52 17488 c:\windows\system32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\cmdide.sys
    + 2009-07-13 23:19 . 2009-07-14 01:52 24128 c:\windows\system32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
    + 2009-07-13 23:19 . 2009-07-14 01:52 15440 c:\windows\system32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\amdide.sys
    + 2009-07-13 23:19 . 2009-07-14 01:52 15440 c:\windows\system32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\aliide.sys
    + 2009-07-14 00:06 . 2009-07-14 00:06 61440 c:\windows\system32\DriverStore\FileRepository\msdv.inf_amd64_neutral_571f87a277565224\msdv.sys
    + 2009-07-13 23:38 . 2009-07-13 23:38 30208 c:\windows\system32\DriverStore\FileRepository\monitor.inf_amd64_neutral_ab477c4d805d044f\monitor.sys
    + 2009-07-14 00:10 . 2009-07-14 00:10 24064 c:\windows\system32\DriverStore\FileRepository\modemcsa.inf_amd64_neutral_b64a610f1f09f267\MODEMCSA.sys
    + 2009-07-13 23:31 . 2009-07-13 23:31 16384 c:\windows\system32\DriverStore\FileRepository\memory.inf_amd64_neutral_c2d2c213c3138487\pnpmem.sys
    + 2009-06-10 20:37 . 2009-07-14 01:48 35392 c:\windows\system32\DriverStore\FileRepository\megasas.inf_amd64_neutral_395276dd9b7a7448\megasas.sys
    + 2009-07-14 00:08 . 2009-07-14 00:08 30208 c:\windows\system32\DriverStore\FileRepository\mdmnokia.inf_amd64_neutral_a8e9a41983d33a0b\MSIRCOMM.sys
    + 2009-07-14 00:08 . 2009-07-14 00:08 30208 c:\windows\system32\DriverStore\FileRepository\mdmirmdm.inf_amd64_neutral_fadec14b0a37b637\MSIRCOMM.sys
    + 2011-04-15 09:25 . 2010-11-20 10:43 32768 c:\windows\system32\DriverStore\FileRepository\mdmcpq.inf_amd64_neutral_fbc4a14a6a13d0c8\usbser.sys
    + 2009-07-14 00:06 . 2009-07-14 00:06 72192 c:\windows\system32\DriverStore\FileRepository\mdmbtmdm.inf_amd64_neutral_2e4da8629fc5904e\bthmodem.sys
    + 2009-07-14 01:20 . 2009-06-10 20:41 15360 c:\windows\system32\DriverStore\FileRepository\mdmbr00a.inf_amd64_neutral_aa4f0850ff03674e\BrUsbSIb.sys
    + 2009-07-14 01:20 . 2009-06-10 20:41 15360 c:\windows\system32\DriverStore\FileRepository\mdmbr008.inf_amd64_neutral_2cedaac353c381da\BrUsbSIb.sys
    + 2009-07-14 01:20 . 2009-06-10 20:41 15360 c:\windows\system32\DriverStore\FileRepository\mdmbr007.inf_amd64_neutral_91d259640bad7d26\BrUsbSIb.sys
    + 2009-07-14 01:20 . 2009-06-10 20:41 15360 c:\windows\system32\DriverStore\FileRepository\mdmbr006.inf_amd64_neutral_40c76453575b1208\BrUsbSIb.sys
    + 2009-07-14 01:20 . 2009-06-10 20:41 15360 c:\windows\system32\DriverStore\FileRepository\mdmbr005.inf_amd64_neutral_d140721f97061bba\BrUsbSIb.sys
    + 2009-07-14 01:20 . 2009-06-10 20:41 15360 c:\windows\system32\DriverStore\FileRepository\mdmbr004.inf_amd64_neutral_ccf1bc353e588fe1\BrUsbSIb.sys
    + 2009-07-14 01:20 . 2009-06-10 20:41 15360 c:\windows\system32\DriverStore\FileRepository\mdmbr002.inf_amd64_neutral_ce2134188ab21f59\BrUsbSIb.sys
    + 2011-04-15 09:25 . 2010-11-20 10:34 12800 c:\windows\system32\DriverStore\FileRepository\mchgr.inf_amd64_neutral_407146dba80d1566\spctramc.sys
    + 2011-04-15 09:25 . 2010-11-20 10:34 15360 c:\windows\system32\DriverStore\FileRepository\mchgr.inf_amd64_neutral_407146dba80d1566\sonymc.sys
    + 2011-04-15 09:25 . 2010-11-20 10:34 12288 c:\windows\system32\DriverStore\FileRepository\mchgr.inf_amd64_neutral_407146dba80d1566\snyaitmc.sys
    + 2011-04-15 09:25 . 2010-11-20 10:34 12800 c:\windows\system32\DriverStore\FileRepository\mchgr.inf_amd64_neutral_407146dba80d1566\seaddsmc.sys
    + 2011-04-15 09:25 . 2010-11-20 10:34 11264 c:\windows\system32\DriverStore\FileRepository\mchgr.inf_amd64_neutral_407146dba80d1566\qntmmc.sys
    + 2011-04-15 09:25 . 2010-11-20 10:34 13824 c:\windows\system32\DriverStore\FileRepository\mchgr.inf_amd64_neutral_407146dba80d1566\qlstrmc.sys
  15. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Do you have the remainder of the log? It is located at C:\ComboFix[#].txt. Would you please try to upload that log here, please?
  16. Don37

    Don37 TS Rookie Topic Starter

    Yeah you're right, probably a mistake with copy paste. Sorry about that.

