TechSpot

Removed system check and followed your steps here are reports

By debym
Mar 4, 2012
  1. I followed the posted steps here are the logs, thank you very much for the help.

    Malwarebytes Anti-Malware 1.60.1.1000
    www.malwarebytes.org

    Database version: v2012.01.13.04

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 8.0.7601.17514
    Owner :: OWNER-PC [administrator]

    3/3/2012 7:19:17 PM
    mbam-log-2012-03-03 (19-19-17).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 267667
    Time elapsed: 5 minute(s), 36 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 20
    HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{66D8FBA6-D90F-40A9-AC55-84896F79CA69} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 1
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.

    Folders Detected: 6
    C:\Program Files (x86)\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Files Detected: 4
    C:\Users\Owner\Downloads\Webfetti.exe (Adware.FunWeb) -> Quarantined and deleted successfully.
    C:\Users\Owner\Downloads\ZwinkySetup2.3.69.8.ZJfox000(2).exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Users\Owner\Downloads\ZwinkySetup2.3.69.8.ZJfox000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files (x86)\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    (end)
     
  2. debym

    debym TS Rookie Topic Starter Posts: 23

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit scan 2012-03-03 21:04:31
    Windows 6.1.7601 Service Pack 1
    Running: oghxiv29.exe


    ---- Services - GMER 1.0.15 ----

    Service system32\DRIVERS\pwipf6.sys (*** hidden *** ) [SYSTEM] pwipf6 <-- ROOTKIT !!!

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6@Type 1
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6@Start 1
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6@ErrorControl 1
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6@Tag 27
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6@ImagePath system32\DRIVERS\pwipf6.sys
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6@DisplayName Privacyware Filter Driver
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6@Group NDIS
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6@Description Privacyware Filter Driver
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6@NdisMajorVersion 6
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6@NdisMinorVersion 0
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Instances
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Instances@DefaultInstance pwipf6
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Instances\pwipf6
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Instances\pwipf6@Altitude 323800
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Instances\pwipf6@Flags 0
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters@DefaultFilterSettings 1
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{2CAA64ED-BAA3-4473-B637-DEC65A14C8AA}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{2CAA64ED-BAA3-4473-B637-DEC65A14C8AA}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{5BF54C7E-91DA-457D-80BF-333677D7E316}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{5BF54C7E-91DA-457D-80BF-333677D7E316}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{856ED3C4-B8B5-470E-B3C2-641E5FDB459F}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{856ED3C4-B8B5-470E-B3C2-641E5FDB459F}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{8A918BBD-5D51-45C6-9872-785B10CB5AFD}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{8A918BBD-5D51-45C6-9872-785B10CB5AFD}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{941F3CFC-23B8-4D2F-988C-645568138CF9}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{941F3CFC-23B8-4D2F-988C-645568138CF9}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{9A399D81-2EAD-4F23-BCDD-637FC13DCD51}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{9A399D81-2EAD-4F23-BCDD-637FC13DCD51}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{AC48E262-04F8-4DE7-AA66-536313088B58}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{AC48E262-04F8-4DE7-AA66-536313088B58}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{BCCA8953-4F1B-4012-A9A5-72F7161A8F6A}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\Adapters\{BCCA8953-4F1B-4012-A9A5-72F7161A8F6A}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{2CAA64ED-BAA3-4473-B637-DEC65A14C8AA}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{2CAA64ED-BAA3-4473-B637-DEC65A14C8AA}@InterfaceGuid 0xF8 0xE3 0xB5 0xE6 ...
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{5BF54C7E-91DA-457D-80BF-333677D7E316}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{5BF54C7E-91DA-457D-80BF-333677D7E316}@InterfaceGuid 0xF4 0xE3 0xB5 0xE6 ...
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{856ED3C4-B8B5-470E-B3C2-641E5FDB459F}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{856ED3C4-B8B5-470E-B3C2-641E5FDB459F}@InterfaceGuid 0xF7 0xE3 0xB5 0xE6 ...
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{8A918BBD-5D51-45C6-9872-785B10CB5AFD}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{8A918BBD-5D51-45C6-9872-785B10CB5AFD}@InterfaceGuid 0xF6 0xE3 0xB5 0xE6 ...
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{941F3CFC-23B8-4D2F-988C-645568138CF9}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{941F3CFC-23B8-4D2F-988C-645568138CF9}@InterfaceGuid 0xF9 0xE3 0xB5 0xE6 ...
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{9A399D81-2EAD-4F23-BCDD-637FC13DCD51}
    Reg HKLM\SYSTEM\CurrentControlSet\services\pwipf6\Parameters\NdisAdapters\{9A399D81-2EAD-4F23-BCDD-637FC13DCD51}@InterfaceGuid 0xF5 0xE3 0xB5 0xE6 ...
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6@Type 1
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6@Start 1
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6@ErrorControl 1
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6@Tag 27
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6@ImagePath system32\DRIVERS\pwipf6.sys
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6@DisplayName Privacyware Filter Driver
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6@Group NDIS
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6@Description Privacyware Filter Driver
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6@NdisMajorVersion 6
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6@NdisMinorVersion 0
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Instances (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Instances@DefaultInstance pwipf6
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Instances\pwipf6 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Instances\pwipf6@Altitude 323800
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Instances\pwipf6@Flags 0
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters@DefaultFilterSettings 1
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{2CAA64ED-BAA3-4473-B637-DEC65A14C8AA} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{2CAA64ED-BAA3-4473-B637-DEC65A14C8AA}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{5BF54C7E-91DA-457D-80BF-333677D7E316} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{5BF54C7E-91DA-457D-80BF-333677D7E316}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{856ED3C4-B8B5-470E-B3C2-641E5FDB459F} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{856ED3C4-B8B5-470E-B3C2-641E5FDB459F}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{8A918BBD-5D51-45C6-9872-785B10CB5AFD} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{8A918BBD-5D51-45C6-9872-785B10CB5AFD}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{941F3CFC-23B8-4D2F-988C-645568138CF9} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{941F3CFC-23B8-4D2F-988C-645568138CF9}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{9A399D81-2EAD-4F23-BCDD-637FC13DCD51} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{9A399D81-2EAD-4F23-BCDD-637FC13DCD51}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{AC48E262-04F8-4DE7-AA66-536313088B58} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{AC48E262-04F8-4DE7-AA66-536313088B58}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{BCCA8953-4F1B-4012-A9A5-72F7161A8F6A} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\Adapters\{BCCA8953-4F1B-4012-A9A5-72F7161A8F6A}\{5CBF81BD-5055-47CD-9055-A76B2B4E3697}-0000 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{2CAA64ED-BAA3-4473-B637-DEC65A14C8AA} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{2CAA64ED-BAA3-4473-B637-DEC65A14C8AA}@InterfaceGuid 0xF8 0xE3 0xB5 0xE6 ...
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{5BF54C7E-91DA-457D-80BF-333677D7E316} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{5BF54C7E-91DA-457D-80BF-333677D7E316}@InterfaceGuid 0xF4 0xE3 0xB5 0xE6 ...
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{856ED3C4-B8B5-470E-B3C2-641E5FDB459F} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{856ED3C4-B8B5-470E-B3C2-641E5FDB459F}@InterfaceGuid 0xF7 0xE3 0xB5 0xE6 ...
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{8A918BBD-5D51-45C6-9872-785B10CB5AFD} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{8A918BBD-5D51-45C6-9872-785B10CB5AFD}@InterfaceGuid 0xF6 0xE3 0xB5 0xE6 ...
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{941F3CFC-23B8-4D2F-988C-645568138CF9} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{941F3CFC-23B8-4D2F-988C-645568138CF9}@InterfaceGuid 0xF9 0xE3 0xB5 0xE6 ...
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{9A399D81-2EAD-4F23-BCDD-637FC13DCD51} (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\pwipf6\Parameters\NdisAdapters\{9A399D81-2EAD-4F23-BCDD-637FC13DCD51}@InterfaceGuid 0xF5 0xE3 0xB5 0xE6 ...

    ---- EOF - GMER 1.0.15 ----

    .
     
  3. debym

    debym TS Rookie Topic Starter Posts: 23

    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_20
    Run by Owner at 14:00:18 on 2012-03-04
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2812.1298 [GMT -5:00]
    .
    AV: Webroot Internet Security Essentials *Enabled/Updated* {53211D91-0C31-95F2-E3A5-7661FB22889E}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Webroot Internet Security Essentials *Enabled/Updated* {E840FC75-2A0B-9A7C-D915-4D1380A5C223}
    FW: Webroot Internet Security Essentials *Enabled* {6B1A9CB4-465E-94AA-C8FA-DF5405F1CFE5}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\atieclxx.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Windows\SysWOW64\svchost.exe -k Akamai
    C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
    C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
    C:\Program Files\Common Files\Motive\McciCMService.exe
    C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
    C:\Program Files\Acer\Acer Updater\UpdaterService.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\PROGRA~2\Webroot\Security\Current\plugins\cleanup\WRCLEA~1.EXE
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files (x86)\Webroot\Security\current\plugins\antimalware\AEI.exe
    C:\Program Files (x86)\Webroot\Security\current\plugins\antimalware\SSU.EXE
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
    C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files (x86)\Upromise\dca-ua.exe
    C:\Program Files (x86)\Upromise\UpromiseTray.exe
    C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
    C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
    C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
    C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
    C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files (x86)\Launch Manager\LManager.exe
    C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Windows\system32\DllHost.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files (x86)\Webroot\Security\current\plugins\sync\WRSyncManager.exe
    C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11f_ActiveX.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.yahoo.com/?ilc=5
    uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360210d505l0424z135t4452x25n
    uSearch Page =
    uSearch Bar =
    mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360210d505l0424z135t4452x25n
    mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360210d505l0424z135t4452x25n
    mSearchAssistant =
    uURLSearchHooks: H - No File
    uURLSearchHooks: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
    uURLSearchHooks: H - No File
    uURLSearchHooks: FCToolbarURLSearchHook Class: {b843a48a-b70f-45cd-a15a-6c2b30c2c11e} - C:\Program Files (x86)\Gamers Unite! Snag Bar\Helper.dll
    mURLSearchHooks: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
    mWinlogon: Userinit=userinit.exe,
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Gamers Unite! Snag Bar BHO: {26a7ca19-7d58-411d-b2da-f1b0324cbffc} - C:\Program Files (x86)\Gamers Unite! Snag Bar\Toolbar.dll
    BHO: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: WebrootBHO Class: {d93ec24d-8741-4d41-b83d-a5793b998416} - C:\Program Files (x86)\Webroot\Security\current\plugins\browserextension\WebrootBHO.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre1.6.0_20\bin\jp2ssv.dll
    BHO: Webroot Browser Helper Object: {e08861fe-8847-4b2a-8ec2-08edb20e4020} - C:\Program Files (x86)\Webroot\Security\current\products\WISE\toolbar\LPBar.dll
    BHO: Upromise TurboSaver: {edc0f17f-f4b7-47e4-b73e-887faeb376fa} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    TB: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
    TB: Webroot Toolbar: {d84a64a0-f2b2-4975-b264-3a3bce8d57d6} - C:\Program Files (x86)\Webroot\Security\current\products\WISE\toolbar\LPBar.dll
    TB: Gamers Unite! Snag Bar: {25515a79-c1c7-4b97-97f8-31a711694487} - C:\Program Files (x86)\Gamers Unite! Snag Bar\Toolbar.dll
    TB: Upromise TurboSaver: {06e58e5e-f8cb-4049-991e-a41c03bd419e} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    TB: {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No File
    TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
    uRun: [Upromise Update] "C:\Program Files (x86)\Upromise\dca-ua.exe"
    uRun: [Upromise Tray] "C:\Program Files (x86)\Upromise\UpromiseTray.exe"
    mRun: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe"
    mRun: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
    mRun: [PlayMovie] "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
    mRun: [LManager] "C:\Program Files (x86)\Launch Manager\LManager.exe"
    mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [Acer Assist Launcher] "C:\Program Files (x86)\Acer\Acer Assist\launcher.exe"
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start
    mRun: [WebrootTrayApp] "C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe"
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    dRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10p_ActiveX.exe -update activex
    StartupFolder: C:\Users\Owner\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
    IE: {06E58E5E-F8CB-4049-991E-A41C03BD419E} - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
    Trusted Zone: motive.com\pattta.att
    Trusted Zone: motive.com\patttbc.att
    DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{856ED3C4-B8B5-470E-B3C2-641E5FDB459F} : DhcpNameServer = 75.75.75.75 75.75.76.76
    TCP: Interfaces\{8A918BBD-5D51-45C6-9872-785B10CB5AFD} : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{AC48E262-04F8-4DE7-AA66-536313088B58} : DhcpNameServer = 192.168.1.254 192.168.1.254
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO-X64: 0x1 - No File
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: Gamers Unite! Snag Bar BHO: {26A7CA19-7D58-411D-B2DA-F1B0324CBFFC} - C:\Program Files (x86)\Gamers Unite! Snag Bar\Toolbar.dll
    BHO-X64: FCTBPos00Pos - No File
    BHO-X64: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
    BHO-X64: Zynga - No File
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: WebrootBHO Class: {D93EC24D-8741-4D41-B83D-A5793B998416} - C:\Program Files (x86)\Webroot\Security\current\plugins\browserextension\WebrootBHO.dll
    BHO-X64: WRCommonBHO - No File
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.6.0_20\bin\jp2ssv.dll
    BHO-X64: Webroot Browser Helper Object: {e08861fe-8847-4b2a-8ec2-08edb20e4020} - C:\Program Files (x86)\Webroot\Security\current\products\WISE\toolbar\LPBar.dll
    BHO-X64: Webroot Browser Helper Object - No File
    BHO-X64: Upromise TurboSaver: {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    BHO-X64: ToolHelper - No File
    TB-X64: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
    TB-X64: Webroot Toolbar: {d84a64a0-f2b2-4975-b264-3a3bce8d57d6} - C:\Program Files (x86)\Webroot\Security\current\products\WISE\toolbar\LPBar.dll
    TB-X64: Gamers Unite! Snag Bar: {25515A79-C1C7-4B97-97F8-31A711694487} - C:\Program Files (x86)\Gamers Unite! Snag Bar\Toolbar.dll
    TB-X64: Upromise TurboSaver: {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    TB-X64: {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No File
    TB-X64: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
    mRun-x64: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe"
    mRun-x64: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
    mRun-x64: [PlayMovie] "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
    mRun-x64: [LManager] "C:\Program Files (x86)\Launch Manager\LManager.exe"
    mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun-x64: [Acer Assist Launcher] "C:\Program Files (x86)\Acer\Acer Assist\launcher.exe"
    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun-x64: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start
    mRun-x64: [WebrootTrayApp] "C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe"
    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\
    FF - prefs.js: browser.startup.homepage - |hxxp://www.yahoo.com/
    FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
    FF - component: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\extensions\{7a2cadc6-0db8-43bb-a6e4-9d8bda6a254f}\platform\WINNT_x86-msvc\components\wrxpcom.dll
    FF - component: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCoreGecko19.dll
    FF - component: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCoreGecko5.dll
    FF - component: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCoreGecko6.dll
    FF - component: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCoreGecko7.dll
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\Java\jre1.6.0_20\bin\new_plugin\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Java\jre1.6.0_20\bin\new_plugin\npjp2.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\NPcol400.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll
    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    ============= SERVICES / DRIVERS ===============
    .
    R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?]
    R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?]
    R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?]
    R1 pwipf6;Privacyware Filter Driver;C:\Windows\system32\DRIVERS\pwipf6.sys --> C:\Windows\system32\DRIVERS\pwipf6.sys [?]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
    R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
    R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 20992]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
    R2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2009-11-5 844320]
    R2 Greg_Service;GRegService;C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [2009-8-28 1150496]
    R2 McciCMService64;McciCMService64;C:\Program Files\Common Files\Motive\McciCMService.exe [2010-5-14 517632]
    R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-6-17 144640]
    R2 ssfmonm;ssfmonm;C:\Windows\system32\DRIVERS\ssfmonm.sys --> C:\Windows\system32\DRIVERS\ssfmonm.sys [?]
    R2 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2009-11-5 240160]
    R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;C:\Program Files (x86)\Webroot\Security\Current\plugins\antimalware\AEI.exe [2011-3-17 3997912]
    R2 WRConsumerService;Webroot Client Service;C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe [2011-11-3 3386840]
    R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]
    R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]
    R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S3 MWLService;MyWinLocker Service;C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe [2009-9-10 305448]
    S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-6-17 50432]
    S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
    S3 rt70x64;RT2500 USB Wireless LAN Driver for Vista;C:\Windows\system32\DRIVERS\netr7064.sys --> C:\Windows\system32\DRIVERS\netr7064.sys [?]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    S3 wrssweep;Webroots Volume Access Driver;C:\PROGRA~2\Webroot\Security\Current\plugins\cleanup\wrssweep.sys [2011-3-17 26040]
    .
    =============== Created Last 30 ================
    .
    2012-03-03 22:03:36 -------- d-----w- C:\Users\Owner\AppData\Roaming\Malwarebytes
    2012-03-03 22:03:27 -------- d-----w- C:\ProgramData\Malwarebytes
    2012-03-03 22:03:26 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2012-03-03 22:03:26 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2012-03-03 09:42:54 359936 ----a-w- C:\ProgramData\VDZJyhhlMdCIFU.exe
    2012-03-03 05:08:12 -------- d-----w- C:\Windows\SysWow64\??????????›???????????
    2012-03-03 05:07:50 -------- d-----w- C:\Windows\SysWow64\??????????›???????????
    2012-03-03 05:07:29 -------- d-----w- C:\Windows\SysWow64\??????????›???????????
    2012-03-03 05:07:07 -------- d-----w- C:\Windows\SysWow64\??????????›???????????
    2012-03-03 05:06:45 -------- d-----w- C:\Windows\SysWow64\?????????‰›???????????
    2012-03-03 05:06:11 -------- d-----w- C:\Windows\SysWow64\??????????›???????????
    2012-03-03 05:05:49 -------- d-----w- C:\Windows\SysWow64\??????????›???????????
    2012-03-03 05:05:28 -------- d-----w- C:\Windows\SysWow64\??????????›???????????
    2012-03-03 05:05:06 -------- d-----w- C:\Windows\SysWow64\??????????›???????????
    2012-03-03 05:04:44 -------- d-----w- C:\Windows\SysWow64\?????????‹›???????????
    2012-03-03 05:04:23 -------- d-----w- C:\Windows\SysWow64\??????????›???????????
    2012-03-03 04:59:45 -------- d-----w- C:\Windows\SysWow64\?????????‹›???????????
    2012-03-03 04:59:24 -------- d-----w- C:\Windows\SysWow64\??????????›???????????
    2012-03-03 04:58:42 -------- d-----w- C:\Windows\SysWow64\??????????›???????????
    2012-03-02 20:32:07 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D1A3A14A-EFB0-45A1-AB57-EC0AFCAD9198}\offreg.dll
    2012-03-02 11:50:14 8643640 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D1A3A14A-EFB0-45A1-AB57-EC0AFCAD9198}\mpengine.dll
    2012-02-18 07:24:35 -------- d-s---w- C:\Windows\SysWow64\Microsoft
    2012-02-15 17:46:46 509952 ----a-w- C:\Windows\System32\ntshrui.dll
    2012-02-15 17:46:46 442880 ----a-w- C:\Windows\SysWow64\ntshrui.dll
    2012-02-15 17:46:39 515584 ----a-w- C:\Windows\System32\timedate.cpl
    2012-02-15 17:46:39 478720 ----a-w- C:\Windows\SysWow64\timedate.cpl
    2012-02-15 17:46:32 3145728 ----a-w- C:\Windows\System32\win32k.sys
    2012-02-15 17:46:22 498688 ----a-w- C:\Windows\System32\drivers\afd.sys
    2012-02-15 17:45:16 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll
    2012-02-15 17:45:16 634880 ----a-w- C:\Windows\System32\msvcrt.dll
    2012-02-06 21:59:32 -------- d-----w- C:\Program Files (x86)\Pure Networks
    .
    ==================== Find3M ====================
    .
    2012-02-18 07:11:34 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-01-29 10:10:42 279656 ------w- C:\Windows\System32\MpSigStub.exe
    2011-12-16 08:47:38 1188864 ----a-w- C:\Windows\System32\wininet.dll
    2011-12-16 07:54:22 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
    2011-12-16 06:44:38 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
    2011-12-16 06:09:17 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    .
    ============= FINISH: 14:03:46.47 ===============