    Here is the full log attached

    Attached Files:

  17. Don37

    Don37 TS Rookie Topic Starter

    Oh, and a question too: I am now able to update windows with windows updates. I guess it was turned off by some virus before I started this thread here, and since I have started changing things with your guidance, it is now back to functional.
    Can I update windows now with security updates or should I wait until we are fully done with your help?
  18. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Go ahead with updates.

    ComboFix Script

    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Open notepad and copy/paste the text in the codebox below into it:
    • Save this as CFScript.txt, in the same location as ComboFix.exe

      [​IMG]
    • Referring to the picture above, drag CFScript into ComboFix.exe
    • When finished, it shall produce a log for you at C:\ComboFix.txt
    • Please post the contents of the log in your next reply.
  19. Don37

    Don37 TS Rookie Topic Starter

    Log is smaller this time :)

    ComboFix 12-09-15.02 - Don 16/09/2012 13:42:53.3.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.353.1033.18.3886.2249 [GMT 2:00]
    Running from: c:\users\Don\Desktop\ComboFix.exe
    Command switches used :: c:\users\Don\Desktop\CFScript.txt
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Don\AppData\Local\Temp\f9ca9507-9acd-4bfb-8630-5a8a6c2ce1bc\CliSecureRT64.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-08-16 to 2012-09-16 )))))))))))))))))))))))))))))))
    .
    .
    2012-09-16 12:10 . 2012-09-16 12:10 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-09-16 11:12 . 2012-07-06 20:07 552960 ----a-w- c:\windows\system32\drivers\bthport.sys
    2012-09-16 11:06 . 2012-05-05 08:36 503808 ----a-w- c:\windows\system32\srcore.dll
    2012-09-16 11:05 . 2012-07-04 22:16 73216 ----a-w- c:\windows\system32\netapi32.dll
    2012-09-16 08:36 . 2012-09-16 08:36 404680 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-09-12 07:32 . 2012-09-12 07:33 -------- d-----w- C:\FRST
    2012-09-11 10:27 . 2012-09-11 10:27 73696 ----a-w- c:\program files (x86)\Mozilla Firefox\breakpadinjector.dll
    2012-08-20 13:01 . 2012-08-20 13:01 -------- d-----w- c:\users\Don\AppData\Local\SteelSeries_ApS
    2012-08-20 12:58 . 2012-08-20 12:58 -------- d-----w- c:\users\Don\AppData\Roaming\SteelSeries
    2012-08-20 12:58 . 2012-08-20 12:58 -------- d-----w- c:\programdata\SteelSeries
    2012-08-20 12:57 . 2012-08-20 12:58 -------- d-----w- c:\program files\SteelSeries Engine
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-08-30 22:43 . 2010-10-19 20:28 64462936 ----a-w- c:\windows\system32\MRT.exe
    2012-08-28 18:24 . 2012-07-01 07:58 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
    2012-08-28 18:24 . 2011-06-21 02:20 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2012-08-14 16:37 . 2012-08-14 16:37 1002728 ----a-w- c:\windows\system32\WinUSBCoInstaller2.dll
    2012-08-14 16:37 . 2012-08-14 16:37 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
    2012-07-03 11:46 . 2012-08-09 14:53 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
    .
    .
    ((((((((((((((((((((((((((((( SnapShot_2012-09-14_18.45.43 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2012-01-15 17:41 . 2011-11-17 05:28 96768 c:\windows\SysWOW64\sspicli.dll
    + 2012-09-16 11:06 . 2012-06-02 04:34 96768 c:\windows\SysWOW64\sspicli.dll
    + 2012-09-16 11:06 . 2012-05-05 07:46 43008 c:\windows\SysWOW64\srclient.dll
    - 2009-07-13 23:23 . 2009-07-14 01:16 43008 c:\windows\SysWOW64\srclient.dll
    - 2012-01-15 17:41 . 2011-11-17 05:34 22016 c:\windows\SysWOW64\secur32.dll
    + 2012-09-16 11:06 . 2012-06-02 04:40 22016 c:\windows\SysWOW64\secur32.dll
    + 2012-09-16 11:05 . 2012-07-04 21:16 57344 c:\windows\SysWOW64\netapi32.dll
    + 2012-09-16 11:10 . 2012-06-29 00:01 73216 c:\windows\SysWOW64\mshtmled.dll
    - 2012-06-14 01:06 . 2012-05-17 22:25 73216 c:\windows\SysWOW64\mshtmled.dll
    + 2012-09-16 11:10 . 2012-06-29 00:06 66048 c:\windows\SysWOW64\migration\WininetPlugin.dll
    - 2012-06-14 01:06 . 2012-05-17 22:31 66048 c:\windows\SysWOW64\migration\WininetPlugin.dll
    - 2012-06-14 01:06 . 2012-05-17 22:31 65024 c:\windows\SysWOW64\jsproxy.dll
    + 2012-09-16 11:10 . 2012-06-29 00:06 65024 c:\windows\SysWOW64\jsproxy.dll
    - 2011-04-15 09:25 . 2010-11-20 12:18 41984 c:\windows\SysWOW64\browcli.dll
    + 2012-09-16 11:05 . 2012-07-04 21:14 41984 c:\windows\SysWOW64\browcli.dll
    + 2010-02-03 14:05 . 2012-09-16 11:34 43338 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2012-09-16 11:34 44346 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2010-10-18 23:45 . 2012-09-16 11:34 15362 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3757606886-878825452-795579271-1000_UserData.bin
    + 2012-09-16 11:10 . 2012-06-29 03:40 96768 c:\windows\system32\mshtmled.dll
    - 2012-06-14 01:06 . 2012-05-18 01:51 96768 c:\windows\system32\mshtmled.dll
    + 2012-09-16 11:10 . 2012-06-29 03:46 86528 c:\windows\system32\migration\WininetPlugin.dll
    - 2012-06-14 01:06 . 2012-05-18 01:56 86528 c:\windows\system32\migration\WininetPlugin.dll
    + 2012-09-16 11:10 . 2012-06-29 03:45 85504 c:\windows\system32\jsproxy.dll
    - 2012-06-14 01:06 . 2012-05-18 01:56 85504 c:\windows\system32\jsproxy.dll
    - 2009-07-14 05:30 . 2012-08-23 12:48 86016 c:\windows\system32\DriverStore\infpub.dat
    + 2009-07-14 05:30 . 2012-09-16 11:30 86016 c:\windows\system32\DriverStore\infpub.dat
    + 2009-07-14 00:09 . 2009-07-14 00:09 19968 c:\windows\system32\DriverStore\FileRepository\netrndis.inf_amd64_neutral_0b46e86f0f566f5a\usb8023x.sys
    + 2009-07-14 00:09 . 2009-07-14 00:09 19968 c:\windows\system32\DriverStore\FileRepository\netrndis.inf_amd64_neutral_0b46e86f0f566f5a\usb80236.sys
    + 2012-09-16 11:06 . 2012-07-04 20:26 41472 c:\windows\system32\DriverStore\FileRepository\netrndis.inf_amd64_neutral_0b46e86f0f566f5a\rndismpx.sys
    + 2012-09-16 11:06 . 2012-07-04 20:26 35840 c:\windows\system32\DriverStore\FileRepository\netrndis.inf_amd64_neutral_0b46e86f0f566f5a\rndismp6.sys
    + 2011-07-12 23:13 . 2011-04-28 03:54 80384 c:\windows\system32\DriverStore\FileRepository\bth.inf_amd64_neutral_de0494b6391d872c\BTHUSB.SYS
    + 2009-07-14 00:06 . 2009-07-14 00:06 41984 c:\windows\system32\DriverStore\FileRepository\bth.inf_amd64_neutral_de0494b6391d872c\bthenum.sys
    + 2012-09-16 11:06 . 2012-07-04 20:26 41472 c:\windows\system32\drivers\RNDISMP.sys
    - 2009-07-14 00:09 . 2009-07-14 00:09 41472 c:\windows\system32\drivers\RNDISMP.sys
    - 2012-01-15 17:41 . 2011-11-17 06:49 95600 c:\windows\system32\drivers\ksecdd.sys
    + 2012-09-16 11:06 . 2012-06-02 05:48 95600 c:\windows\system32\drivers\ksecdd.sys
    + 2012-09-16 11:05 . 2012-07-04 22:13 59392 c:\windows\system32\browcli.dll
    + 2012-09-16 11:06 . 2012-02-11 06:36 67072 c:\windows\splwow64.exe
    - 2011-04-15 09:26 . 2010-11-20 13:25 67072 c:\windows\splwow64.exe
    + 2009-07-14 04:46 . 2012-09-16 11:35 93696 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
    + 2011-01-30 16:15 . 2012-09-16 11:13 34144 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\oisicon.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 34144 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\oisicon.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 42848 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\msouc.exe
    + 2011-01-30 16:15 . 2012-09-16 11:13 42848 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\msouc.exe
    + 2011-01-30 16:15 . 2012-09-16 11:13 19296 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\cagicon.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 19296 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\cagicon.exe
    - 2009-07-14 00:19 . 2009-07-14 01:07 2048 c:\windows\SysWOW64\msxml3r.dll
    + 2012-09-16 11:06 . 2010-06-26 03:24 2048 c:\windows\SysWOW64\msxml3r.dll
    - 2009-07-14 00:41 . 2009-07-14 01:30 2048 c:\windows\system32\msxml3r.dll
    + 2012-09-16 11:06 . 2010-06-26 03:55 2048 c:\windows\system32\msxml3r.dll
    - 2012-09-14 16:57 . 2012-09-14 16:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2012-09-16 11:32 . 2012-09-16 11:32 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2012-09-16 11:32 . 2012-09-16 11:32 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2012-09-14 16:57 . 2012-09-14 16:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2012-09-16 11:06 . 2012-02-11 05:43 492032 c:\windows\SysWOW64\win32spl.dll
    - 2011-04-15 09:26 . 2010-11-20 12:21 492032 c:\windows\SysWOW64\win32spl.dll
    - 2012-06-14 01:06 . 2012-05-17 22:33 231936 c:\windows\SysWOW64\url.dll
    + 2012-09-16 11:10 . 2012-06-29 00:07 231936 c:\windows\SysWOW64\url.dll
    + 2012-09-16 11:06 . 2012-06-02 04:40 225280 c:\windows\SysWOW64\schannel.dll
    + 2012-09-16 11:06 . 2012-06-02 04:39 219136 c:\windows\SysWOW64\ncrypt.dll
    - 2009-07-13 23:33 . 2009-07-14 01:16 219136 c:\windows\SysWOW64\ncrypt.dll
    + 2012-09-16 08:36 . 2012-09-16 08:36 245960 c:\windows\SysWOW64\Macromed\Flash\FlashUtil10zf_Plugin.exe
    + 2012-09-16 11:10 . 2012-06-29 00:04 717824 c:\windows\SysWOW64\jscript.dll
    + 2012-09-16 11:10 . 2012-06-29 00:04 142848 c:\windows\SysWOW64\ieUnatt.exe
    - 2012-06-14 01:06 . 2012-05-17 22:29 142848 c:\windows\SysWOW64\ieUnatt.exe
    + 2012-09-16 11:10 . 2012-06-28 23:57 176640 c:\windows\SysWOW64\ieui.dll
    - 2012-06-14 01:06 . 2012-05-17 22:20 176640 c:\windows\SysWOW64\ieui.dll
    + 2012-09-16 11:06 . 2012-08-02 16:57 490496 c:\windows\SysWOW64\d3d10level9.dll
    + 2012-09-16 11:05 . 2012-06-06 05:03 805376 c:\windows\SysWOW64\cdosys.dll
    - 2011-04-15 09:26 . 2010-11-20 12:18 805376 c:\windows\SysWOW64\cdosys.dll
    + 2012-09-16 11:06 . 2012-02-11 06:43 751104 c:\windows\system32\win32spl.dll
    - 2011-04-15 09:27 . 2010-11-20 13:27 751104 c:\windows\system32\win32spl.dll
    - 2012-06-14 01:06 . 2012-05-18 01:58 237056 c:\windows\system32\url.dll
    + 2012-09-16 11:10 . 2012-06-29 03:47 237056 c:\windows\system32\url.dll
    + 2012-09-16 11:06 . 2012-02-11 06:36 559104 c:\windows\system32\spoolsv.exe
    - 2011-04-15 09:27 . 2010-11-20 13:25 559104 c:\windows\system32\spoolsv.exe
    - 2012-01-15 17:41 . 2011-11-17 06:35 340992 c:\windows\system32\schannel.dll
    + 2012-09-16 11:06 . 2012-06-02 05:45 340992 c:\windows\system32\schannel.dll
    + 2009-07-14 02:36 . 2012-09-16 11:37 628874 c:\windows\system32\perfh009.dat
    - 2009-07-14 02:36 . 2012-09-13 13:12 628874 c:\windows\system32\perfh009.dat
    - 2009-07-14 02:36 . 2012-09-13 13:12 111026 c:\windows\system32\perfc009.dat
    + 2009-07-14 02:36 . 2012-09-16 11:37 111026 c:\windows\system32\perfc009.dat
    - 2009-07-13 23:49 . 2009-07-14 01:41 307200 c:\windows\system32\ncrypt.dll