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 2/23/2010 10:08:01 PM
    System Uptime: 3/4/2012 10:24:59 AM (4 hours ago)
    .
    Motherboard: Acer | | Aspire 5532
    Processor: AMD Athlon(tm) Processor TF-20 | Socket S1G1 | 1600/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 137 GiB total, 86.056 GiB free.
    D: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    No restore point in system.
    .
    ==== Installed Programs ======================
    .
    Update for Microsoft Office 2007 (KB2508958)
    Acer Arcade Deluxe
    Acer Assist
    Acer ePower Management
    Acer eRecovery Management
    Acer Games
    Acer GridVista
    Acer Registration
    Acer ScreenSaver
    Acer Updater
    Acrobat.com
    Adobe AIR
    Adobe Reader X (10.1.2)
    Airstrike 2 - Gulf Thunder
    Akamai NetSession Interface Service
    AMD USB Filter Driver
    Ancient Spider
    Apple Application Support
    Apple Software Update
    Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
    BitTorrent
    Bubblefish Bob
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    ccc-core-static
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    Compatibility Pack for the 2007 Office system
    Coupon Printer for Windows
    D3DX10
    Dream Vacation Solitaire
    eSobi v2
    Faerie Solitaire
    GameHouse Solitaire Challenge
    Gamers Unite! Snag Bar
    Identity Card
    Java Auto Updater
    Java(TM) 6 Update 20
    Jewel Quest Solitaire 2
    Junk Mail filter update
    Launch Manager
    Malwarebytes Anti-Malware version 1.60.1.1000
    Microsoft Office 2007 Service Pack 3 (SP3)
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office File Validation Add-In
    Microsoft Office Home and Student 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Suite Activation Assistant
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Works
    Mozilla Firefox 9.0.1 (x86 en-US)
    MSVCRT
    MSVCRT_amd64
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 and SOAP Toolkit 3.0
    MyWinLocker
    NTI Backup Now 5
    NTI Backup Now Standard
    NTI Media Maker 8
    OpenOffice.org 3.2
    Pizza Panic
    QuickTime
    Realtek High Definition Audio Driver
    Realtek USB 2.0 Card Reader
    reFX Nexus VSTi RTAS v2.2.0
    SAMSUNG Intelli-studio
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
    Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
    Shape Solitaire
    Smartparts Desktop
    Spyde Solitaire
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Extended (KB2468871)
    Update for Microsoft .NET Framework 4 Extended (KB2533523)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
    Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
    Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    Upromise TurboSaver (remove only)
    Webroot Software
    Welcome Center
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Mail
    Windows Live Messenger
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live Sync
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Zynga Toolbar
    .
    ==== Event Viewer Messages From Past Week ========
    .
    3/4/2012 1:55:30 PM, Error: atikmdag [43029] - Display is not active
    3/3/2012 7:50:58 PM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter
    3/3/2012 5:26:48 PM, Error: Service Control Manager [7034] - The Webroot Client Service service terminated unexpectedly. It has done this 1 time(s).
    3/3/2012 5:23:59 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the DHCP Client service, but this action failed with the following error: An instance of the service is already running.
    3/3/2012 5:21:59 AM, Error: Service Control Manager [7031] - The Windows Event Log service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    3/3/2012 5:21:59 AM, Error: Service Control Manager [7031] - The Windows Audio service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    3/3/2012 5:21:59 AM, Error: Service Control Manager [7031] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
    3/3/2012 5:21:59 AM, Error: Service Control Manager [7031] - The Security Center service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    3/3/2012 5:21:59 AM, Error: Service Control Manager [7031] - The DHCP Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    3/3/2012 5:17:48 PM, Error: Service Control Manager [7023] -
    3/3/2012 5:17:15 PM, Error: Service Control Manager [7022] - The Function Discovery Resource Publication service hung on starting.
    3/3/2012 5:17:15 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: After starting, the service hung in a start-pending state.
    3/3/2012 5:15:53 PM, Error: Service Control Manager [7022] - The SSDP Discovery service hung on starting.
    3/3/2012 5:15:53 PM, Error: Service Control Manager [7001] - The UPnP Device Host service depends on the SSDP Discovery service which failed to start because of the following error: After starting, the service hung in a start-pending state.
    3/3/2012 5:15:53 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
    3/3/2012 5:15:42 PM, Error: Service Control Manager [7022] - The IPsec Policy Agent service hung on starting.
    3/3/2012 5:14:13 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
    3/3/2012 10:02:54 PM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
    3/3/2012 10:00:19 PM, Error: volsnap [14] - The shadow copies of volume C: were aborted because of an IO failure on volume C:.
    3/2/2012 3:41:11 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    3/2/2012 3:40:10 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    3/2/2012 3:39:26 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache mwlPSDFilter mwlPSDNServ mwlPSDVDisk spldr Wanarpv6
    3/2/2012 11:48:11 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    3/2/2012 11:48:09 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    3/2/2012 11:48:09 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    3/2/2012 11:48:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    3/2/2012 11:48:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    3/2/2012 11:47:59 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    3/2/2012 11:47:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    3/2/2012 11:47:46 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache mwlPSDFilter mwlPSDNServ mwlPSDVDisk NetBIOS NetBT nsiproxy Psched pwipf6 rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
    3/2/2012 11:47:11 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    3/2/2012 11:47:11 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    3/2/2012 11:47:11 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    3/2/2012 11:47:11 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    3/2/2012 11:47:11 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    3/2/2012 11:47:11 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
    3/2/2012 11:47:11 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    3/2/2012 11:47:11 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    3/2/2012 11:47:11 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    3/2/2012 11:47:11 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    3/1/2012 2:01:02 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
    .
    ==== End Of File ===========================
     
  4. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ====================================================================