    + 2012-09-16 11:06 . 2012-06-02 05:44 307200 c:\windows\system32\ncrypt.dll
    - 2010-12-15 21:35 . 2012-02-23 08:18 279656 c:\windows\system32\MpSigStub.exe
    + 2010-12-15 21:35 . 2012-05-31 10:25 279656 c:\windows\system32\MpSigStub.exe
    + 2012-09-16 11:05 . 2012-05-14 05:26 956928 c:\windows\system32\localspl.dll
    + 2012-09-16 11:10 . 2012-06-29 03:44 816640 c:\windows\system32\jscript.dll
    - 2012-06-14 01:06 . 2012-05-18 01:55 173056 c:\windows\system32\ieUnatt.exe
    + 2012-09-16 11:10 . 2012-06-29 03:43 173056 c:\windows\system32\ieUnatt.exe
    - 2012-06-14 01:06 . 2012-05-18 01:47 248320 c:\windows\system32\ieui.dll
    + 2012-09-16 11:10 . 2012-06-29 03:35 248320 c:\windows\system32\ieui.dll
    + 2009-07-14 05:30 . 2012-09-16 11:30 143360 c:\windows\system32\DriverStore\infstrng.dat
    - 2009-07-14 05:30 . 2012-08-23 12:48 143360 c:\windows\system32\DriverStore\infstrng.dat
    + 2009-07-14 05:30 . 2012-09-16 11:30 143360 c:\windows\system32\DriverStore\infstor.dat
    - 2009-07-14 05:30 . 2012-08-23 12:48 143360 c:\windows\system32\DriverStore\infstor.dat
    + 2011-04-15 09:26 . 2010-11-20 13:24 229376 c:\windows\system32\DriverStore\FileRepository\bth.inf_amd64_neutral_de0494b6391d872c\fsquirt.exe
    + 2012-09-16 11:12 . 2012-07-06 20:07 552960 c:\windows\system32\DriverStore\FileRepository\bth.inf_amd64_neutral_de0494b6391d872c\bthport.sys
    - 2009-07-14 05:31 . 2011-07-15 02:40 399360 c:\windows\system32\DriverStore\drvindex.dat
    + 2009-07-14 05:31 . 2012-09-16 11:30 399360 c:\windows\system32\DriverStore\drvindex.dat
    + 2012-09-16 11:06 . 2012-08-22 18:12 376688 c:\windows\system32\drivers\netio.sys
    + 2012-09-16 11:06 . 2012-08-22 18:12 950128 c:\windows\system32\drivers\ndis.sys
    + 2012-09-16 11:06 . 2012-06-02 05:48 151920 c:\windows\system32\drivers\ksecpkg.sys
    + 2012-09-16 11:06 . 2012-08-22 18:12 288624 c:\windows\system32\drivers\FWPKCLNT.SYS
    + 2012-09-16 11:06 . 2012-06-02 05:50 458704 c:\windows\system32\drivers\cng.sys
    + 2012-09-16 11:06 . 2012-08-02 17:58 574464 c:\windows\system32\d3d10level9.dll
    - 2010-10-19 07:40 . 2012-09-14 08:29 901120 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2010-10-19 07:40 . 2012-09-16 11:49 901120 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2012-09-16 11:05 . 2012-07-04 22:13 136704 c:\windows\system32\browser.dll
    + 2009-07-14 05:01 . 2012-09-16 11:30 483296 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2011-03-07 22:24 . 2012-09-16 11:30 483296 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3757606886-878825452-795579271-1000-8192.dat
    + 2011-01-30 16:15 . 2012-09-16 11:13 415584 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\pubs.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 415584 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\pubs.exe
    + 2011-01-30 16:15 . 2012-09-16 11:13 303456 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\outicon.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 303456 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\outicon.exe
    + 2011-01-30 16:15 . 2012-09-16 11:13 571232 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\misc.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 571232 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\misc.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 326496 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\joticon.exe
    + 2011-01-30 16:15 . 2012-09-16 11:13 326496 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\joticon.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 469856 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\inficon.exe
    + 2011-01-30 16:15 . 2012-09-16 11:13 469856 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\inficon.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 178528 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\grvicons.exe
    + 2011-01-30 16:15 . 2012-09-16 11:13 178528 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\grvicons.exe
    + 2012-09-16 11:10 . 2012-06-29 00:09 1129472 c:\windows\SysWOW64\wininet.dll
    - 2012-06-14 01:06 . 2012-05-17 22:35 1129472 c:\windows\SysWOW64\wininet.dll
    + 2012-09-16 11:10 . 2012-06-29 00:09 1103872 c:\windows\SysWOW64\urlmon.dll
    - 2012-06-14 01:06 . 2012-05-17 22:36 1103872 c:\windows\SysWOW64\urlmon.dll
    + 2012-09-16 11:06 . 2012-06-06 05:05 1390080 c:\windows\SysWOW64\msxml6.dll
    - 2011-04-15 09:27 . 2010-11-20 12:19 1390080 c:\windows\SysWOW64\msxml6.dll
    + 2012-09-16 11:06 . 2012-06-06 05:05 1236992 c:\windows\SysWOW64\msxml3.dll
    - 2011-04-15 09:26 . 2010-11-20 12:19 1236992 c:\windows\SysWOW64\msxml3.dll
    + 2012-09-16 08:36 . 2012-09-16 08:36 6277832 c:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
    + 2012-09-16 11:10 . 2012-06-29 00:16 1800704 c:\windows\SysWOW64\jscript9.dll
    - 2012-06-14 01:06 . 2012-05-17 22:27 1793024 c:\windows\SysWOW64\iertutil.dll
    + 2012-09-16 11:10 . 2012-06-29 00:01 1793024 c:\windows\SysWOW64\iertutil.dll
    - 2012-06-14 01:06 . 2012-05-17 22:48 9737728 c:\windows\SysWOW64\ieframe.dll
    + 2012-09-16 11:10 . 2012-06-29 00:27 9737728 c:\windows\SysWOW64\ieframe.dll
    + 2012-09-16 11:10 . 2012-06-29 03:49 1392128 c:\windows\system32\wininet.dll
    - 2012-06-14 01:06 . 2012-05-18 01:59 1392128 c:\windows\system32\wininet.dll
    + 2012-09-16 11:06 . 2012-07-18 18:15 3148800 c:\windows\system32\win32k.sys