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
  5. debym

    debym TS Rookie Topic Starter Posts: 23

    Thank you for helping, here is the log

    15:54:03.0868 3316 TDSS rootkit removing tool 2.7.18.0 Mar 2 2012 09:40:07
    15:54:05.0881 3316 ============================================================
    15:54:05.0881 3316 Current date / time: 2012/03/04 15:54:05.0881
    15:54:05.0881 3316 SystemInfo:
    15:54:05.0881 3316
    15:54:05.0881 3316 OS Version: 6.1.7601 ServicePack: 1.0
    15:54:05.0881 3316 Product type: Workstation
    15:54:05.0881 3316 ComputerName: OWNER-PC
    15:54:05.0881 3316 UserName: Owner
    15:54:05.0881 3316 Windows directory: C:\Windows
    15:54:05.0881 3316 System windows directory: C:\Windows
    15:54:05.0881 3316 Running under WOW64
    15:54:05.0881 3316 Processor architecture: Intel x64
    15:54:05.0881 3316 Number of processors: 1
    15:54:05.0881 3316 Page size: 0x1000
    15:54:05.0881 3316 Boot type: Normal boot
    15:54:05.0881 3316 ============================================================
    15:54:07.0316 3316 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
    15:54:07.0316 3316 \Device\Harddisk0\DR0:
    15:54:07.0332 3316 MBR used
    15:54:07.0332 3316 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1801F5F, BlocksNum 0x32FCD
    15:54:07.0332 3316 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1834F2C, BlocksNum 0x111E4784
    15:54:07.0363 3316 Initialize success
    15:54:07.0363 3316 ============================================================
    15:54:15.0334 4412 ============================================================
    15:54:15.0334 4412 Scan started
    15:54:15.0334 4412 Mode: Manual;
    15:54:15.0334 4412 ============================================================
    15:54:16.0614 4412 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
    15:54:16.0645 4412 1394ohci - ok
    15:54:16.0801 4412 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
    15:54:16.0801 4412 ACPI - ok
    15:54:16.0910 4412 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
    15:54:16.0910 4412 AcpiPmi - ok
    15:54:17.0285 4412 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
    15:54:17.0300 4412 adp94xx - ok
    15:54:17.0581 4412 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
    15:54:17.0597 4412 adpahci - ok
    15:54:17.0675 4412 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
    15:54:17.0690 4412 adpu320 - ok
    15:54:17.0877 4412 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
    15:54:17.0893 4412 AFD - ok
    15:54:18.0096 4412 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
    15:54:18.0096 4412 agp440 - ok
    15:54:18.0283 4412 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
    15:54:18.0283 4412 aliide - ok
    15:54:18.0517 4412 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
    15:54:18.0533 4412 amdide - ok
    15:54:18.0657 4412 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
    15:54:18.0657 4412 AmdK8 - ok
    15:54:18.0751 4412 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
    15:54:18.0751 4412 AmdPPM - ok
    15:54:18.0845 4412 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
    15:54:18.0845 4412 amdsata - ok
    15:54:18.0891 4412 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
    15:54:18.0891 4412 amdsbs - ok
    15:54:18.0938 4412 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
    15:54:18.0938 4412 amdxata - ok
    15:54:19.0297 4412 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
    15:54:19.0297 4412 AppID - ok
    15:54:19.0562 4412 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
    15:54:19.0562 4412 arc - ok
    15:54:19.0703 4412 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
    15:54:19.0703 4412 arcsas - ok
    15:54:20.0030 4412 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
    15:54:20.0030 4412 AsyncMac - ok
    15:54:20.0171 4412 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
    15:54:20.0171 4412 atapi - ok
    15:54:20.0342 4412 athr (d6cad7e5b05055bb8226bdcb1644da27) C:\Windows\system32\DRIVERS\athrx.sys
    15:54:20.0405 4412 athr - ok
    15:54:20.0810 4412 atikmdag (2db9047aac9d981f59ce06d04d70c4d8) C:\Windows\system32\DRIVERS\atikmdag.sys
    15:54:20.0982 4412 atikmdag - ok
    15:54:21.0216 4412 AtiPcie (7c5d273e29dcc5505469b299c6f29163) C:\Windows\system32\DRIVERS\AtiPcie.sys
    15:54:21.0216 4412 AtiPcie - ok
    15:54:21.0528 4412 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
    15:54:21.0543 4412 b06bdrv - ok
    15:54:21.0949 4412 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
    15:54:21.0949 4412 b57nd60a - ok
    15:54:22.0308 4412 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
    15:54:22.0308 4412 Beep - ok
    15:54:22.0417 4412 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
    15:54:22.0417 4412 blbdrive - ok
    15:54:22.0542 4412 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
    15:54:22.0557 4412 bowser - ok
    15:54:22.0589 4412 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
    15:54:22.0589 4412 BrFiltLo - ok
    15:54:22.0604 4412 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
    15:54:22.0604 4412 BrFiltUp - ok
    15:54:22.0667 4412 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
    15:54:22.0667 4412 Brserid - ok
    15:54:22.0729 4412 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
    15:54:22.0729 4412 BrSerWdm - ok
    15:54:22.0745 4412 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
    15:54:22.0760 4412 BrUsbMdm - ok
    15:54:22.0776 4412 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
    15:54:22.0776 4412 BrUsbSer - ok
    15:54:22.0807 4412 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
    15:54:22.0807 4412 BTHMODEM - ok
    15:54:22.0901 4412 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
    15:54:22.0901 4412 cdfs - ok
    15:54:23.0166 4412 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
    15:54:23.0181 4412 cdrom - ok
    15:54:23.0447 4412 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
    15:54:23.0447 4412 circlass - ok
    15:54:23.0681 4412 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
    15:54:23.0681 4412 CLFS - ok
    15:54:23.0961 4412 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
    15:54:23.0961 4412 CmBatt - ok
    15:54:24.0039 4412 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
    15:54:24.0039 4412 cmdide - ok
    15:54:24.0180 4412 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
    15:54:24.0195 4412 CNG - ok
    15:54:24.0336 4412 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
    15:54:24.0336 4412 Compbatt - ok
    15:54:24.0554 4412 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
    15:54:24.0554 4412 CompositeBus - ok
    15:54:24.0741 4412 cpuz132 - ok
    15:54:24.0944 4412 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
    15:54:24.0944 4412 crcdisk - ok
    15:54:25.0178 4412 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
    15:54:25.0194 4412 DfsC - ok
    15:54:25.0272 4412 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
    15:54:25.0287 4412 discache - ok
    15:54:25.0397 4412 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
    15:54:25.0397 4412 Disk - ok
    15:54:25.0428 4412 DKbFltr - ok
    15:54:25.0506 4412 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
    15:54:25.0506 4412 drmkaud - ok
    15:54:25.0646 4412 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
    15:54:25.0693 4412 DXGKrnl - ok
    15:54:25.0880 4412 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
    15:54:25.0974 4412 ebdrv - ok
    15:54:26.0286 4412 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
    15:54:26.0301 4412 elxstor - ok
    15:54:26.0442 4412 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
    15:54:26.0442 4412 ErrDev - ok
    15:54:26.0567 4412 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
    15:54:26.0598 4412 exfat - ok
    15:54:26.0645 4412 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
    15:54:26.0660 4412 fastfat - ok
    15:54:26.0723 4412 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
    15:54:26.0723 4412 fdc - ok
    15:54:26.0769 4412 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
    15:54:26.0769 4412 FileInfo - ok
    15:54:26.0801 4412 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
    15:54:26.0816 4412 Filetrace - ok
    15:54:26.0847 4412 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
    15:54:26.0847 4412 flpydisk - ok
    15:54:26.0941 4412 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
    15:54:26.0941 4412 FltMgr - ok
    15:54:27.0003 4412 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
    15:54:27.0003 4412 FsDepends - ok
    15:54:27.0035 4412 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
    15:54:27.0035 4412 Fs_Rec - ok
    15:54:27.0113 4412 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
    15:54:27.0113 4412 fvevol - ok
    15:54:27.0159 4412 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
    15:54:27.0159 4412 gagp30kx - ok
    15:54:27.0253 4412 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
    15:54:27.0253 4412 hcw85cir - ok
    15:54:27.0331 4412 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
    15:54:27.0347 4412 HdAudAddService - ok
    15:54:27.0425 4412 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
    15:54:27.0425 4412 HDAudBus - ok
    15:54:27.0456 4412 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
    15:54:27.0456 4412 HidBatt - ok
    15:54:27.0487 4412 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
    15:54:27.0487 4412 HidBth - ok
    15:54:27.0518 4412 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
    15:54:27.0518 4412 HidIr - ok
    15:54:27.0596 4412 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys
    15:54:27.0596 4412 HidUsb - ok
    15:54:27.0674 4412 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
    15:54:27.0674 4412 HpSAMD - ok
    15:54:27.0752 4412 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
    15:54:27.0768 4412 HTTP - ok
    15:54:27.0830 4412 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
    15:54:27.0830 4412 hwpolicy - ok
    15:54:28.0205 4412 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
    15:54:28.0205 4412 i8042prt - ok
    15:54:28.0361 4412 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
    15:54:28.0361 4412 iaStorV - ok
    15:54:29.0094 4412 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
    15:54:29.0109 4412 iirsp - ok
    15:54:29.0265 4412 IntcAzAudAddService (0c3cf4b3bae28e121a1689e3538f8712) C:\Windows\system32\drivers\RTKVHD64.sys
    15:54:29.0328 4412 IntcAzAudAddService - ok
    15:54:29.0390 4412 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
    15:54:29.0390 4412 intelide - ok
    15:54:29.0453 4412 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
    15:54:29.0453 4412 intelppm - ok
    15:54:29.0515 4412 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
    15:54:29.0531 4412 IpFilterDriver - ok
    15:54:29.0593 4412 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
    15:54:29.0593 4412 IPMIDRV - ok
    15:54:29.0624 4412 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
    15:54:29.0624 4412 IPNAT - ok
    15:54:29.0671 4412 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
    15:54:29.0671 4412 IRENUM - ok
    15:54:29.0733 4412 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
    15:54:29.0733 4412 isapnp - ok
    15:54:29.0827 4412 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
    15:54:29.0843 4412 iScsiPrt - ok
    15:54:29.0952 4412 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
    15:54:29.0952 4412 kbdclass - ok
    15:54:30.0217 4412 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
    15:54:30.0248 4412 kbdhid - ok
    15:54:30.0716 4412 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
    15:54:30.0716 4412 KSecDD - ok
    15:54:30.0747 4412 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
    15:54:30.0747 4412 KSecPkg - ok
    15:54:30.0825 4412 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
    15:54:30.0825 4412 ksthunk - ok
    15:54:30.0935 4412 L1C (2377ec4cc3e356655b996f39b43486b6) C:\Windows\system32\DRIVERS\L1C62x64.sys
    15:54:30.0981 4412 L1C - ok
    15:54:31.0091 4412 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
    15:54:31.0091 4412 lltdio - ok
    15:54:31.0153 4412 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
    15:54:31.0169 4412 LSI_FC - ok
    15:54:31.0184 4412 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
    15:54:31.0184 4412 LSI_SAS - ok
    15:54:31.0215 4412 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
    15:54:31.0215 4412 LSI_SAS2 - ok
    15:54:31.0262 4412 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
    15:54:31.0262 4412 LSI_SCSI - ok
    15:54:31.0309 4412 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
    15:54:31.0325 4412 luafv - ok
    15:54:31.0371 4412 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
    15:54:31.0371 4412 megasas - ok
    15:54:31.0418 4412 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
    15:54:31.0418 4412 MegaSR - ok
    15:54:31.0449 4412 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
    15:54:31.0465 4412 Modem - ok
    15:54:31.0512 4412 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
    15:54:31.0512 4412 monitor - ok
    15:54:31.0637 4412 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
    15:54:31.0637 4412 mouclass - ok
    15:54:31.0683 4412 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
    15:54:31.0683 4412 mouhid - ok
    15:54:31.0777 4412 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
    15:54:31.0777 4412 mountmgr - ok
    15:54:31.0824 4412 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
    15:54:31.0824 4412 mpio - ok
    15:54:31.0886 4412 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
    15:54:31.0886 4412 mpsdrv - ok
    15:54:31.0964 4412 MREMP50 - ok
    15:54:32.0120 4412 MREMP50a64 (c2758df79c83a0d12a5599a040ca1818) C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS
    15:54:32.0136 4412 MREMP50a64 - ok
    15:54:32.0167 4412 MREMPR5 - ok
    15:54:32.0183 4412 MRENDIS5 - ok
    15:54:32.0198 4412 MRESP50 - ok
    15:54:32.0261 4412 MRESP50a64 (38bd5b32e0722752be8465d2a6da43d9) C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS
    15:54:32.0261 4412 MRESP50a64 - ok
    15:54:32.0385 4412 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
    15:54:32.0385 4412 MRxDAV - ok
    15:54:32.0495 4412 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
    15:54:32.0495 4412 mrxsmb - ok
    15:54:32.0573 4412 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
    15:54:32.0604 4412 mrxsmb10 - ok
    15:54:32.0635 4412 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
    15:54:32.0651 4412 mrxsmb20 - ok
    15:54:32.0713 4412 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
    15:54:32.0729 4412 msahci - ok
    15:54:32.0807 4412 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
    15:54:32.0807 4412 msdsm - ok
    15:54:32.0869 4412 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
    15:54:32.0869 4412 Msfs - ok
    15:54:32.0931 4412 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
    15:54:32.0931 4412 mshidkmdf - ok
    15:54:32.0994 4412 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
    15:54:32.0994 4412 msisadrv - ok
    15:54:33.0041 4412 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
    15:54:33.0041 4412 MSKSSRV - ok
    15:54:33.0072 4412 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
    15:54:33.0072 4412 MSPCLOCK - ok
    15:54:33.0103 4412 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
    15:54:33.0103 4412 MSPQM - ok
    15:54:33.0165 4412 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
    15:54:33.0181 4412 MsRPC - ok
    15:54:33.0212 4412 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
    15:54:33.0212 4412 mssmbios - ok
    15:54:33.0243 4412 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
    15:54:33.0243 4412 MSTEE - ok
    15:54:33.0275 4412 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
    15:54:33.0275 4412 MTConfig - ok
    15:54:33.0306 4412 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
    15:54:33.0306 4412 Mup - ok
    15:54:33.0368 4412 mwlPSDFilter (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
    15:54:33.0368 4412 mwlPSDFilter - ok
    15:54:33.0399 4412 mwlPSDNServ (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
    15:54:33.0415 4412 mwlPSDNServ - ok
    15:54:33.0446 4412 mwlPSDVDisk (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
    15:54:33.0446 4412 mwlPSDVDisk - ok
    15:54:33.0540 4412 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
    15:54:33.0555 4412 NativeWifiP - ok
    15:54:33.0633 4412 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
    15:54:33.0665 4412 NDIS - ok
    15:54:33.0711 4412 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
    15:54:33.0711 4412 NdisCap - ok
    15:54:33.0758 4412 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
    15:54:33.0758 4412 NdisTapi - ok
    15:54:33.0836 4412 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
    15:54:33.0836 4412 Ndisuio - ok
    15:54:33.0914 4412 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
    15:54:33.0914 4412 NdisWan - ok
    15:54:33.0977 4412 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
    15:54:33.0977 4412 NDProxy - ok
    15:54:34.0039 4412 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
    15:54:34.0055 4412 NetBIOS - ok
    15:54:34.0133 4412 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
    15:54:34.0133 4412 NetBT - ok
    15:54:34.0257 4412 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
    15:54:34.0273 4412 nfrd960 - ok
    15:54:34.0320 4412 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
    15:54:34.0320 4412 Npfs - ok
    15:54:34.0351 4412 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
    15:54:34.0351 4412 nsiproxy - ok
    15:54:34.0476 4412 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
    15:54:34.0523 4412 Ntfs - ok
    15:54:34.0585 4412 NTIDrvr (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys
    15:54:34.0585 4412 NTIDrvr - ok
    15:54:34.0647 4412 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
    15:54:34.0647 4412 Null - ok
    15:54:34.0694 4412 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
    15:54:34.0710 4412 nvraid - ok
    15:54:34.0788 4412 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
    15:54:34.0803 4412 nvstor - ok
    15:54:34.0866 4412 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
    15:54:34.0866 4412 nv_agp - ok
    15:54:34.0928 4412 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
    15:54:34.0928 4412 ohci1394 - ok
    15:54:35.0006 4412 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
    15:54:35.0006 4412 Parport - ok
    15:54:35.0069 4412 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
    15:54:35.0069 4412 partmgr - ok
    15:54:35.0131 4412 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
    15:54:35.0147 4412 pci - ok
    15:54:35.0193 4412 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
    15:54:35.0193 4412 pciide - ok
    15:54:35.0225 4412 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
    15:54:35.0271 4412 pcmcia - ok
    15:54:35.0318 4412 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
    15:54:35.0318 4412 pcw - ok
    15:54:35.0365 4412 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
    15:54:35.0381 4412 PEAUTH - ok
    15:54:35.0537 4412 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
    15:54:35.0537 4412 PptpMiniport - ok
    15:54:35.0568 4412 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
    15:54:35.0568 4412 Processor - ok
    15:54:35.0864 4412 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
    15:54:35.0864 4412 Psched - ok
    15:54:35.0973 4412 pwipf6 (e13e8c164432d9ff0d2d51d3d02ffeae) C:\Windows\system32\DRIVERS\pwipf6.sys
    15:54:35.0973 4412 pwipf6 - ok
    15:54:36.0051 4412 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
    15:54:36.0098 4412 ql2300 - ok
    15:54:36.0129 4412 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
    15:54:36.0129 4412 ql40xx - ok
    15:54:36.0176 4412 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
    15:54:36.0176 4412 QWAVEdrv - ok
    15:54:36.0207 4412 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
    15:54:36.0207 4412 RasAcd - ok
    15:54:36.0270 4412 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
    15:54:36.0270 4412 RasAgileVpn - ok
    15:54:36.0332 4412 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
    15:54:36.0348 4412 Rasl2tp - ok
    15:54:36.0379 4412 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
    15:54:36.0395 4412 RasPppoe - ok
    15:54:36.0426 4412 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
    15:54:36.0441 4412 RasSstp - ok
    15:54:36.0473 4412 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
    15:54:36.0488 4412 rdbss - ok
    15:54:36.0519 4412 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
    15:54:36.0519 4412 rdpbus - ok
    15:54:36.0566 4412 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
    15:54:36.0566 4412 RDPCDD - ok
    15:54:36.0629 4412 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
    15:54:36.0644 4412 RDPENCDD - ok
    15:54:36.0675 4412 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
    15:54:36.0675 4412 RDPREFMP - ok
    15:54:36.0738 4412 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
    15:54:36.0753 4412 RDPWD - ok
    15:54:36.0831 4412 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
    15:54:36.0831 4412 rdyboost - ok
    15:54:36.0925 4412 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
    15:54:36.0925 4412 rspndr - ok
    15:54:37.0003 4412 RSUSBSTOR (e220d85daaa8318736f9b6b92f109146) C:\Windows\system32\Drivers\RtsUStor.sys
    15:54:37.0003 4412 RSUSBSTOR - ok
    15:54:37.0065 4412 rt70x64 (3641e624c8c5d5ea089ae9b5340b5b79) C:\Windows\system32\DRIVERS\netr7064.sys
    15:54:37.0065 4412 rt70x64 - ok
    15:54:37.0112 4412 RtsUIR - ok
    15:54:37.0175 4412 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
    15:54:37.0190 4412 sbp2port - ok
    15:54:37.0253 4412 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
    15:54:37.0253 4412 scfilter - ok
    15:54:37.0331 4412 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
    15:54:37.0331 4412 secdrv - ok
    15:54:37.0393 4412 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
    15:54:37.0409 4412 Serenum - ok
    15:54:37.0440 4412 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
    15:54:37.0440 4412 Serial - ok
    15:54:37.0487 4412 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
    15:54:37.0487 4412 sermouse - ok
    15:54:37.0580 4412 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
    15:54:37.0580 4412 sffdisk - ok
    15:54:37.0643 4412 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
    15:54:37.0643 4412 sffp_mmc - ok
    15:54:37.0674 4412 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
    15:54:37.0689 4412 sffp_sd - ok
    15:54:37.0705 4412 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
    15:54:37.0721 4412 sfloppy - ok
    15:54:37.0783 4412 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
    15:54:37.0783 4412 SiSRaid2 - ok
    15:54:37.0814 4412 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
    15:54:37.0830 4412 SiSRaid4 - ok
    15:54:37.0861 4412 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
    15:54:37.0861 4412 Smb - ok
    15:54:37.0923 4412 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
    15:54:37.0939 4412 spldr - ok
    15:54:38.0017 4412 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
    15:54:38.0033 4412 srv - ok
    15:54:38.0079 4412 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
    15:54:38.0095 4412 srv2 - ok
    15:54:38.0126 4412 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
    15:54:38.0126 4412 srvnet - ok
    15:54:38.0267 4412 ssfmonm (a4c4a1fedfbed04b39efae9f1311ed5e) C:\Windows\system32\DRIVERS\ssfmonm.sys
    15:54:38.0282 4412 ssfmonm - ok
    15:54:38.0313 4412 ssidrv (1cc88f50bd4e6fd6eac5c5365ceb6583) C:\Windows\system32\DRIVERS\ssidrv.sys
    15:54:38.0313 4412 ssidrv - ok
    15:54:38.0376 4412 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
    15:54:38.0376 4412 stexstor - ok
    15:54:38.0438 4412 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
    15:54:38.0438 4412 swenum - ok
    15:54:38.0501 4412 SynTP (bcf305959b53b200ceb2ad25ad22f8a7) C:\Windows\system32\DRIVERS\SynTP.sys
    15:54:38.0516 4412 SynTP - ok
    15:54:38.0657 4412 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
    15:54:38.0750 4412 Tcpip - ok
    15:54:38.0828 4412 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
    15:54:38.0859 4412 TCPIP6 - ok
    15:54:38.0906 4412 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
    15:54:38.0922 4412 tcpipreg - ok
    15:54:38.0969 4412 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
    15:54:38.0969 4412 TDPIPE - ok
    15:54:38.0984 4412 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
    15:54:38.0984 4412 TDTCP - ok
    15:54:39.0062 4412 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
    15:54:39.0062 4412 tdx - ok
    15:54:39.0125 4412 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
    15:54:39.0125 4412 TermDD - ok
    15:54:39.0265 4412 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
    15:54:39.0265 4412 tssecsrv - ok
    15:54:39.0343 4412 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
    15:54:39.0343 4412 TsUsbFlt - ok
    15:54:39.0437 4412 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
    15:54:39.0437 4412 tunnel - ok
    15:54:39.0483 4412 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
    15:54:39.0483 4412 uagp35 - ok
    15:54:39.0530 4412 UBHelper (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys
    15:54:39.0530 4412 UBHelper - ok
    15:54:39.0608 4412 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
    15:54:39.0624 4412 udfs - ok
    15:54:39.0733 4412 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
    15:54:39.0733 4412 uliagpkx - ok
    15:54:39.0795 4412 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
    15:54:39.0795 4412 umbus - ok
    15:54:39.0842 4412 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
    15:54:39.0842 4412 UmPass - ok
    15:54:39.0905 4412 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
    15:54:39.0905 4412 usbccgp - ok
    15:54:39.0936 4412 USBCCID - ok
    15:54:40.0014 4412 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
    15:54:40.0014 4412 usbcir - ok
    15:54:40.0061 4412 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
    15:54:40.0061 4412 usbehci - ok
    15:54:40.0123 4412 usbfilter (6648c6d7323a2ce0c4776c36cefbcb14) C:\Windows\system32\DRIVERS\usbfilter.sys
    15:54:40.0139 4412 usbfilter - ok
    15:54:40.0185 4412 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
    15:54:40.0185 4412 usbhub - ok
    15:54:40.0232 4412 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
    15:54:40.0232 4412 usbohci - ok
    15:54:40.0295 4412 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
    15:54:40.0295 4412 usbprint - ok
    15:54:40.0357 4412 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
    15:54:40.0357 4412 usbscan - ok
    15:54:40.0388 4412 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
    15:54:40.0404 4412 USBSTOR - ok
    15:54:40.0451 4412 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
    15:54:40.0451 4412 usbuhci - ok
    15:54:40.0529 4412 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
    15:54:40.0544 4412 usbvideo - ok
    15:54:40.0607 4412 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
    15:54:40.0607 4412 vdrvroot - ok
    15:54:40.0669 4412 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
    15:54:40.0685 4412 vga - ok
    15:54:40.0731 4412 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
    15:54:40.0731 4412 VgaSave - ok
    15:54:40.0794 4412 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
    15:54:40.0809 4412 vhdmp - ok
    15:54:40.0856 4412 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
    15:54:40.0872 4412 viaide - ok
    15:54:40.0965 4412 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
    15:54:40.0965 4412 volmgr - ok
    15:54:41.0028 4412 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
    15:54:41.0043 4412 volmgrx - ok
    15:54:41.0106 4412 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
    15:54:41.0106 4412 volsnap - ok
    15:54:41.0168 4412 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
    15:54:41.0168 4412 vsmraid - ok
    15:54:41.0215 4412 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
    15:54:41.0215 4412 vwifibus - ok
    15:54:41.0262 4412 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
    15:54:41.0262 4412 vwififlt - ok
    15:54:41.0309 4412 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
    15:54:41.0309 4412 vwifimp - ok
    15:54:41.0355 4412 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
    15:54:41.0371 4412 WacomPen - ok
    15:54:41.0433 4412 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
    15:54:41.0433 4412 WANARP - ok
    15:54:41.0449 4412 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
    15:54:41.0449 4412 Wanarpv6 - ok
    15:54:41.0558 4412 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
    15:54:41.0558 4412 Wd - ok
    15:54:41.0667 4412 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
    15:54:41.0699 4412 Wdf01000 - ok
    15:54:42.0026 4412 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
    15:54:42.0026 4412 WfpLwf - ok
    15:54:42.0104 4412 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
    15:54:42.0104 4412 WIMMount - ok
    15:54:42.0260 4412 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
    15:54:42.0260 4412 WinUsb - ok
    15:54:42.0369 4412 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
    15:54:42.0369 4412 WmiAcpi - ok
    15:54:42.0572 4412 wrssweep (efa6f5a0e72d574659e0711f346940ba) C:\PROGRA~2\Webroot\Security\Current\plugins\cleanup\wrssweep.sys
    15:54:42.0572 4412 wrssweep - ok
    15:54:42.0681 4412 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
    15:54:42.0681 4412 ws2ifsl - ok
    15:54:42.0791 4412 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
    15:54:42.0806 4412 WudfPf - ok
    15:54:42.0869 4412 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
    15:54:42.0869 4412 WUDFRd - ok
    15:54:42.0978 4412 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
    15:54:43.0040 4412 \Device\Harddisk0\DR0 - ok
    15:54:43.0040 4412 Boot (0x1200) (d48777ec071627c478dcf94a40414fb2) \Device\Harddisk0\DR0\Partition0
    15:54:43.0056 4412 \Device\Harddisk0\DR0\Partition0 - ok
    15:54:43.0071 4412 Boot (0x1200) (2fb88b983d5b980e8c663f4baecd9f54) \Device\Harddisk0\DR0\Partition1
    15:54:43.0071 4412 \Device\Harddisk0\DR0\Partition1 - ok
    15:54:43.0071 4412 ============================================================
    15:54:43.0071 4412 Scan finished
    15:54:43.0071 4412 ============================================================
    15:54:43.0103 5380 Detected object count: 0
    15:54:43.0103 5380 Actual detected object count: 0
     
  6. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan.
    On completion of the scan click "Save log", save it to your desktop and post in your next reply.