    - 2012-06-14 01:06 . 2012-05-18 01:59 1346048 c:\windows\system32\urlmon.dll
    + 2012-09-16 11:10 . 2012-06-29 03:49 1346048 c:\windows\system32\urlmon.dll
    + 2012-09-16 11:06 . 2012-06-06 06:06 2004480 c:\windows\system32\msxml6.dll
    - 2011-04-15 09:27 . 2010-11-20 13:27 2004480 c:\windows\system32\msxml6.dll
    + 2012-09-16 11:06 . 2012-06-06 06:06 1881600 c:\windows\system32\msxml3.dll
    + 2012-09-16 11:10 . 2012-06-29 03:56 2312704 c:\windows\system32\jscript9.dll
    + 2012-09-16 11:10 . 2012-06-29 03:42 2144768 c:\windows\system32\iertutil.dll
    - 2012-06-14 01:06 . 2012-05-18 01:54 2144768 c:\windows\system32\iertutil.dll
    - 2009-07-14 04:45 . 2012-09-10 07:33 4955488 c:\windows\system32\FNTCACHE.DAT
    + 2009-07-14 04:45 . 2012-09-16 11:32 4955488 c:\windows\system32\FNTCACHE.DAT
    + 2012-09-16 11:06 . 2012-08-22 18:12 1913200 c:\windows\system32\drivers\tcpip.sys
    - 2010-10-19 07:40 . 2012-09-14 08:29 4177920 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2010-10-19 07:40 . 2012-09-16 11:49 4177920 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2012-09-16 11:05 . 2012-06-06 06:02 1133568 c:\windows\system32\cdosys.dll
    - 2011-04-15 09:26 . 2010-11-20 13:25 1133568 c:\windows\system32\cdosys.dll
    - 2009-07-14 04:45 . 2012-06-21 18:46 7162691 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
    + 2009-07-14 04:45 . 2012-09-16 11:35 7162691 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
    + 2012-08-29 20:37 . 2012-08-29 20:37 3449344 c:\windows\Installer\9add4c.msp
    + 2011-01-30 16:15 . 2012-09-16 11:13 1479520 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\xlicons.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 1479520 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\xlicons.exe
    + 2011-01-30 16:15 . 2012-09-16 11:13 1858400 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\wordicon.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 1858400 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\wordicon.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 3792736 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\pptico.exe
    + 2011-01-30 16:15 . 2012-09-16 11:13 3792736 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\pptico.exe
    - 2011-01-30 16:15 . 2012-06-14 01:08 1449312 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\accicons.exe
    + 2011-01-30 16:15 . 2012-09-16 11:13 1449312 c:\windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\accicons.exe
    + 2012-09-16 11:06 . 2012-06-09 04:41 12873728 c:\windows\SysWOW64\shell32.dll
    + 2012-09-16 11:10 . 2012-06-29 00:52 12317184 c:\windows\SysWOW64\mshtml.dll
    + 2009-07-14 02:34 . 2012-09-16 11:30 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat
    - 2009-07-14 02:34 . 2012-06-21 09:22 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat
    + 2012-09-16 11:06 . 2012-06-09 05:43 14172672 c:\windows\system32\shell32.dll
    - 2012-02-16 23:47 . 2012-01-04 10:44 14172672 c:\windows\system32\shell32.dll
    + 2012-09-16 11:10 . 2012-06-29 04:55 17809920 c:\windows\system32\mshtml.dll
    + 2012-09-16 11:10 . 2012-06-29 04:09 10925568 c:\windows\system32\ieframe.dll
    + 2009-07-14 04:54 . 2012-09-16 11:49 16187392 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-07-14 04:54 . 2012-09-14 08:29 16187392 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 94208 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 94208 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 94208 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}]
    @="{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}"
    [HKEY_CLASSES_ROOT\CLSID\{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}]
    2009-10-14 19:41 150872 ----a-w- c:\windows\SysWOW64\pfmshx_359.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Netvue"="c:\program files (x86)\Netvue\Netvue.exe" [2006-12-13 528384]
    "PeerBlock"="c:\program files\PeerBlock\peerblock.exe" [2010-11-07 2646128]
    "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
    "MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
    "SteelSeries Engine"="c:\program files\SteelSeries Engine\SteelSeriesEngine.exe" [2012-08-06 236032]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-17 98304]
    "MGSysCtrl"="c:\program files (x86)\System Control Manager\MGSysCtrl.exe" [2010-01-08 2396160]
    "IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-03 284696]
    "VirtualCloneDrive"="c:\program files (x86)\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
    "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
    "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
    .
    c:\users\Don\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Netvue.exe - Shortcut.lnk - c:\program files (x86)\Netvue\Netvue.exe [2006-12-13 528384]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-15 158856]
    R3 BTMCOM;Bluetooth Serial Port;c:\windows\System32\Drivers\btmcom.sys [2009-12-14 51200]
    R3 BTMHID;BTMHID;c:\windows\system32\DRIVERS\btmhid.sys [2010-01-13 34048]
    R3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\Drivers\btmusb.sys [2010-01-26 461312]
    R3 driverhardwarev2x64;driverhardwarev2x64;c:\program files\ma-config.com\Drivers\driverhardwarev2x64.sys [2010-08-30 15872]
    R3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2009-05-20 70656]
    R3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\DRIVERS\enecirhid.sys [2009-05-19 14848]