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    =================================================================

    Download Bootkit Remover to your desktop.

    • Unzip downloaded file to your Desktop.
    • Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on boot_cleaner.exe and click Run As Administrator).
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
     
  7. debym

    debym TS Rookie Topic Starter Posts: 23

    here they both are


    aswMBR version 0.9.9.1649 Copyright(c) 2011 AVAST Software
    Run date: 2012-03-04 16:57:54
    -----------------------------
    16:57:54.314 OS Version: Windows x64 6.1.7601 Service Pack 1
    16:57:54.314 Number of processors: 1 586 0x7C02
    16:57:54.314 ComputerName: OWNER-PC UserName: Owner
    16:58:00.024 Initialize success
    16:59:49.022 AVAST engine defs: 12030401
    16:59:54.934 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
    16:59:54.950 Disk 0 Vendor: WDC_WD1600BEVT-22ZCT0 11.01A11 Size: 152627MB BusType: 11
    16:59:54.965 Disk 0 MBR read successfully
    16:59:54.965 Disk 0 MBR scan
    16:59:54.981 Disk 0 Windows 7 default MBR code
    16:59:54.996 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 12291 MB offset 63
    16:59:55.012 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 101 MB offset 25173855
    16:59:55.043 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 140232 MB offset 25382700
    16:59:55.090 Disk 0 scanning C:\Windows\system32\drivers
    17:00:18.911 Service scanning
    17:00:51.781 Service pwipf6 C:\Windows\system32\DRIVERS\pwipf6.sys **LOCKED**
    17:01:14.510 Modules scanning
    17:01:14.525 Disk 0 trace - called modules:
    17:01:15.103 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
    17:01:15.103 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8003088060]
    17:01:15.118 3 CLASSPNP.SYS[fffff8800161743f] -> nt!IofCallDriver -> [0xfffffa8003089730]
    17:01:15.118 5 ACPI.sys[fffff88000e0e7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8003071060]
    17:01:16.273 AVAST engine scan C:\Windows
    17:01:20.843 AVAST engine scan C:\Windows\system32
    17:09:37.923 AVAST engine scan C:\Windows\system32\drivers
    17:10:08.639 AVAST engine scan C:\Users\Owner
    17:14:42.636 AVAST engine scan C:\ProgramData
    17:15:39.452 File: C:\ProgramData\VDZJyhhlMdCIFU.exe **INFECTED** Win32:FakeSysdef-KM [Trj]
    17:17:15.858 Scan finished successfully
    17:17:30.616 Disk 0 MBR has been saved successfully to "C:\Users\Owner\Desktop\MBR.dat"
    17:17:30.616 The log file has been saved successfully to "C:\Users\Owner\Desktop\aswMBR.txt"


    Bootkit Remover
    (c) 2009 Esage Lab
    www.esagelab.com

    Program version: 1.2.0.1
    OS Version: Microsoft Windows 7 Home Premium Edition Service Pack 1 (build 7601)
    , 64-bit

    System volume is \\.\C:
    \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000003`069e5800
    Boot sector MD5 is: bb4f1627d8b9beda49ac0d010229f3ff

    Size Device Name MBR Status
    --------------------------------------------
    149 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)


    Done;
    Press any key to quit...
     
  8. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
    There are 4 different versions. If one of them won't run then download and try to run the other one.
    Vista and Win7 users need to right click Rkill and choose Run as Administrator
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    * Rkill.com
    * Rkill.scr
    * Rkill.exe
    • Double-click on the Rkill icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.
    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  9. debym

    debym TS Rookie Topic Starter Posts: 23

    OK I got scared after that combofix as nothing would work it deleted ie etc but after restart got it back here is log

    ComboFix 12-03-04.02 - Owner 03/05/2012 7:39.1.1 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2812.1287 [GMT -5:00]
    Running from: c:\users\Owner\Desktop\ComboFix.exe
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    C:\Install.exe
    c:\program files (x86)\Object
    c:\program files (x86)\Object\config.ini
    c:\programdata\VDZJyhhlMdCIFU.exe
    c:\users\Owner\AppData\Roaming\Local
    c:\users\Owner\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
    c:\users\Owner\AppData\Roaming\Local\Temp\DDM\Settings\Post_Install_RB_HiQ_en.divx.ddr
    c:\users\Owner\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
    c:\users\Owner\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Post_Install_RB_HiQ_en.divx
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-02-05 to 2012-03-05 )))))))))))))))))))))))))))))))
    .
    .
    2012-03-05 12:50 . 2012-03-05 12:50 -------- d-----w- c:\users\Katherine\AppData\Local\temp
    2012-03-03 22:03 . 2012-03-03 22:03 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
    2012-03-03 22:03 . 2012-03-03 22:03 -------- d-----w- c:\programdata\Malwarebytes
    2012-03-03 22:03 . 2012-03-03 22:03 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2012-03-03 22:03 . 2011-12-10 20:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-03-03 01:43 . 2012-03-03 01:43 -------- d-----w- c:\users\Erick.Owner-PC\AppData\Local\Microsoft Games
    2012-03-02 11:50 . 2012-02-08 07:13 8643640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D1A3A14A-EFB0-45A1-AB57-EC0AFCAD9198}\mpengine.dll
    2012-02-15 17:46 . 2012-01-04 10:44 509952 ----a-w- c:\windows\system32\ntshrui.dll
    2012-02-15 17:46 . 2011-12-30 06:26 515584 ----a-w- c:\windows\system32\timedate.cpl
    2012-02-15 17:46 . 2012-01-14 04:06 3145728 ----a-w- c:\windows\system32\win32k.sys
    2012-02-15 17:46 . 2011-12-28 03:59 498688 ----a-w- c:\windows\system32\drivers\afd.sys
    2012-02-15 17:45 . 2011-12-16 08:46 634880 ----a-w- c:\windows\system32\msvcrt.dll
    2012-02-06 21:59 . 2012-02-06 21:59 -------- d-----w- c:\program files (x86)\Pure Networks
    2012-02-06 18:00 . 2012-02-06 18:53 -------- d-----w- c:\users\Erick.Owner-PC\AppData\Local\Diagnostics
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-02-18 07:11 . 2011-05-28 11:26 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-01-29 10:10 . 2011-03-21 13:07 279656 ------w- c:\windows\system32\MpSigStub.exe
    2012-01-04 08:58 . 2012-02-15 17:46 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
    2011-12-30 05:27 . 2012-02-15 17:46 478720 ----a-w- c:\windows\SysWow64\timedate.cpl
    2011-12-16 07:54 . 2012-02-15 17:44 981504 ----a-w- c:\windows\SysWow64\wininet.dll
    2011-12-16 07:52 . 2012-02-15 17:45 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll
    2011-12-16 06:09 . 2012-02-15 17:44 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{7b13ec3e-999a-4b70-b9cb-2617b8323822}"= "c:\program files (x86)\Zynga\prxtbZyn2.dll" [2011-05-09 176936]
    "{b843a48a-b70f-45cd-a15a-6c2b30c2c11e}"= "c:\program files (x86)\Gamers Unite! Snag Bar\Helper.dll" [2011-09-04 361472]
    .
    [HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
    .
    [HKEY_CLASSES_ROOT\clsid\{b843a48a-b70f-45cd-a15a-6c2b30c2c11e}]
    [HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1]
    [HKEY_CLASSES_ROOT\TypeLib\{E2A57EE8-6A26-499F-95F8-A96E5C3BE17E}]
    [HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook]
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{26A7CA19-7D58-411D-B2DA-F1B0324CBFFC}]
    2011-09-04 23:26 1572864 ----a-w- c:\program files (x86)\Gamers Unite! Snag Bar\Toolbar.dll
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
    2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\Zynga\prxtbZyn2.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
    "{7b13ec3e-999a-4b70-b9cb-2617b8323822}"= "c:\program files (x86)\Zynga\prxtbZyn2.dll" [2011-05-09 176936]
    "{25515A79-C1C7-4B97-97F8-31A711694487}"= "c:\program files (x86)\Gamers Unite! Snag Bar\Toolbar.dll" [2011-09-04 1572864]
    .
    [HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
    .
    [HKEY_CLASSES_ROOT\clsid\{25515a79-c1c7-4b97-97f8-31a711694487}]
    [HKEY_CLASSES_ROOT\FCTB000062781.IEToolbar.1]
    [HKEY_CLASSES_ROOT\TypeLib\{017D1380-106D-43D5-97DC-81E8A527FD73}]
    [HKEY_CLASSES_ROOT\FCTB000062781.IEToolbar]
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
    [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
    2009-09-10 13:41 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Upromise Update"="c:\program files (x86)\Upromise\dca-ua.exe" [2011-08-04 267584]
    "Upromise Tray"="c:\program files (x86)\Upromise\UpromiseTray.exe" [2011-09-02 279896]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
    "ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-10-29 419112]
    "PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-10-22 181480]
    "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-08-18 1157128]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-30 98304]
    "Acer Assist Launcher"="c:\program files (x86)\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-08-10 421888]
    "WebrootTrayApp"="c:\program files (x86)\Webroot\Security\Current\Framework\WRTray.exe" [2011-11-03 1382984]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
    .
    c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
    @="Service"
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]
    R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
    R3 rt70x64;RT2500 USB Wireless LAN Driver for Vista;c:\windows\system32\DRIVERS\netr7064.sys [x]
    R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    R3 wrssweep;Webroots Volume Access Driver;c:\progra~2\Webroot\Security\Current\plugins\cleanup\wrssweep.sys [2011-03-09 26040]
    S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
    S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
    S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
    S1 pwipf6;Privacyware Filter Driver;c:\windows\system32\DRIVERS\pwipf6.sys [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
    S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-10-29 844320]
    S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]
    S2 McciCMService64;McciCMService64;c:\program files\Common Files\Motive\McciCMService.exe [2009-08-14 517632]
    S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]
    S2 ssfmonm;ssfmonm;c:\windows\system32\DRIVERS\ssfmonm.sys [x]
    S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
    S2 WRConsumerService;Webroot Client Service;c:\program files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe [2011-11-03 3386840]
    S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [x]
    S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
    S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - WS2IFSL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
    Akamai REG_MULTI_SZ Akamai
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
    [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
    2009-09-10 13:44 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
    @="{6B78A880-15CA-468f-8422-A7960AD6FBB9}"
    [HKEY_CLASSES_ROOT\CLSID\{6B78A880-15CA-468f-8422-A7960AD6FBB9}]
    2011-10-29 03:16 404792 ----a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
    @="{4EE7A346-5845-471e-9FAB-002EAF83F8B0}"
    [HKEY_CLASSES_ROOT\CLSID\{4EE7A346-5845-471e-9FAB-002EAF83F8B0}]
    2011-10-29 03:16 404792 ----a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
    @="{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}"
    [HKEY_CLASSES_ROOT\CLSID\{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}]
    2011-10-29 03:16 404792 ----a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
    @="{493FC96E-B938-4924-9B38-C4088E9B8AC2}"
    [HKEY_CLASSES_ROOT\CLSID\{493FC96E-B938-4924-9B38-C4088E9B8AC2}]
    2011-10-29 03:16 404792 ----a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112]
    "Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-10-29 822816]
    "mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-10 349480]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com/?ilc=5
    uLocal Page = c:\windows\system32\blank.htm
    mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360210d505l0424z135t4452x25n
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
    Trusted Zone: motive.com\pattta.att
    Trusted Zone: motive.com\patttbc.att
    TCP: DhcpNameServer = 192.168.0.1
    FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\
    FF - prefs.js: browser.startup.homepage - |hxxp://www.yahoo.com/
    FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    .
    - - - - ORPHANS REMOVED - - - -
    .
    URLSearchHooks-{88c7f2aa-f93f-432c-8f0e-b7d85967a527} - (no file)
    Toolbar-Locked - (no file)
    Wow6432Node-HKLM-Run-DivX Download Manager - c:\program files (x86)\DivX\DivX Plus Web Player\DDmService.exe
    Wow6432Node-HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\SysWOW64\Macromed\Flash\FlashUtil10p_ActiveX.exe
    SafeBoot-mcmscsvc
    SafeBoot-MCODS
    Toolbar-Locked - (no file)
    WebBrowser-{7B13EC3E-999A-4B70-B9CB-2617B8323822} - (no file)
    WebBrowser-{88C7F2AA-F93F-432C-8F0E-B7D85967A527} - (no file)
    WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
    WebBrowser-{25515A79-C1C7-4B97-97F8-31A711694487} - (no file)
    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
    HKLM-Run-ATT-SST_McciTrayApp - c:\program files\ATT-SST\McciTrayApp.exe
    HKLM-Run-ATT-SST_UninstallTracking - c:\users\Owner\AppData\Local\Temp\InstallHelper.exe
    .
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
    "ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,99,65,ac,9d,dc,47,2a,45,a2,e7,4a,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,99,65,ac,9d,dc,47,2a,45,a2,e7,4a,\
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\progra~2\Webroot\Security\Current\plugins\cleanup\WRCLEA~1.EXE
    c:\program files (x86)\Webroot\Security\current\plugins\antimalware\AEI.exe
    c:\program files (x86)\Webroot\Security\current\plugins\antimalware\SSU.EXE
    c:\program files (x86)\Webroot\Security\current\plugins\sync\WRSyncManager.exe
    .
    **************************************************************************
    .
    Completion time: 2012-03-05 08:16:50 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-03-05 13:16
    .
    Pre-Run: 94,582,083,584 bytes free
    Post-Run: 94,359,007,232 bytes free
    .
    - - End Of File - - 64FE08027C311C12CEA45E8259246E1C
     
  10. debym

    debym TS Rookie Topic Starter Posts: 23

    um Windows did an update while i was away an installed IE9 should I be worried as my system is still instructing me to turn back on webroot and firewall. I am on a laptop so I will just disconnect from internet till I get the next instructions, again thank you so much for your help.
     
  11. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Combofix looks good.

    You can turn Webroot on now.

    Any current issues?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\tasks\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  12. debym

    debym TS Rookie Topic Starter Posts: 23

    everything seems to be running good, I have not done anything online as everything was turned off but it seems to be loading great.

    here is 1ST half OTL

    OTL logfile created on: 3/5/2012 5:34:47 PM - Run 1
    OTL by OldTimer - Version 3.2.35.1 Folder = C:\Users\Owner\Downloads
    64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.75 Gb Total Physical Memory | 0.99 Gb Available Physical Memory | 36.06% Memory free
    5.49 Gb Paging File | 3.51 Gb Available in Paging File | 63.87% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 136.95 Gb Total Space | 86.29 Gb Free Space | 63.01% Space Free | Partition Type: NTFS

    Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2012/03/05 17:33:07 | 000,584,704 | ---- | M] (OldTimer Tools) -- C:\Users\Owner\Downloads\OTL.exe
    PRC - [2012/01/03 08:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    PRC - [2011/11/03 08:15:38 | 003,386,840 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe
    PRC - [2011/11/03 08:15:31 | 001,382,984 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe
    PRC - [2011/10/19 10:22:58 | 003,997,912 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files (x86)\Webroot\Security\Current\plugins\antimalware\AEI.exe
    PRC - [2011/10/19 10:22:36 | 000,158,048 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files (x86)\Webroot\Security\Current\plugins\antimalware\SSU.exe
    PRC - [2011/09/02 06:07:52 | 000,107,864 | ---- | M] (Upromise, Inc.) -- C:\Program Files (x86)\Upromise\UpromiseGlobalCache.exe
    PRC - [2011/09/02 06:07:50 | 000,279,896 | ---- | M] (Upromise, Inc.) -- C:\Program Files (x86)\Upromise\UpromiseTray.exe
    PRC - [2011/08/04 13:31:12 | 000,267,584 | ---- | M] (Compete, Inc.) -- C:\Program Files (x86)\Upromise\dca-ua.exe
    PRC - [2011/07/21 15:01:26 | 001,477,304 | ---- | M] (Webroot Software, Inc.) -- C:\Program Files (x86)\Webroot\Security\Current\plugins\cleanup\WRCleanupEngine.exe
    PRC - [2011/03/09 09:09:44 | 015,233,104 | ---- | M] (Sharpcast, Inc.) -- C:\Program Files (x86)\Webroot\Security\Current\plugins\sync\WRSyncManager.exe
    PRC - [2010/05/21 00:28:00 | 011,312,128 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
    PRC - [2010/05/21 00:27:58 | 011,318,784 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
    PRC - [2009/10/29 06:47:34 | 000,419,112 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
    PRC - [2009/10/21 21:53:42 | 000,181,480 | ---- | M] (Acer Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
    PRC - [2009/09/10 08:42:30 | 000,349,480 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
    PRC - [2009/08/28 04:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
    PRC - [2009/08/18 04:42:08 | 001,157,128 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
    PRC - [2009/08/04 00:09:34 | 000,199,464 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
    PRC - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe


    ========== Modules (No Company Name) ==========

    MOD - [2011/11/03 08:15:34 | 002,558,976 | ---- | M] () -- C:\Program Files (x86)\Webroot\Security\Current\Framework\frameworkresources.dll
    MOD - [2011/09/04 18:26:57 | 001,572,864 | ---- | M] () -- C:\Users\Owner\AppData\LocalLow\FCTB000062781\Toolbar\Toolbar.dll
    MOD - [2011/09/04 18:26:57 | 001,572,864 | ---- | M] () -- C:\Program Files (x86)\Gamers Unite! Snag Bar\Toolbar.dll
    MOD - [2011/09/04 18:26:57 | 000,361,472 | ---- | M] () -- C:\Users\Owner\AppData\LocalLow\FCTB000062781\Toolbar\Helper.dll
    MOD - [2011/09/04 18:26:57 | 000,361,472 | ---- | M] () -- C:\Program Files (x86)\Gamers Unite! Snag Bar\Helper.dll
    MOD - [2011/07/06 11:45:28 | 000,897,624 | ---- | M] () -- C:\Program Files (x86)\Webroot\Security\Current\plugins\browserextension\PTCBHOPlugin.dll
    MOD - [2011/07/01 19:54:00 | 000,366,592 | ---- | M] () -- C:\Users\Owner\AppData\LocalLow\FCTB000062781\Toolbar\RSSReader_plugin.dll
    MOD - [2011/07/01 19:53:38 | 000,395,264 | ---- | M] () -- C:\Users\Owner\AppData\LocalLow\FCTB000062781\Toolbar\RadioPlugin.dll
    MOD - [2011/07/01 19:53:10 | 000,219,136 | ---- | M] () -- C:\Users\Owner\AppData\LocalLow\FCTB000062781\Toolbar\SearchComponent.dll
    MOD - [2011/07/01 19:52:42 | 000,274,432 | ---- | M] () -- C:\Users\Owner\AppData\LocalLow\FCTB000062781\Toolbar\bookmarksplugin.dll
    MOD - [2011/07/01 19:52:24 | 000,480,768 | ---- | M] () -- C:\Users\Owner\AppData\LocalLow\FCTB000062781\Toolbar\emailchecker_plugin.dll
    MOD - [2011/07/01 19:52:02 | 000,281,088 | ---- | M] () -- C:\Users\Owner\AppData\LocalLow\FCTB000062781\Toolbar\weatherplugin.dll
    MOD - [2011/07/01 19:51:44 | 000,294,400 | ---- | M] () -- C:\Users\Owner\AppData\LocalLow\FCTB000062781\Toolbar\msgboxplugin.dll
    MOD - [2011/03/09 08:40:08 | 007,446,528 | ---- | M] () -- C:\Program Files (x86)\Webroot\Security\Current\plugins\sync\QtGui4.dll
    MOD - [2011/03/09 08:40:08 | 000,671,744 | ---- | M] () -- C:\Program Files (x86)\Webroot\Security\Current\plugins\sync\QtNetwork4.dll
    MOD - [2011/03/09 08:40:08 | 000,364,544 | ---- | M] () -- C:\Program Files (x86)\Webroot\Security\Current\plugins\sync\QtXml4.dll
    MOD - [2011/03/09 08:40:06 | 002,027,520 | ---- | M] () -- C:\Program Files (x86)\Webroot\Security\Current\plugins\sync\QtCore4.dll
    MOD - [2010/05/04 15:36:28 | 000,970,752 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll


    ========== Win32 Services (SafeList) ==========

    SRV:64bit: - [2011/05/02 09:46:38 | 000,109,864 | ---- | M] (Privacyware/PWI, Inc.) [Unknown (-1) | Unknown] -- C:\Windows\SysNative\drivers\pwipf6.sys -- (pwipf6)
    SRV:64bit: - [2009/10/29 14:10:02 | 000,844,320 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
    SRV:64bit: - [2009/07/29 07:03:42 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
    SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV:64bit: - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
    SRV - [2012/02/12 15:05:30 | 003,340,064 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll -- (Akamai)
    SRV - [2012/01/03 08:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
    SRV - [2011/11/03 08:15:38 | 003,386,840 | ---- | M] (Webroot Software, Inc. ) [Auto | Running] -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe -- (WRConsumerService)
    SRV - [2011/10/19 10:22:58 | 003,997,912 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Auto | Running] -- C:\Program Files (x86)\Webroot\Security\current\plugins\antimalware\AEI.exe -- (WebrootSpySweeperService)
    SRV - [2010/09/30 16:44:46 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Acer Games\Acer Game Console\GameConsoleService.exe -- (GameConsoleService)
    SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
    SRV - [2009/09/10 08:42:46 | 000,305,448 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
    SRV - [2009/08/28 04:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
    SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


    ========== Driver Services (SafeList) ==========

    DRV:64bit: - [2011/07/11 09:07:54 | 000,136,224 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ssidrv.sys -- (ssidrv)
    DRV:64bit: - [2011/07/11 09:07:50 | 000,056,920 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\ssfmonm.sys -- (ssfmonm)
    DRV:64bit: - [2011/05/02 09:46:38 | 000,109,864 | ---- | M] (Privacyware/PWI, Inc.) [Unknown (-1) | Unknown (-1) | Running] -- C:\Windows\SysNative\drivers\pwipf6.sys -- (pwipf6)
    DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
    DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
    DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
    DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
    DRV:64bit: - [2010/04/27 12:40:58 | 000,388,448 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr7064.sys -- (rt70x64)
    DRV:64bit: - [2009/11/11 20:35:24 | 000,225,824 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
    DRV:64bit: - [2009/11/05 23:56:06 | 001,550,848 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
    DRV:64bit: - [2009/10/22 01:23:18 | 000,043,008 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50a64.sys -- (MREMP50a64)
    DRV:64bit: - [2009/10/22 01:23:18 | 000,040,960 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50a64.sys -- (MRESP50a64)
    DRV:64bit: - [2009/07/29 17:11:24 | 006,038,016 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
    DRV:64bit: - [2009/07/27 02:04:36 | 000,058,880 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20)
    DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
    DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
    DRV:64bit: - [2009/07/13 20:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
    DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
    DRV:64bit: - [2009/06/18 07:12:32 | 000,272,432 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
    DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
    DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
    DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
    DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
    DRV:64bit: - [2009/06/02 06:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
    DRV:64bit: - [2009/06/02 06:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
    DRV:64bit: - [2009/06/02 06:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
    DRV:64bit: - [2009/05/05 03:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
    DRV:64bit: - [2009/05/05 03:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
    DRV:64bit: - [2009/05/04 08:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
    DRV:64bit: - [2009/04/03 09:39:58 | 000,034,872 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
    DRV - [2011/03/09 09:06:20 | 000,026,040 | ---- | M] (Webroot Software Inc (www.webroot.com)) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Webroot\Security\Current\plugins\cleanup\wrssweep.sys -- (wrssweep)
    DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360210d505l0424z135t4452x25n
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360210d505l0424z135t4452x25n
    IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
    IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27360210d505l0424z135t4452x25n
    IE - HKLM\..\URLSearchHook: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll (Conduit Ltd.)
    IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
    IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
    IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2790392


    IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=5
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\URLSearchHook: - No CLSID value found
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\URLSearchHook: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll (Conduit Ltd.)
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\URLSearchHook: {b843a48a-b70f-45cd-a15a-6c2b30c2c11e} - C:\Program Files (x86)\Gamers Unite! Snag Bar\Helper.dll ()
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\SearchScopes\{83702D08-CC14-4C3E-96A6-D279C544607D}: "URL" = http://www.ask.com/web?q={searchTerms}&search=search&qsrc=0&o=0&l=dir
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search?q={searchTerms}
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\SearchScopes\{B576B582-A7C4-499B-95EE-E24E0A71C35C}: "URL" = http://ws.infospace.com/gamers_brw/ws/redir?_iceUrl=true&user_id=%userid&tool_id=%toolid&qkw={searchTerms}
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=chr-i3752
    IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
    FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
    FF - prefs.js..browser.search.param.yahoo-type: "${8}"
    FF - prefs.js..browser.search.useDBForOrder: true
    FF - prefs.js..browser.startup.homepage: "|http://www.yahoo.com/"
    FF - prefs.js..extensions.charles.settings.disabled.network.proxy.http: ""
    FF - prefs.js..extensions.charles.settings.disabled.network.proxy.http_port: 0
    FF - prefs.js..extensions.charles.settings.disabled.network.proxy.no_proxies_on: "localhost, 127.0.0.1"
    FF - prefs.js..extensions.charles.settings.disabled.network.proxy.share_proxy_settings: false
    FF - prefs.js..extensions.charles.settings.disabled.network.proxy.socks: ""
    FF - prefs.js..extensions.charles.settings.disabled.network.proxy.socks_port: 0
    FF - prefs.js..extensions.charles.settings.disabled.network.proxy.ssl: ""
    FF - prefs.js..extensions.charles.settings.disabled.network.proxy.ssl_port: 0
    FF - prefs.js..extensions.charles.settings.disabled.network.proxy.type: 5
    FF - prefs.js..extensions.charles.settings.enabled.network.proxy.http: "127.0.0.1"
    FF - prefs.js..extensions.charles.settings.enabled.network.proxy.http_port: 8888
    FF - prefs.js..extensions.charles.settings.enabled.network.proxy.no_proxies_on: ""
    FF - prefs.js..extensions.charles.settings.enabled.network.proxy.share_proxy_settings: false
    FF - prefs.js..extensions.charles.settings.enabled.network.proxy.socks: ""
    FF - prefs.js..extensions.charles.settings.enabled.network.proxy.socks_port: 0
    FF - prefs.js..extensions.charles.settings.enabled.network.proxy.ssl: "127.0.0.1"
    FF - prefs.js..extensions.charles.settings.enabled.network.proxy.ssl_port: 8888
    FF - prefs.js..extensions.charles.settings.enabled.network.proxy.type: 1
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
    FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:3.3.3.2
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
    FF - prefs.js..extensions.enabledItems: FFToolbar@upromise:7.0.2.4181
    FF - prefs.js..extensions.enabledItems: {afe43e80-0abc-4df2-81a0-3fe44b74abe8}:1.300.368
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
    FF - prefs.js..extensions.enabledItems: {7a2cadc6-0db8-43bb-a6e4-9d8bda6a254f}:1.72.0
    FF - prefs.js..extensions.enabledItems: {3DF533F5-FB3C-4c4c-A1D7-99717F8C3038}:1.0
    FF - prefs.js..keyword.URL: "chrome://browser-region/locale/region.properties"


    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre1.6.0_20\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
    FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3DF533F5-FB3C-4c4c-A1D7-99717F8C3038}: C:\Program Files (x86)\Webroot\Security\current\plugins\browserextension\ff_ptc\ [2011/08/03 21:08:52 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/01/21 13:24:36 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/01/12 18:17:54 | 000,000,000 | ---D | M]
    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Program Files (x86)\Object\facetheme

    [2010/07/04 18:16:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Extensions
    [2012/01/29 17:12:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\extensions
    [2011/03/17 08:13:37 | 000,000,000 | ---D | M] (Webroot) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\extensions\{7a2cadc6-0db8-43bb-a6e4-9d8bda6a254f}
    [2012/01/29 17:12:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\extensions\staged
    [2010/09/16 08:28:39 | 000,002,151 | ---- | M] () -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\searchplugins\ask-jeeves.xml
    [2010/08/18 12:51:06 | 000,001,832 | ---- | M] () -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\searchplugins\bing.xml
    [2011/07/30 01:13:20 | 000,002,055 | ---- | M] () -- C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\yu18mxuq.default\searchplugins\daemon-search.xml
    [2011/12/10 10:27:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
    [2011/08/03 21:08:52 | 000,000,000 | ---D | M] (Webroot malicious URL filtering) -- C:\PROGRAM FILES (X86)\WEBROOT\SECURITY\CURRENT\PLUGINS\BROWSEREXTENSION\FF_PTC
    () (No name found) -- C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YU18MXUQ.DEFAULT\EXTENSIONS\{AFE43E80-0ABC-4DF2-81A0-3FE44B74ABE8}.XPI
    () (No name found) -- C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YU18MXUQ.DEFAULT\EXTENSIONS\FFTOOLBAR@UPROMISE.XPI
    [2012/01/21 13:24:36 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
    [2011/11/20 15:21:17 | 000,466,944 | ---- | M] (Catalina Marketing Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll
    [2011/03/18 13:32:12 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll
    [2010/11/21 05:18:38 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
    [2011/03/18 13:32:14 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npMozCouponPrinter.dll
    [2012/01/21 13:24:32 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
    [2012/01/21 13:24:32 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

    ========== Chrome ==========


    O1 HOSTS File: ([2012/03/05 09:04:15 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O2 - BHO: (Gamers Unite! Snag Bar BHO) - {26A7CA19-7D58-411D-B2DA-F1B0324CBFFC} - C:\Program Files (x86)\Gamers Unite! Snag Bar\Toolbar.dll ()
    O2 - BHO: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll (Conduit Ltd.)
    O2 - BHO: (WebrootBHO Class) - {D93EC24D-8741-4D41-B83D-A5793B998416} - C:\Program Files (x86)\Webroot\Security\Current\plugins\browserextension\WebrootBHO.dll (Webroot Software, Inc.)
    O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.6.0_20\bin\jp2ssv.dll (Sun Microsystems, Inc.)
    O2 - BHO: (Webroot Browser Helper Object) - {e08861fe-8847-4b2a-8ec2-08edb20e4020} - C:\Program Files (x86)\Webroot\Security\Current\products\WISE\toolbar\LPBar.dll (Webroot Software, Inc.)
    O2 - BHO: (Upromise TurboSaver) - {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll (Upromise, Inc.)
    O3 - HKLM\..\Toolbar: (Upromise TurboSaver) - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll (Upromise, Inc.)
    O3 - HKLM\..\Toolbar: (Gamers Unite! Snag Bar) - {25515A79-C1C7-4B97-97F8-31A711694487} - C:\Program Files (x86)\Gamers Unite! Snag Bar\Toolbar.dll ()
    O3 - HKLM\..\Toolbar: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll (Conduit Ltd.)
    O3 - HKLM\..\Toolbar: (Webroot Toolbar) - {d84a64a0-f2b2-4975-b264-3a3bce8d57d6} - C:\Program Files (x86)\Webroot\Security\Current\products\WISE\toolbar\LPBar.dll (Webroot Software, Inc.)
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Upromise TurboSaver) - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll (Upromise, Inc.)
    O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Gamers Unite! Snag Bar) - {25515A79-C1C7-4B97-97F8-31A711694487} - C:\Program Files (x86)\Gamers Unite! Snag Bar\Toolbar.dll ()
    O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Zynga Toolbar) - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll (Conduit Ltd.)
    O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Upromise TurboSaver) - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll (Upromise, Inc.)
    O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Gamers Unite! Snag Bar) - {25515A79-C1C7-4B97-97F8-31A711694487} - C:\Program Files (x86)\Gamers Unite! Snag Bar\Toolbar.dll ()
    O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Zynga Toolbar) - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll (Conduit Ltd.)
    O3 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\Toolbar\WebBrowser: (Upromise TurboSaver) - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll (Upromise, Inc.)
    O3 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\Toolbar\WebBrowser: (Gamers Unite! Snag Bar) - {25515A79-C1C7-4B97-97F8-31A711694487} - C:\Program Files (x86)\Gamers Unite! Snag Bar\Toolbar.dll ()
    O3 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\Toolbar\WebBrowser: (Zynga Toolbar) - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll (Conduit Ltd.)
    O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
    O4:64bit: - HKLM..\Run: [ATT-SST_McciTrayApp] "C:\Program Files\ATT-SST\McciTrayApp.exe" File not found
    O4:64bit: - HKLM..\Run: [ATT-SST_UninstallTracking] C:\Users\Owner\AppData\Local\Temp\InstallHelper.exe /uninstalltrackingvendor=ATT-SST File not found
    O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
    O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
    O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe ()
    O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
    O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
    O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
    O4 - HKLM..\Run: [PlayMovie] C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
    O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
    O4 - HKLM..\Run: [WebrootTrayApp] C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe (Webroot Software, Inc. )
    O4 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000..\Run: [Upromise Tray] C:\Program Files (x86)\Upromise\UpromiseTray.exe (Upromise, Inc.)
    O4 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000..\Run: [Upromise Update] C:\Program Files (x86)\Upromise\dca-ua.exe (Compete, Inc.)
    O4 - Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
    O7 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
    O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html File not found
    O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html File not found
    O9 - Extra Button: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll (Upromise, Inc.)
    O9 - Extra 'Tools' menuitem : Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll (Upromise, Inc.)
    O15 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..Trusted Domains: motive.com ([pattta.att] https in Trusted sites)
    O15 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..Trusted Domains: motive.com ([patttbc.att] https in Trusted sites)
    O16 - DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab (Reg Error: Key error.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{856ED3C4-B8B5-470E-B3C2-641E5FDB459F}: DhcpNameServer = 75.75.75.75 75.75.76.76
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8A918BBD-5D51-45C6-9872-785B10CB5AFD}: DhcpNameServer = 192.168.0.1
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AC48E262-04F8-4DE7-AA66-536313088B58}: DhcpNameServer = 192.168.1.254 192.168.1.254
    O18:64bit: - Protocol\Handler\livecall - No CLSID value found
    O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
    O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
    O18:64bit: - Protocol\Handler\msnim - No CLSID value found
    O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
    O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
    O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O32 - HKLM CDRom: AutoRun - 1
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35:64bit: - HKLM\..comfile [open] -- "%1" %*
    O35:64bit: - HKLM\..exefile [open] -- "%1" %*
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*


    Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.vorbis - C:\Windows\SysWow64\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
    Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2012/03/05 08:43:58 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2012/03/05 08:17:03 | 000,000,000 | ---D | C] -- C:\Windows\temp
    [2012/03/05 07:30:15 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2012/03/05 07:30:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2012/03/05 07:30:15 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2012/03/05 07:30:06 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2012/03/05 07:30:05 | 000,000,000 | ---D | C] -- C:\ComboFix
    [2012/03/05 07:29:58 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2012/03/05 07:17:10 | 004,427,148 | R--- | C] (Swearware) -- C:\Users\Owner\Desktop\ComboFix.exe
    [2012/03/04 17:20:30 | 000,000,000 | ---D | C] -- C:\Users\Owner\Desktop\bootkit_remover
    [2012/03/04 16:57:22 | 004,730,880 | ---- | C] (AVAST Software) -- C:\Users\Owner\Desktop\aswMBR.exe
    [2012/03/04 15:53:46 | 000,000,000 | ---D | C] -- C:\Users\Owner\Desktop\tdsskiller
    [2012/03/03 21:14:13 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Owner\Desktop\dds.scr
    [2012/03/03 17:03:36 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\Malwarebytes
    [2012/03/03 17:03:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2012/03/03 17:03:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2012/03/03 17:03:26 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
    [2012/03/03 17:03:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    [2012/03/03 17:02:04 | 009,502,424 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup-1.60.1.1000.exe
    [2012/03/03 16:47:37 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\breast pump_files
    [2012/02/18 02:24:35 | 000,000,000 | --SD | C] -- C:\Windows\SysWow64\Microsoft
    [2012/02/06 16:59:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pure Networks
    [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
     
  13. debym

    debym TS Rookie Topic Starter Posts: 23

    2nd half OTL

    ========== Files - Modified Within 30 Days ==========

    [2012/03/05 17:29:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2012/03/05 09:15:41 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    [2012/03/05 09:15:41 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    [2012/03/05 09:09:06 | 000,001,441 | ---- | M] () -- C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2012/03/05 09:04:15 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
    [2012/03/05 09:01:13 | 2211,483,648 | -HS- | M] () -- C:\hiberfil.sys
    [2012/03/05 08:57:20 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
    [2012/03/05 08:57:14 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
    [2012/03/05 08:52:17 | 000,773,482 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
    [2012/03/05 08:52:17 | 000,660,530 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
    [2012/03/05 08:52:17 | 000,121,426 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
    [2012/03/05 08:52:02 | 000,773,482 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
    [2012/03/05 07:17:43 | 004,427,148 | R--- | M] (Swearware) -- C:\Users\Owner\Desktop\ComboFix.exe
    [2012/03/04 17:20:21 | 000,044,607 | ---- | M] () -- C:\Users\Owner\Desktop\bootkit_remover.zip
    [2012/03/04 17:17:30 | 000,000,512 | ---- | M] () -- C:\Users\Owner\Desktop\MBR.dat
    [2012/03/04 16:57:49 | 004,730,880 | ---- | M] (AVAST Software) -- C:\Users\Owner\Desktop\aswMBR.exe
    [2012/03/04 15:53:31 | 002,044,252 | ---- | M] () -- C:\Users\Owner\Desktop\tdsskiller.zip
    [2012/03/03 21:15:20 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Owner\Desktop\dds.scr
    [2012/03/03 20:39:29 | 000,302,592 | ---- | M] () -- C:\Users\Owner\Desktop\oghxiv29.exe
    [2012/03/03 17:03:27 | 000,001,137 | ---- | M] () -- C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware.lnk
    [2012/03/03 17:03:27 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2012/03/03 17:02:27 | 009,502,424 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup-1.60.1.1000.exe
    [2012/02/27 22:28:17 | 000,233,271 | ---- | M] () -- C:\Users\Owner\Desktop\aero.xps
    [2012/02/25 07:41:10 | 000,247,881 | ---- | M] () -- C:\Users\Owner\Desktop\seaworld.xps
    [2012/02/22 19:36:58 | 000,080,705 | ---- | M] () -- C:\Users\Owner\Desktop\rec.xps
    [2012/02/21 13:28:48 | 000,092,849 | ---- | M] () -- C:\Users\Owner\Desktop\lowes.png
    [2012/02/16 10:08:47 | 000,365,360 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
    [2012/02/05 12:37:07 | 000,055,527 | ---- | M] () -- C:\Users\Owner\Documents\erick insurance card.pdf
    [2012/02/05 12:34:19 | 000,199,910 | ---- | M] () -- C:\Users\Owner\Documents\erick insurance.xps
    [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2012/03/05 08:57:20 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
    [2012/03/05 08:57:14 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
    [2012/03/05 07:30:15 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2012/03/05 07:30:15 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2012/03/05 07:30:15 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2012/03/05 07:30:15 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2012/03/05 07:30:15 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2012/03/04 17:19:10 | 000,044,607 | ---- | C] () -- C:\Users\Owner\Desktop\bootkit_remover.zip
    [2012/03/04 17:17:30 | 000,000,512 | ---- | C] () -- C:\Users\Owner\Desktop\MBR.dat
    [2012/03/04 15:53:07 | 002,044,252 | ---- | C] () -- C:\Users\Owner\Desktop\tdsskiller.zip
    [2012/03/03 20:37:49 | 000,302,592 | ---- | C] () -- C:\Users\Owner\Desktop\oghxiv29.exe
    [2012/03/03 17:03:27 | 000,001,137 | ---- | C] () -- C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware.lnk
    [2012/03/03 17:03:27 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2012/03/03 16:47:37 | 000,003,889 | ---- | C] () -- C:\Users\Owner\Documents\breast pump.htm
    [2012/02/27 22:28:14 | 000,233,271 | ---- | C] () -- C:\Users\Owner\Desktop\aero.xps
    [2012/02/25 07:41:07 | 000,247,881 | ---- | C] () -- C:\Users\Owner\Desktop\seaworld.xps
    [2012/02/22 19:36:56 | 000,080,705 | ---- | C] () -- C:\Users\Owner\Desktop\rec.xps
    [2012/02/21 13:28:47 | 000,092,849 | ---- | C] () -- C:\Users\Owner\Desktop\lowes.png
    [2012/02/05 12:37:07 | 000,055,527 | ---- | C] () -- C:\Users\Owner\Documents\erick insurance card.pdf
    [2012/02/05 12:34:16 | 000,199,910 | ---- | C] () -- C:\Users\Owner\Documents\erick insurance.xps
    [2012/01/17 16:15:21 | 000,008,927 | ---- | C] () -- C:\ProgramData\7ce8974a
    [2011/08/04 05:15:33 | 000,773,482 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
    [2010/09/10 11:30:19 | 000,030,424 | ---- | C] () -- C:\Windows\SysWow64\wrLZMA.dll
    [2010/09/06 05:42:45 | 000,000,248 | ---- | C] () -- C:\Windows\wininit.ini
    [2010/07/04 18:16:11 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
    [2010/06/24 23:59:43 | 000,000,135 | ---- | C] () -- C:\Windows\SysWow64\msexcr.ini
    [2010/06/13 07:51:56 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
    [2010/05/07 16:25:23 | 000,000,210 | ---- | C] () -- C:\Users\Owner\AppData\Roaming\wklnhst.dat

    ========== LOP Check ==========

    [2011/12/27 03:00:35 | 000,000,000 | ---D | M] -- C:\Users\Erick\AppData\Roaming\Acer
    [2011/12/27 03:00:30 | 000,000,000 | ---D | M] -- C:\Users\Erick\AppData\Roaming\Leadertech
    [2011/12/27 03:05:11 | 000,000,000 | ---D | M] -- C:\Users\Erick\AppData\Roaming\Template
    [2011/12/27 17:11:20 | 000,000,000 | ---D | M] -- C:\Users\Erick.Owner-PC\AppData\Roaming\Acer
    [2011/12/27 17:11:19 | 000,000,000 | ---D | M] -- C:\Users\Erick.Owner-PC\AppData\Roaming\Leadertech
    [2011/12/27 17:18:37 | 000,000,000 | ---D | M] -- C:\Users\Erick.Owner-PC\AppData\Roaming\Template
    [2011/10/27 21:24:06 | 000,000,000 | ---D | M] -- C:\Users\Katherine\AppData\Roaming\Acer
    [2011/10/27 21:24:04 | 000,000,000 | ---D | M] -- C:\Users\Katherine\AppData\Roaming\Leadertech
    [2010/02/23 22:12:20 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Acer
    [2011/10/09 01:06:42 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\BitTorrent
    [2011/11/20 15:21:18 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Catalina Marketing Corp
    [2010/07/05 17:26:09 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Charles
    [2011/07/30 17:45:48 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\DAEMON Tools Lite
    [2011/07/27 16:25:49 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Deckadance16
    [2011/07/21 23:31:39 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\fltk.org
    [2010/02/23 22:12:20 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Leadertech
    [2011/09/03 07:33:48 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\OpenOffice.org
    [2010/02/24 13:59:13 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\PowerCinema
    [2011/08/06 16:05:56 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Propellerhead Software
    [2010/02/24 13:59:23 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\SoftDMA
    [2011/07/27 17:10:28 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\SongManager
    [2010/10/13 03:06:30 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Template
    [2011/11/09 09:04:27 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\upromise
    [2011/12/13 11:13:04 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Visan
    [2010/02/24 15:52:29 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\WildTangent
    [2010/08/18 12:49:35 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Winff
    [2011/11/18 07:14:01 | 000,032,560 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2009/11/05 14:47:05 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
    [2012/03/05 08:16:55 | 000,019,561 | ---- | M] () -- C:\ComboFix.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt
    [2007/11/07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt
    [2007/11/07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt
    [2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
    [2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
    [2012/03/05 09:01:13 | 2211,483,648 | -HS- | M] () -- C:\hiberfil.sys
    [2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
    [2007/11/07 08:44:20 | 000,075,280 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
    [2007/11/07 08:44:20 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
    [2007/11/07 08:44:20 | 000,090,128 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
    [2007/11/07 08:44:20 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
    [2007/11/07 08:44:20 | 000,094,224 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
    [2007/11/07 08:44:20 | 000,080,400 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
    [2007/11/07 08:44:20 | 000,078,864 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
    [2007/11/07 08:44:20 | 000,074,768 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
    [2007/11/07 08:44:20 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
    [2012/03/05 09:01:13 | 2948,648,960 | -HS- | M] () -- C:\pagefile.sys
    [2009/11/05 14:57:50 | 000,002,051 | ---- | M] () -- C:\RHDSetup.log
    [2012/03/04 16:00:02 | 000,077,498 | ---- | M] () -- C:\TDSSKiller.2.7.18.0_04.03.2012_15.54.03_log.txt
    [2012/03/04 16:54:38 | 000,077,498 | ---- | M] () -- C:\TDSSKiller.2.7.18.0_04.03.2012_16.54.04_log.txt
    [2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
    [2007/11/07 08:50:40 | 001,927,956 | ---- | M] () -- C:\VC_RED.cab
    [2007/11/07 08:53:12 | 000,242,176 | ---- | M] () -- C:\VC_RED.MSI

    < %systemroot%\Fonts\*.com >
    [2009/07/14 00:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
    [2009/07/14 00:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
    [2009/07/14 00:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
    [2009/07/14 00:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2009/06/10 15:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2010/11/10 01:28:46 | 000,301,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2012/03/05 09:09:06 | 000,000,221 | -HS- | M] () -- C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >
    [2012/03/04 16:57:49 | 004,730,880 | ---- | M] (AVAST Software) -- C:\Users\Owner\Desktop\aswMBR.exe
    [2012/03/05 07:17:43 | 004,427,148 | R--- | M] (Swearware) -- C:\Users\Owner\Desktop\ComboFix.exe
    [2012/03/03 17:02:27 | 009,502,424 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup-1.60.1.1000.exe
    [2012/03/03 20:39:29 | 000,302,592 | ---- | M] () -- C:\Users\Owner\Desktop\oghxiv29.exe
    [2010/08/22 16:24:37 | 001,228,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Owner\Desktop\PremiereElements_8_LS8.exe
    [2011/10/21 08:07:24 | 012,176,632 | ---- | M] (Smartparts, Inc. ) -- C:\Users\Owner\Desktop\setup_4_1.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\tasks\*.* >
    [2012/03/05 09:01:38 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
    [2011/11/18 07:14:01 | 000,032,560 | ---- | M] () -- C:\Windows\tasks\SCHEDLGU.TXT

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >
    [2009/06/10 16:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\ADDINS\FXSEXT.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >
    [2011/08/16 12:17:12 | 000,008,192 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.chk
    [2011/08/16 12:17:11 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.log
    [2011/08/16 12:17:11 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00001.jrs
    [2011/08/16 12:17:11 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00002.jrs
    [2011/08/16 12:17:11 | 000,786,432 | ---- | M] () -- C:\Windows\SECURITY\Database\edbtmp.log
    [2011/08/16 12:17:12 | 001,056,768 | ---- | M] () -- C:\Windows\SECURITY\Database\tmp.edb

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2012/02/16 11:33:47 | 000,000,402 | -HS- | M] () -- C:\Users\Owner\Favorites\desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >
    [2012/01/18 18:26:24 | 000,008,927 | ---- | M] () -- C:\ProgramData\7ce8974a
    [2009/11/05 15:35:58 | 000,008,415 | ---- | M] () -- C:\ProgramData\ArcadeDeluxe3.log
    [2010/05/18 17:18:13 | 000,000,317 | ---- | M] () -- C:\ProgramData\hpzinstall.log

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < >

    ========== Files - Unicode (All) ==========
    [2012/03/03 00:08:12 | 000,000,000 | ---D | M](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㠰〺‶›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:08:12 | 000,000,000 | ---D | C](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㠰〺‶›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:07:50 | 000,000,000 | ---D | M](C:\Windows\SysWow64\?????????`›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㜰㐺‵›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:07:50 | 000,000,000 | ---D | C](C:\Windows\SysWow64\?????????`›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㜰㐺‵›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:07:29 | 000,000,000 | ---D | M](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㜰㈺″›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:07:29 | 000,000,000 | ---D | C](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㜰㈺″›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:07:07 | 000,000,000 | ---D | M](C:\Windows\SysWow64\?????????'›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㜰〺′›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:07:07 | 000,000,000 | ---D | C](C:\Windows\SysWow64\?????????'›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㜰〺′›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:06:45 | 000,000,000 | ---D | M](C:\Windows\SysWow64\?????????‰›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㘰㐺‰›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:06:45 | 000,000,000 | ---D | C](C:\Windows\SysWow64\?????????‰›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㘰㐺‰›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:06:11 | 000,000,000 | ---D | M](C:\Windows\SysWow64\?????????`›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㘰〺‵›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:06:11 | 000,000,000 | ---D | C](C:\Windows\SysWow64\?????????`›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㘰〺‵›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:05:49 | 000,000,000 | ---D | M](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㔰㐺‴›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:05:49 | 000,000,000 | ---D | C](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㔰㐺‴›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:05:28 | 000,000,000 | ---D | M](C:\Windows\SysWow64\?????????'›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㔰㈺′›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:05:28 | 000,000,000 | ---D | C](C:\Windows\SysWow64\?????????'›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㔰㈺′›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:05:06 | 000,000,000 | ---D | M](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㔰〺‱›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:05:06 | 000,000,000 | ---D | C](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㔰〺‱›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:04:44 | 000,000,000 | ---D | M](C:\Windows\SysWow64\?????????‹›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㐰㌺‹›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:04:44 | 000,000,000 | ---D | C](C:\Windows\SysWow64\?????????‹›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㐰㌺‹›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:04:23 | 000,000,000 | ---D | M](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㐰ㄺ‷›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/03 00:04:23 | 000,000,000 | ---D | C](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㐰ㄺ‷›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/02 23:59:45 | 000,000,000 | ---D | M](C:\Windows\SysWow64\?????????‹›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㤵㌺‹›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/02 23:59:45 | 000,000,000 | ---D | C](C:\Windows\SysWow64\?????????‹›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㤵㌺‹›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/02 23:59:24 | 000,000,000 | ---D | M](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㤵ㄺ‸›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/02 23:59:24 | 000,000,000 | ---D | C](C:\Windows\SysWow64\??????????›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㤵ㄺ‸›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/02 23:58:42 | 000,000,000 | ---D | M](C:\Windows\SysWow64\?????????`›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㠵㌺‵›汃慥䵮瑦䐠楲敶㴠䌠尺਍
    [2012/03/02 23:58:42 | 000,000,000 | ---D | C](C:\Windows\SysWow64\?????????`›???????????) -- C:\Windows\SysWow64\㩃睜整灭Ȁɨ̸㠵㌺‵›汃慥䵮瑦䐠楲敶㴠䌠尺਍

    < End of report >
     
  14. debym

    debym TS Rookie Topic Starter Posts: 23

    Here is Extras.txt

    OTL Extras logfile created on: 3/5/2012 5:34:47 PM - Run 1
    OTL by OldTimer - Version 3.2.35.1 Folder = C:\Users\Owner\Downloads
    64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.75 Gb Total Physical Memory | 0.99 Gb Available Physical Memory | 36.06% Memory free
    5.49 Gb Paging File | 3.51 Gb Available in Paging File | 63.87% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 136.95 Gb Total Space | 86.29 Gb Free Space | 63.01% Space Free | Partition Type: NTFS

    Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

    [HKEY_USERS\S-1-5-21-4163090722-2340137853-366069492-1000\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
    inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
    InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
    InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
    "{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
    "{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
    "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    "{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
    "{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
    "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
    "{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
    "{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
    "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{ACCA82EB-7088-919E-5E1C-100A24F11CCF}" = ATI Catalyst Install Manager
    "{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
    "{E2FCA441-6D7B-CD78-3ADF-42EA9FA06065}" = ccc-utility64
    "{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
    "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
    "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
    "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
    "SynTPDeinstKey" = Synaptics Pointing Device Driver