    R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\DRIVERS\enecirhidma.sys [2008-04-24 6656]
    R3 fspad_xp64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_xp64;c:\windows\system32\DRIVERS\fspad_xp64.sys [2010-02-09 53248]
    R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\x64\maconfservice.exe [2011-05-01 420864]
    R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-11 114144]
    R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-11-02 340240]
    R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-01-13 7675392]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
    R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2009-09-02 225280]
    R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
    R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
    R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-21 1255736]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-07-23 254528]
    S1 pfmfs_359;pfmfs_359;c:\windows\system32\Drivers\pfmfs_359.sys [2009-10-14 241880]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
    S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-02-24 191616]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-12-17 202752]
    S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe [2009-12-21 637192]
    S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]
    S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\System Control Manager\MSIService.exe [2009-07-09 160768]
    S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-08-06 13784]
    S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-18 2320920]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2009-12-17 6177792]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2009-12-17 156160]
    S3 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [2010-01-25 4154120]
    S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe [2010-01-26 1029896]
    S3 busenum;SteelBusSvc;c:\windows\system32\DRIVERS\SteelBus64.sys [2012-05-22 112128]
    S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-03-16 1028096]
    S3 fspad_wlh64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_wlh64;c:\windows\system32\DRIVERS\fspad_wlh64.sys [2010-02-09 53248]
    S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-12-18 56344]
    S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-10 158720]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-01-07 271872]
    S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [2009-12-17 7773856]
    S3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2010-11-09 8500736]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-21 413800]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-09-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3757606886-878825452-795579271-1000Core.job
    - c:\users\Don\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-27 19:29]
    .
    2012-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3757606886-878825452-795579271-1000UA.job
    - c:\users\Don\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-27 19:29]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 97792 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 97792 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 97792 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2012-06-30 04:19 97792 ----a-w- c:\users\Don\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}]
    @="{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}"
    [HKEY_CLASSES_ROOT\CLSID\{4BBAAAE9-0004-4000-9AA5-1BBD98C86E9B}]
    2009-10-14 19:41 170840 ----a-w- c:\windows\System32\pfmshx_359.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-12-17 166424]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-12-17 390168]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2009-12-17 409624]
    "BTMTrayAgent"="c:\program files\Motorola\Bluetooth\btmshell.dll" [2010-02-13 20433160]
    "fspuip"="c:\program files (x86)\FSP\fspuip.exe" [BU]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 112512]
    "AutoKMS"="c:\windows\AutoKMS.exe" [2011-01-30 615936]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-18 11775592]
    "IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-11-02 1933584]
    "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = https://mail.google.com/mail/?shva=1#inbox
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
    Trusted Zone: msi.com
    TCP: DhcpNameServer = 192.168.1.1
    FF - ProfilePath - c:\users\Don\AppData\Roaming\Mozilla\Firefox\Profiles\oo7zp5fc.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig
    FF - prefs.js: network.proxy.ftp - 194.254.103.248
    FF - prefs.js: network.proxy.ftp_port - 3128
    FF - prefs.js: network.proxy.http_port - 3128
    FF - prefs.js: network.proxy.socks - 194.254.103.248
    FF - prefs.js: network.proxy.socks_port - 3128
    FF - prefs.js: network.proxy.ssl - 194.254.103.248
    FF - prefs.js: network.proxy.ssl_port - 3128
    FF - prefs.js: network.proxy.type - 4
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2012-09-16 14:13:00
    ComboFix-quarantined-files.txt 2012-09-16 12:13
    ComboFix2.txt 2012-09-14 18:47
    .
    Pre-Run: 34,164,252,672 bytes free
    Post-Run: 34,072,973,312 bytes free
    .
    - - End Of File - - D5555A4BAD91A42FB06BD77A8D599167
  20. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    ESET Online Scan

    Please run a free online scan with the ESET Online Scanner
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • When asked, allow the ActiveX control to install, or it will ask to download an installer. Please do so an install it.
    • Click Start or wait for the scanner to load.
    • Make sure that the options Remove found threats and the option Scan unwanted applications are checked.
    • Click Scan (This scan can take several hours, so please be patient)
    • Once the scan is completed, there are a couple of things to keep in mind:
    • 1. If NO threats were found, allow the scanner to Uninstall on close and then close the Window.
    • 2. If threats WERE detected, click on List of Threats Found, Export to Text File...save it as ESET-Scan-Log.txt. Click the back button/link, put a checkmark to Uninstall Application on Close and then close the window.
    • Open the logfile from wherever you saved it
    • Copy and paste the contents in your next reply.


    Any more issues?

    We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here.

    Many of the things to note for us would be:

    • Slow computer
    • Error messages
    • Fake antivirus alerts or the icon in the system tray
    • svchost.exe running at 100%
    • System crashes or blue screen of death
  21. Don37

    Don37 TS Rookie Topic Starter

    Hey,

    Some threats were found with ESET:

    C:\FRST\Quarantine\services.exe Win64/Patched.B.Gen trojan deleted - quarantined
    C:\FRST\Quarantine\{5602a9de-1529-407a-030d-e41718b23532}\U\80000000.@ Win64/Sirefef.AL trojan cleaned by deleting - quarantined
    C:\FRST\Quarantine\{5602a9de-1529-407a-030d-e41718b23532}\{5602a9de-1529-407a-030d-e41718b23532}\n Win64/Sirefef.W trojan cleaned by deleting - quarantined
    C:\Windows\AutoKMS.exe Win32/HackKMS.A application cleaned by deleting - quarantined
    D:\Sites Web\Backup Finance-Actu\Ressources\WP Theme Finance\financeevolution1.1\financeevolution\footer.php PHP/Obfuscated.F application cleaned by deleting - quarantined
    D:\Sites Web\Backup Finance-Actu\Ressources\WP Theme Finance\smack-finance\footer.php PHP/Obfuscated.F application cleaned by deleting - quarantined
  22. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Those are low risk items. No biggie. If there are no more issues, then we shall finish up!