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
    "{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
    "{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
    "{183F0908-AD5E-8B3B-5F06-28B1A8C65C62}" = CCC Help Japanese
    "{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
    "{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
    "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
    "{23E9588B-05ED-BC2F-EB69-101A96511EF1}" = ccc-core-static
    "{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
    "{2484D1EA-CBA4-60BB-82B9-F8477D25C47A}" = CCC Help Dutch
    "{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
    "{26A24AE4-039D-4CA4-87B4-2F83216020F0}" = Java(TM) 6 Update 20
    "{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
    "{29802D65-9514-DB20-36CD-E47A94C8AEB9}" = Catalyst Control Center Graphics Full Existing
    "{2F61E9D7-CD05-643E-A04E-CC1A8B6610BA}" = CCC Help Finnish
    "{2FA3CDD8-1436-497D-6339-789936561E99}" = CCC Help German
    "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
    "{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0
    "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
    "{34123E80-BE96-6282-1167-6696730AF6D2}" = CCC Help Korean
    "{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
    "{3D20EF26-2E9A-D388-851D-E7675BBACFF5}" = Catalyst Control Center Core Implementation
    "{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
    "{4024F49B-65D4-D6B2-2A1D-6DBF6F09F181}" = CCC Help Greek
    "{49A63237-FD38-AE77-6DF6-FFB41499A4E6}" = CCC Help Hungarian
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
    "{4F0FC827-B693-F166-612E-EA89D798540C}" = CCC Help Chinese Traditional
    "{52FBF90E-D2EF-A2A3-1CCA-6984596B1B02}" = CCC Help English
    "{5A13987D-55F4-4271-A40E-76AC9B1B38FD}" = OpenOffice.org 3.2
    "{628CBFE4-3823-67FB-26D2-566899C3BB5C}" = CCC Help Italian
    "{63F26DAE-CB0D-98B6-3019-D4FC3D0DD203}" = Catalyst Control Center InstallProxy
    "{652EB559-6865-DEF4-2409-D506963C15FD}" = CCC Help Polish
    "{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
    "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
    "{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
    "{68987945-A387-4C25-0C59-21F2AF657E65}" = CCC Help Thai
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
    "{6B45E33B-6BB4-234B-2F5F-65B1A103801D}" = CCC Help Russian
    "{6B99737C-9FDC-50F9-C9A4-AB7DA5C9A336}" = Catalyst Control Center Graphics Full New
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{7BE74C0E-F300-D0A6-780B-C93BB78DE58C}" = CCC Help Norwegian
    "{7E75ACC5-B0EC-7006-183A-374974019911}" = Catalyst Control Center Graphics Light
    "{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
    "{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
    "{82809116-D1EE-443C-AE31-F19E709DDF7A}" = AMD USB Filter Driver
    "{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
    "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8B287B75-DF8D-40C8-9620-8E4492C38EF1}" = Webroot Software
    "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
    "{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
    "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
    "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
    "{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
    "{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
    "{97124B44-C17B-C352-44B1-403D0D706173}" = CCC Help Czech
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{9ACA8261-11D1-F8A1-C154-7F8B23515C79}" = CCC Help Swedish
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
    "{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
    "{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
    "{A9574A7E-C024-EED1-7A81-CC4786A1915A}" = CCC Help Portuguese
    "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
    "{AA32D2A6-1299-0F05-BF8D-04075A9F69EB}" = CCC Help Turkish
    "{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
    "{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
    "{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
    "{AFB1DFA5-FB56-4C9F-97A0-1607BC14BC0C}" = Smartparts Desktop
    "{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
    "{BCC05B1F-7397-799A-9EDB-AC10123BB17A}" = CCC Help Chinese Standard
    "{BEF4FD8A-29FF-C250-468A-5FC55F0E3451}" = Catalyst Control Center Localization All
    "{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
    "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
    "{CF7A62B6-F712-412E-9914-D80033A7F8B8}" = Catalyst Control Center - Branding
    "{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
    "{D41301F8-90FD-9CE8-CD2C-ED2B9D5F07E3}" = CCC Help Spanish
    "{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
    "{D43AD08C-BE76-8C5B-FD90-4B665EF60E2E}" = CCC Help Danish
    "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
    "{DA4CA661-5ABF-9218-6E42-84BF89F43655}" = CCC Help French
    "{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
    "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
    "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
    "{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
    "{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
    "{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
    "Acer Assist" = Acer Assist
    "Acer Registration" = Acer Registration
    "Acer Screensaver" = Acer ScreenSaver
    "Acer Welcome Center" = Welcome Center
    "Adobe AIR" = Adobe AIR
    "Akamai" = Akamai NetSession Interface Service
    "BitTorrent" = BitTorrent
    "Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
    "Gamers Unite! Snag Bar" = Gamers Unite! Snag Bar
    "GridVista" = Acer GridVista
    "HOMESTUDENTR" = Microsoft Office Home and Student 2007
    "Identity Card" = Identity Card
    "InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
    "InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
    "InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
    "InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
    "Intelli-studio" = SAMSUNG Intelli-studio
    "LManager" = Launch Manager
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.1.1000
    "Mozilla Firefox 9.0.1 (x86 en-US)" = Mozilla Firefox 9.0.1 (x86 en-US)
    "reFX Nexus_is1" = reFX Nexus VSTi RTAS v2.2.0
    "Webroot Software" = Webroot Software
    "WildTangent acer Master Uninstall" = Acer Games
    "WinLiveSuite" = Windows Live Essentials
    "WT077432" = Faerie Solitaire
    "WT077690" = Jewel Quest Solitaire 2
    "WT078409" = Dream Vacation Solitaire
    "WT078435" = GameHouse Solitaire Challenge
    "WT080234" = Ancient Spider
    "WT080351" = Bubblefish Bob
    "WT081138" = Pizza Panic
    "WT081381" = Shape Solitaire
    "WT081442" = Spyde Solitaire
    "WTA-fe9ebd23-27ba-4399-82e9-56605e95d80d" = Airstrike 2 - Gulf Thunder
    "Zynga Toolbar" = Zynga Toolbar

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-4163090722-2340137853-366069492-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Upromise TurboSaver" = Upromise TurboSaver (remove only)

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 2/16/2012 7:24:44 PM | Computer Name = Owner-PC | Source = SideBySide | ID = 16842785
    Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe".
    Dependent
    Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
    could not be found. Please use sxstrace.exe for detailed diagnosis.

    Error - 2/16/2012 7:24:44 PM | Computer Name = Owner-PC | Source = SideBySide | ID = 16842785
    Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe".
    Dependent
    Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
    could not be found. Please use sxstrace.exe for detailed diagnosis.

    Error - 2/16/2012 7:24:44 PM | Computer Name = Owner-PC | Source = SideBySide | ID = 16842785
    Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe".
    Dependent
    Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
    could not be found. Please use sxstrace.exe for detailed diagnosis.

    Error - 2/16/2012 7:24:44 PM | Computer Name = Owner-PC | Source = SideBySide | ID = 16842785
    Description = Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
    Dependent
    Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
    could not be found. Please use sxstrace.exe for detailed diagnosis.

    Error - 2/18/2012 3:24:27 AM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
    Description = Faulting application name: WRConsumerService.exe, version: 7.0.12.22,
    time stamp: 0x4eab86b2 Faulting module name: ole32.dll, version: 6.1.7601.17514,
    time stamp: 0x4ce7b96f Exception code: 0xc0000005 Fault offset: 0x0003bc21 Faulting
    process id: 0x338 Faulting application start time: 0x01ccee0c24f464a9 Faulting application
    path: C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe
    Faulting
    module path: C:\Windows\syswow64\ole32.dll Report Id: 969d6057-5a01-11e1-b081-705ab611b6f2

    Error - 2/18/2012 3:44:25 AM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
    Description = Faulting application name: WRConsumerService.exe, version: 7.0.12.22,
    time stamp: 0x4eab86b2 Faulting module name: WRConsumerService.exe, version: 7.0.12.22,
    time stamp: 0x4eab86b2 Exception code: 0xc000001d Fault offset: 0x000c0055 Faulting
    process id: 0x170c Faulting application start time: 0x01ccee0ed016f654 Faulting application
    path: C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe
    Faulting
    module path: C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe
    Report
    Id: 60ac5591-5a04-11e1-b081-705ab611b6f2

    Error - 2/18/2012 3:44:26 AM | Computer Name = Owner-PC | Source = Application Error | ID = 1005
    Description = Windows cannot access the file for one of the following reasons: there
    is a problem with the network connection, the disk that the file is stored on,
    or the storage drivers installed on this computer; or the disk is missing. Windows
    closed the program WRConsumerService because of this error. Program: WRConsumerService
    File:
    The error value is listed in the Additional Data section. User Action 1. Open the
    file again. This situation might be a temporary problem that corrects itself when
    the program runs again. 2. If the file still cannot be accessed and - It is on the
    network, your network administrator should verify that there is not a problem with
    the network and that the server can be contacted. - It is on a removable disk, for
    example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the
    computer. 3. Check and repair the file system by running CHKDSK. To run CHKDSK,
    click Start, click Run, type CMD, and then click OK. At the command prompt, type
    CHKDSK /F, and then press ENTER. 4. If the problem persists, restore the file from
    a backup copy. 5. Determine whether other files on the same disk can be opened.
    If not, the disk might be damaged. If it is a hard disk, contact your administrator
    or computer hardware vendor for further assistance. Additional Data Error value: 00000000
    Disk
    type: 0

    Error - 2/18/2012 3:51:03 AM | Computer Name = Owner-PC | Source = SideBySide | ID = 16842785
    Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
    Dependent
    Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
    could not be found. Please use sxstrace.exe for detailed diagnosis.

    Error - 2/18/2012 4:11:30 AM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
    Description = Faulting application name: WRConsumerService.exe, version: 7.0.12.22,
    time stamp: 0x4eab86b2 Faulting module name: ole32.dll, version: 6.1.7601.17514,
    time stamp: 0x4ce7b96f Exception code: 0xc0000005 Fault offset: 0x0003bc24 Faulting
    process id: 0xd68 Faulting application start time: 0x01ccee120a14e098 Faulting application
    path: C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe
    Faulting
    module path: C:\Windows\syswow64\ole32.dll Report Id: 28d11c17-5a08-11e1-b081-705ab611b6f2

    Error - 2/18/2012 4:58:24 AM | Computer Name = Owner-PC | Source = Application Error | ID = 1000
    Description = Faulting application name: WRConsumerService.exe, version: 7.0.12.22,
    time stamp: 0x4eab86b2 Faulting module name: ole32.dll, version: 6.1.7601.17514,
    time stamp: 0x4ce7b96f Exception code: 0xc0000005 Fault offset: 0x0003bc21 Faulting
    process id: 0x1594 Faulting application start time: 0x01ccee170387bd86 Faulting application
    path: C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe
    Faulting
    module path: C:\Windows\syswow64\ole32.dll Report Id: b68ee337-5a0e-11e1-b081-705ab611b6f2

    [ System Events ]
    Error - 3/5/2012 8:58:55 AM | Computer Name = Owner-PC | Source = atikmdag | ID = 43029
    Description = Display is not active

    Error - 3/5/2012 8:59:11 AM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7023
    Description = The Windows Defender service terminated with the following error:
    %%126

    Error - 3/5/2012 10:01:19 AM | Computer Name = Owner-PC | Source = atikmdag | ID = 52236
    Description = CPLIB :: General - Invalid Parameter

    Error - 3/5/2012 10:01:19 AM | Computer Name = Owner-PC | Source = atikmdag | ID = 43029
    Description = Display is not active

    Error - 3/5/2012 10:16:06 AM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7034
    Description = The Webroot Client Service service terminated unexpectedly. It has
    done this 1 time(s).

    Error - 3/5/2012 11:14:58 AM | Computer Name = Owner-PC | Source = atikmdag | ID = 43029
    Description = Display is not active

    Error - 3/5/2012 1:49:09 PM | Computer Name = Owner-PC | Source = atikmdag | ID = 43029
    Description = Display is not active

    Error - 3/5/2012 2:40:40 PM | Computer Name = Owner-PC | Source = atikmdag | ID = 43029
    Description = Display is not active

    Error - 3/5/2012 3:40:58 PM | Computer Name = Owner-PC | Source = atikmdag | ID = 43029
    Description = Display is not active

    Error - 3/5/2012 6:29:10 PM | Computer Name = Owner-PC | Source = atikmdag | ID = 43029
    Description = Display is not active


    < End of report >
     
  15. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Good news :)

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      IE - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..\URLSearchHook: - No CLSID value found
      O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
      O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
      O4:64bit: - HKLM..\Run: [ATT-SST_McciTrayApp] "C:\Program Files\ATT-SST\McciTrayApp.exe" File not found
      O4:64bit: - HKLM..\Run: [ATT-SST_UninstallTracking] C:\Users\Owner\AppData\Local\Temp\InstallHelper.exe /uninstalltrackingvendor=ATT-SST File not found
      O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html File not found
      O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html File not found
      O15 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..Trusted Domains: motive.com ([pattta.att] https in Trusted sites)
      O15 - HKU\S-1-5-21-4163090722-2340137853-366069492-1000\..Trusted Domains: motive.com ([patttbc.att] https in Trusted sites)
      O16 - DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} http://content.systemrequirementslab...i_4.1.71.0.cab (Reg Error: Key error.)
      O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
      
      :Commands
      [purity]
      [emptytemp]
      [emptyjava]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ====================================================================

    1. Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    2. Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it.
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.
    • Do NOT post JavaRa log.

    =====================================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

    2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.


    3. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    4. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click on List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  16. debym

    debym TS Rookie Topic Starter Posts: 23

    All processes killed
    ========== OTL ==========
    Registry value HKEY_USERS\S-1-5-21-4163090722-2340137853-366069492-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
    64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ATT-SST_McciTrayApp deleted successfully.
    64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ATT-SST_UninstallTracking deleted successfully.
    64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.
    Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ not found.
    Registry delete failed. HKEY_USERS\S-1-5-21-4163090722-2340137853-366069492-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\motive.com\pattta.att\ scheduled to be deleted on reboot.
    Registry delete failed. HKEY_USERS\S-1-5-21-4163090722-2340137853-366069492-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\motive.com\patttbc.att\ scheduled to be deleted on reboot.
    Starting removal of ActiveX control {140E4DF8-9E14-4A34-9577-C77561ED7883}
    C:\Windows\Downloaded Program Files\SystemRequirementsLab.inf not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{140E4DF8-9E14-4A34-9577-C77561ED7883}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{140E4DF8-9E14-4A34-9577-C77561ED7883}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{140E4DF8-9E14-4A34-9577-C77561ED7883}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{140E4DF8-9E14-4A34-9577-C77561ED7883}\ not found.
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    C:\Windows\Downloaded Program Files\gp.inf not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: AppData
    ->Temp folder emptied: 0 bytes

    User: Coupons
    ->Temp folder emptied: 0 bytes

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Flash cache emptied: 56504 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Erick
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->FireFox cache emptied: 45125564 bytes
    ->Flash cache emptied: 57361 bytes

    User: Erick.Owner-PC
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->FireFox cache emptied: 11278118 bytes
    ->Flash cache emptied: 57035 bytes

    User: Katherine
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 5688555 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 17139222 bytes
    ->Flash cache emptied: 57035 bytes

    User: Katherine.Owner-PC
    ->Temp folder emptied: 0 bytes

    User: Owner
    ->Temp folder emptied: 1988586 bytes
    ->Temporary Internet Files folder emptied: 142116491 bytes
    ->Java cache emptied: 30558575 bytes
    ->FireFox cache emptied: 56837703 bytes
    ->Flash cache emptied: 2376 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    User: School Katherine
    ->Temp folder emptied: 0 bytes

    User: test
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 23750063 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50400 bytes
    RecycleBin emptied: 1006567 bytes

    Total Files Cleaned = 320.00 mb


    [EMPTYJAVA]

    User: All Users

    User: AppData

    User: Coupons

    User: Default

    User: Default User

    User: Erick

    User: Erick.Owner-PC

    User: Katherine
    ->Java cache emptied: 0 bytes

    User: Katherine.Owner-PC

    User: Owner
    ->Java cache emptied: 0 bytes

    User: Public

    User: School Katherine

    User: test

    Total Java Files Cleaned = 0.00 mb


    [EMPTYFLASH]

    User: All Users

    User: AppData

    User: Coupons

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Erick
    ->Flash cache emptied: 0 bytes

    User: Erick.Owner-PC
    ->Flash cache emptied: 0 bytes

    User: Katherine
    ->Flash cache emptied: 0 bytes

    User: Katherine.Owner-PC

    User: Owner
    ->Flash cache emptied: 0 bytes

    User: Public

    User: School Katherine

    User: test

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.35.1 log created on 03052012_201906

    Files\Folders moved on Reboot...
    C:\Users\Owner\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

    Registry entries deleted on Reboot...
    Registry key HKEY_USERS\S-1-5-21-4163090722-2340137853-366069492-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\motive.com\pattta.att\ deleted successfully.
    Registry key HKEY_USERS\S-1-5-21-4163090722-2340137853-366069492-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\motive.com\patttbc.att\ deleted successfully.
     