    Clean up System Restore

    Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

    To manually create a new Restore Point
    • Go to Control Panel and select System and Maintenance
    • Select System
    • On the left select Advanced System Settings and accept the warning if you get one
    • Select System Protection Tab
    • Select Create at the bottom
    • Type in a name I.e. Clean
    • Select Create
    Now we can purge the infected ones
    • Go back to the System and Maintenance page
    • Select Performance Information and Tools
    • On the left select Open Disk Cleanup
    • Select Files from all users and accept the warning if you get one
    • In the drop down box select your main drive I.e. C
    • For a few moments the system will make some calculations:
      [​IMG]
    • Select the More Options tab
      [​IMG]
    • In the System Restore and Shadow Backups select Clean up
      [​IMG]
    • Select Delete on the pop up
    • Select OK
    • Select Delete

    Run OTC to remove our tools

    To remove all of the tools we used and the files and folders they created, please do the following:
    Please download OTC.exe by OldTimer:
    • Save it to your Desktop.
    • Double click OTC.exe.
    • Click the CleanUp! button.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes.
    Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

    Purge old temporary files

    Download CCleaner Slim and save it to your Desktop - Alternate download link

    When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
    Follow the prompts to install the program.

    * Double-click the CCleaner shortcut on the desktop to start the program.
    * Click on the Options block on the left, then choose Cookies.
    * Under Cookies to Delete, highlight any cookies you would like to retain permanently
    * Click the right arrow > to move them to the Cookies to Keep window.
    * Go into Options > Advanced & uncheck Only delete files in Windows Temp folders older than 48 hours
    * Click Cleaner on the left then Run Cleaner on the right to run the program.
    * Important: Make sure that ALL browser windows are closed before selecting Run Cleaner

    Caution: Only use the Registry feature if you are very familiar with the registry.
    Always back up your registry before making any changes. Exit CCleaner after it has completed it's process.

    Security Check

    Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.
    • Save it to your Desktop.
    • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  23. Don37

    Don37 TS Rookie Topic Starter

    Hi DMJ,

    I followed all your last steps, and here is the last log below

    I am definitely not very knowledgeable on the topic, but I thought the sirefef was a serious threat (cf the ESET log in my previous message). I read on the internet it was the one causing weird music starting and stopping suddenly on my computer, which is pretty scary. Has it been removed now? Or do you think it's not important ?

    Thanks again, Security Check log below

    Results of screen317's Security Check version 0.99.51
    Windows 7 Service Pack 1 x64 (UAC is enabled)
    Internet Explorer 9
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    WMI entry may not exist for antivirus; attempting automatic update.
    `````````Anti-malware/Other Utilities Check:`````````
    Malwarebytes Anti-Malware version 1.62.0.1300
    Java(TM) 6 Update 35
    Java version out of Date!
    Adobe Flash Player 10 Flash Player out of Date!
    Adobe Reader 9 Adobe Reader out of Date!
    Mozilla Firefox (15.0.1)
    Google Chrome 21.0.1180.83
    Google Chrome 21.0.1180.89
    ````````Process Check: objlist.exe by Laurent````````
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: 0%
    ````````````````````End of Log``````````````````````
  24. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    It's very much gone, believe me.

    Adobe Reader Update!

    Please download the newest version of Adobe Acrobat Reader from Adobe.com

    Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
    Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
    Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

    Once old versions are gone, please install the newest version.

    Java Update!

    Please download the newest version of Java from Java.com.

    Before installing: it is important to remove older versions of Java since it does not do so automatically and old versions still leave you vulnerable.
    Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
    Search in the list for all previous installed versions of Java. (J2SE Runtime Environment). Please uninstall/remove each of them.

    Once old versions are gone, please install the newest version.

    Read more about Java exploit problems

    Adobe Flash Player Update!

    Please download the newest version of Adobe Flash Player from Adobe.com

    Before installing: it is important to remove older versions of Flash Player since it does not do so automatically and old versions still leave you vulnerable.
    Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
    Search in the list for all previous installed versions of Adobe Flash Player. Uninstall/Remove each of them.

    Once old versions are gone, please install the newest version.

    Personal Tips on Preventing Malware

    See this page for more info about malware and prevention.

    Read more about "FAQ: How did Sirefef or ZeroAccess Infect You?"

    Any other questions before I mark this topic solved?
  25. Don37

    Don37 TS Rookie Topic Starter

    Hi DMJ, I followed your last instructions and did a last malwaresbytes scan afterwards, I was glad to see all the threats were gone.
    Thanks for the article about sirefef too, very interesting.

    So thank you very much for all your help! I really appreciate the time you have spent to help me.

    Please mark this topic as solved, and check your PM (about donation :)
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.