  17. debym

    debym TS Rookie Topic Starter Posts: 23

    checkup log

    Results of screen317's Security Check version 0.99.24
    Windows 7 x64 (UAC is enabled)
    Internet Explorer 9
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Disabled!
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Spyde Solitaire
    Java(TM) 6 Update 20
    Java(TM) 6 Update 31
    Out of date Java installed!
    Adobe Reader X (10.1.2)
    Mozilla Firefox (x86 en-US..)
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Webroot Security current plugins\antimalware\AEI.exe
    Webroot Security current plugins\antimalware\SSU.EXE
    ``````````End of Log````````````
     
  18. debym

    debym TS Rookie Topic Starter Posts: 23

    farber log

    Farbar Service Scanner Version: 01-03-2012
    Ran by Owner (administrator) on 05-03-2012 at 21:13:30
    Running from "C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D1UFTPBQ"
    Microsoft Windows 7 Home Premium Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Attempt to access Google IP returned error: Google IP is offline
    Attempt to access Yahoo IP returend error: Yahoo IP is offline


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall"=DWORD:0
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall"=DWORD:0
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "EnableFirewall"=DWORD:0


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Action Center:
    ============

    Windows Update:
    ============

    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => MD5 is legit
    C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\System32\dhcpcore.dll => MD5 is legit
    C:\Windows\System32\drivers\afd.sys => MD5 is legit
    C:\Windows\System32\drivers\tdx.sys => MD5 is legit
    C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\System32\dnsrslvr.dll => MD5 is legit
    C:\Windows\System32\mpssvc.dll => MD5 is legit
    C:\Windows\System32\bfe.dll => MD5 is legit
    C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\System32\SDRSVC.dll => MD5 is legit
    C:\Windows\System32\vssvc.exe => MD5 is legit
    C:\Windows\System32\wscsvc.dll => MD5 is legit
    C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\System32\wuaueng.dll => MD5 is legit
    C:\Windows\System32\qmgr.dll => MD5 is legit
    C:\Windows\System32\es.dll => MD5 is legit
    C:\Windows\System32\cryptsvc.dll => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\rpcss.dll => MD5 is legit


    **** End of log ****
     
  19. debym

    debym TS Rookie Topic Starter Posts: 23

    I cant run the ESET scan, not sure what has happened it just says
    Cannot get update Is proxy configured

    not sure what is wrong I tried in firefox as well but said the same thing
     
  20. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    Please, run F-Secure Online Scanner

    • Disable your Antivirus program.
    • Checkmark I have read and accepted the license terms.
    • Click on Run Check button.
    • Quick scan (recommended) option will come pre-checked. Don't change it.
    • Click on Start button.
    • When scan is done, in Step 3: Clean the files, leave all settings as they're.
    • Click Next button.
    • Click Full report... button.
    • Copy report's content and paste it into your next reply.
     
  21. debym

    debym TS Rookie Topic Starter Posts: 23

    I forgot to say earlier I had my 1st problem when I went to update Java it would not do anything but crash it did finally do it but it left 9 logs on my desktop called
    hs_err_pid5092

    #
    # A fatal error has been detected by the Java Runtime Environment:
    #
    # EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x6d413f5f, pid=5092, tid=2864
    #
    # JRE version: 6.0_20-b02
    # Java VM: Java HotSpot(TM) Client VM (16.3-b01 mixed mode, sharing windows-x86 )
    # Problematic frame:
    # C [jp2iexp.dll+0x3f5f]
    #
    # If you would like to submit a bug report, please visit:
    # http://java.sun.com/webapps/bugreport/crash.jsp
    # The crash happened outside the Java Virtual Machine in native code.
    # See problematic frame for where to report the bug.
    #

    --------------- T H R E A D ---------------

    Current thread (0x0d114c00): JavaThread "main" [_thread_in_native, id=2864, stack(0x03420000,0x03620000)]

    siginfo: ExceptionCode=0xc0000005, reading address 0x00000000

    Registers:
    EAX=0x00000000, EBX=0x3411a218, ECX=0x0722a2f0, EDX=0x0361d37c
    ESP=0x0361d358, EBP=0x0361d368, ESI=0x00000000, EDI=0x0d114c00
    EIP=0x6d413f5f, EFLAGS=0x00010202

    Top of Stack: (sp=0x0361d358)
    0x0361d358: 0361d37c 0361d364 3411a218 00000000
    0x0361d368: 0361d3a8 0db59f37 0d114d10 0361d3b0
    0x0361d378: 0a2d0408 00000000 0d115354 fffffffe
    0x0361d388: 0361d388 3411a218 0361d3bc 34123020
    0x0361d398: 00000000 3411a218 00000000 0361d3b8
    0x0361d3a8: 0361d3e4 0db52f07 34122a30 0db58276
    0x0361d3b8: 0a2d0408 00000000 321a6d38 0361d3c4
    0x0361d3c8: 3411a187 0361d3ec 34123020 00000000

    Instructions: (pc=0x6d413f5f)
    0x6d413f4f: 33 f6 85 c0 7c 3a 8b 45 fc 8d 55 14 52 89 75 14
    0x6d413f5f: 8b 08 50 ff 91 a0 00 00 00 85 c0 7c 1a 8b 75 14


    Stack: [0x03420000,0x03620000], sp=0x0361d358, free space=7f40361ce3ck
    Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
    C [jp2iexp.dll+0x3f5f]
    j sun.plugin2.main.server.IExplorerPlugin.getDocumentBase0(J)Ljava/lang/String;+0
    j sun.plugin2.main.server.IExplorerPlugin.getDocumentBase()Ljava/lang/String;+31
    j sun.plugin2.main.server.JVMInstance.startApplet(Ljava/util/Map;Lsun/plugin2/main/server/Plugin;JJZIZZ)Z+14
    j sun.plugin2.main.server.JVMManager.startAppletImpl(Ljava/util/Map;Lsun/plugin2/main/server/Plugin;JJZLjava/lang/String;ZIZ)Lsun/plugin2/main/server/AppletID;+240
    j sun.plugin2.main.server.JVMManager.startApplet(Ljava/util/Map;Lsun/plugin2/main/server/Plugin;JJZLjava/lang/String;)Lsun/plugin2/main/server/AppletID;+16
    j sun.plugin2.main.server.JVMManager.startApplet(Ljava/util/Map;Lsun/plugin2/main/server/Plugin;JJZ)Lsun/plugin2/main/server/AppletID;+19
    j sun.plugin2.main.server.IExplorerPlugin.maybeStartApplet()V+192
    j sun.plugin2.main.server.IExplorerPlugin.access$200(Lsun/plugin2/main/server/IExplorerPlugin;)V+1
    j sun.plugin2.main.server.IExplorerPlugin$BackgroundStarter$1.run()V+7
    v ~StubRoutines::call_stub
    V [jvm.dll+0xf049c]
    V [jvm.dll+0x17fcf1]
    V [jvm.dll+0xf051d]
    V [jvm.dll+0xf9e0f]
    V [jvm.dll+0xfcc07]
    C [jp2iexp.dll+0x17a5]
    C [jp2iexp.dll+0x853b]
    C [jp2iexp.dll+0x7a32]
    C [USER32.dll+0x162fa]
    C [USER32.dll+0x16d3a]
    C [USER32.dll+0x177c4]
    C [USER32.dll+0x1788a]
    C [IEFRAME.dll+0xf1c24]
    C [IEFRAME.dll+0x111aee]
    C [iertutil.dll+0x1416c0]
    C [IEFRAME.dll+0xffe33]
    C [kernel32.dll+0x1339a]
    C [ntdll.dll+0x39ef2]
    C [ntdll.dll+0x39ec5]

    Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
    j sun.plugin2.main.server.IExplorerPlugin.getDocumentBase0(J)Ljava/lang/String;+0
    j sun.plugin2.main.server.IExplorerPlugin.getDocumentBase()Ljava/lang/String;+31
    j sun.plugin2.main.server.JVMInstance.startApplet(Ljava/util/Map;Lsun/plugin2/main/server/Plugin;JJZIZZ)Z+14
    j sun.plugin2.main.server.JVMManager.startAppletImpl(Ljava/util/Map;Lsun/plugin2/main/server/Plugin;JJZLjava/lang/String;ZIZ)Lsun/plugin2/main/server/AppletID;+240
    j sun.plugin2.main.server.JVMManager.startApplet(Ljava/util/Map;Lsun/plugin2/main/server/Plugin;JJZLjava/lang/String;)Lsun/plugin2/main/server/AppletID;+16
    j sun.plugin2.main.server.JVMManager.startApplet(Ljava/util/Map;Lsun/plugin2/main/server/Plugin;JJZ)Lsun/plugin2/main/server/AppletID;+19
    j sun.plugin2.main.server.IExplorerPlugin.maybeStartApplet()V+192
    j sun.plugin2.main.server.IExplorerPlugin.access$200(Lsun/plugin2/main/server/IExplorerPlugin;)V+1
    j sun.plugin2.main.server.IExplorerPlugin$BackgroundStarter$1.run()V+7
    v ~StubRoutines::call_stub

    --------------- P R O C E S S ---------------

    Java Threads: ( => current thread )
    0x0d1ebc00 JavaThread "JRE 1.6.0.20 Worker Thread" [_thread_blocked, id=776, stack(0x14c40000,0x14d40000)]
    0x0d1eb800 JavaThread "JRE 1.6.0.20 Output Reader Thread" [_thread_in_native, id=2032, stack(0x14aa0000,0x14ba0000)]
    0x0d1df400 JavaThread "JRE 1.6.0.20 Output Reader Thread" [_thread_in_native, id=5576, stack(0x12f40000,0x13040000)]
    0x0d1eb000 JavaThread "Thread-0" [_thread_in_native, id=5560, stack(0x148f0000,0x149f0000)]
    0x0d1e9800 JavaThread "Java Plug-In Pipe Worker Thread (Server-Side)" daemon [_thread_in_native, id=2072, stack(0x14680000,0x14780000)]
    0x0d168400 JavaThread "traceMsgQueueThread" daemon [_thread_blocked, id=2976, stack(0x10a20000,0x10b20000)]
    0x0d14f000 JavaThread "Low Memory Detector" daemon [_thread_blocked, id=2924, stack(0x10650000,0x10750000)]
    0x0d144000 JavaThread "CompilerThread0" daemon [_thread_blocked, id=2904, stack(0x10470000,0x10570000)]
    0x0d143400 JavaThread "Attach Listener" daemon [_thread_blocked, id=2324, stack(0x10200000,0x10300000)]
    0x0d140000 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=3216, stack(0x0fb60000,0x0fc60000)]
    0x0d13b400 JavaThread "Finalizer" daemon [_thread_blocked, id=352, stack(0x0fe00000,0x0ff00000)]
    0x0d13a000 JavaThread "Reference Handler" daemon [_thread_blocked, id=3220, stack(0x0fc70000,0x0fd70000)]
    =>0x0d114c00 JavaThread "main" [_thread_in_native, id=2864, stack(0x03420000,0x03620000)]

    Other Threads:
    0x0d138c00 VMThread [stack: 0x0d7e0000,0x0d8e0000] [id=1960]
    0x0d150c00 WatcherThread [stack: 0x10800000,0x10900000] [id=2960]

    VM state:not at safepoint (normal execution)

    VM Mutex/Monitor currently owned by a thread: None

    Heap
    def new generation total 4928K, used 1189K [0x32110000, 0x32660000, 0x32bb0000)
    eden space 4416K, 26% used [0x32110000, 0x32239400, 0x32560000)
    from space 512K, 0% used [0x32560000, 0x32560000, 0x325e0000)
    to space 512K, 0% used [0x325e0000, 0x325e0000, 0x32660000)
    tenured generation total 10944K, used 0K [0x32bb0000, 0x33660000, 0x34110000)
    the space 10944K, 0% used [0x32bb0000, 0x32bb0000, 0x32bb0200, 0x33660000)
    compacting perm gen total 12288K, used 703K [0x34110000, 0x34d10000, 0x38110000)
    the space 12288K, 5% used [0x34110000, 0x341bfc58, 0x341bfe00, 0x34d10000)
    ro space 10240K, 51% used [0x38110000, 0x3863ae00, 0x3863ae00, 0x38b10000)
    rw space 12288K, 54% used [0x38b10000, 0x391a72d8, 0x391a7400, 0x39710000)

    Dynamic libraries:
    0x00310000 - 0x003c8000 C:\Program Files (x86)\Internet Explorer\iexplore.exe
    0x77840000 - 0x779c0000 C:\Windows\SysWOW64\ntdll.dll
    0x762a0000 - 0x763b0000 C:\Windows\syswow64\kernel32.dll
    0x766b0000 - 0x766f6000 C:\Windows\syswow64\KERNELBASE.dll
    0x76c30000 - 0x76cd0000 C:\Windows\syswow64\ADVAPI32.dll
    0x75f00000 - 0x75fac000 C:\Windows\syswow64\msvcrt.dll
    0x76000000 - 0x76019000 C:\Windows\SysWOW64\sechost.dll
    0x75c70000 - 0x75d60000 C:\Windows\syswow64\RPCRT4.dll
    0x74f20000 - 0x74f80000 C:\Windows\syswow64\SspiCli.dll
    0x74f10000 - 0x74f1c000 C:\Windows\syswow64\CRYPTBASE.dll
    0x75e00000 - 0x75f00000 C:\Windows\syswow64\USER32.dll
    0x76020000 - 0x760b0000 C:\Windows\syswow64\GDI32.dll
    0x74f80000 - 0x74f8a000 C:\Windows\syswow64\LPK.dll
    0x768c0000 - 0x7695d000 C:\Windows\syswow64\USP10.dll
    0x76240000 - 0x76297000 C:\Windows\syswow64\SHLWAPI.dll
    0x74f90000 - 0x75bda000 C:\Windows\syswow64\SHELL32.dll
    0x76df0000 - 0x76f4c000 C:\Windows\syswow64\ole32.dll
    0x76b10000 - 0x76c21000 C:\Windows\syswow64\urlmon.dll
    0x76960000 - 0x769ef000 C:\Windows\syswow64\OLEAUT32.dll
    0x76700000 - 0x768b8000 C:\Windows\syswow64\iertutil.dll
    0x769f0000 - 0x76b0b000 C:\Windows\syswow64\WININET.dll
    0x75d60000 - 0x75d63000 C:\Windows\syswow64\Normaliz.dll
    0x76630000 - 0x76690000 C:\Windows\system32\IMM32.DLL
    0x76170000 - 0x7623c000 C:\Windows\syswow64\MSCTF.dll
    0x71e10000 - 0x72756000 C:\Windows\system32\IEFRAME.dll
    0x75fb0000 - 0x75fb5000 C:\Windows\syswow64\PSAPI.DLL
    0x71dd0000 - 0x71e0c000 C:\Windows\system32\OLEACC.dll
    0x72860000 - 0x729fe000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
    0x76550000 - 0x765cb000 C:\Windows\syswow64\comdlg32.dll
    0x71460000 - 0x71491000 C:\Program Files (x86)\Internet Explorer\IEShims.dll
    0x74130000 - 0x741b0000 C:\Windows\system32\uxtheme.dll
    0x74cb0000 - 0x74cb8000 C:\Windows\system32\Secur32.dll
    0x74d20000 - 0x74d2b000 C:\Windows\system32\profapi.dll
    0x760e0000 - 0x76115000 C:\Windows\syswow64\WS2_32.dll
    0x75fc0000 - 0x75fc6000 C:\Windows\syswow64\NSI.dll
    0x72e90000 - 0x72ed4000 C:\Windows\system32\dnsapi.DLL
    0x730b0000 - 0x730cc000 C:\Windows\system32\iphlpapi.DLL
    0x730a0000 - 0x730a7000 C:\Windows\system32\WINNSI.DLL
    0x71d10000 - 0x71d1e000 C:\Windows\system32\RpcRtRemote.dll
    0x73c90000 - 0x73ca3000 C:\Windows\system32\dwmapi.dll
    0x71db0000 - 0x71dc6000 C:\Windows\system32\CRYPTSP.dll
    0x71d70000 - 0x71dab000 C:\Windows\system32\rsaenh.dll
    0x6f3c0000 - 0x6ff7b000 C:\Windows\system32\MSHTML.dll
    0x74e40000 - 0x74e49000 C:\Windows\system32\VERSION.dll
    0x763b0000 - 0x7654d000 C:\Windows\syswow64\setupapi.dll
    0x76f50000 - 0x76f77000 C:\Windows\syswow64\CFGMGR32.dll
    0x76690000 - 0x766a2000 C:\Windows\syswow64\DEVOBJ.dll
    0x70ec0000 - 0x70f7a000 C:\Windows\system32\d2d1.dll
    0x70db0000 - 0x70eba000 C:\Windows\system32\DWrite.dll
    0x70fb0000 - 0x71033000 C:\Windows\system32\dxgi.dll
    0x75be0000 - 0x75c63000 C:\Windows\syswow64\CLBCatQ.DLL
    0x71c90000 - 0x71cc2000 C:\Program Files (x86)\Internet Explorer\ieproxy.dll
    0x73300000 - 0x7334c000 C:\Windows\system32\apphelp.dll
    0x10000000 - 0x10188000 C:\Program Files (x86)\Gamers Unite! Snag Bar\Toolbar.dll
    0x74d50000 - 0x74e3b000 C:\Windows\system32\dbghelp.dll
    0x74950000 - 0x74971000 C:\Windows\system32\ntmarta.dll
    0x76120000 - 0x76165000 C:\Windows\syswow64\WLDAP32.dll
    0x05630000 - 0x057b8000 C:\Users\Owner\AppData\LocalLow\FCTB000062781\Toolbar\Toolbar.dll
    0x70d90000 - 0x70da2000 C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    0x72ff0000 - 0x73093000 C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll
    0x73700000 - 0x7378e000 C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCP90.dll
    0x72de0000 - 0x72e64000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\Comctl32.dll
    0x714d0000 - 0x714e0000 C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    0x71ba0000 - 0x71bff000 C:\Windows\system32\SXS.DLL
    0x760b0000 - 0x760dd000 C:\Windows\syswow64\WINTRUST.dll
    0x76cd0000 - 0x76ded000 C:\Windows\syswow64\CRYPT32.dll
    0x77810000 - 0x7781c000 C:\Windows\syswow64\MSASN1.dll
    0x71430000 - 0x7145c000 C:\Windows\system32\d3d10_1.dll
    0x713e0000 - 0x7141a000 C:\Windows\system32\d3d10_1core.dll
    0x708e0000 - 0x70b40000 C:\Windows\system32\atidxx32.dll
    0x70d20000 - 0x70d8f000 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    0x02cb0000 - 0x02cd6000 C:\Program Files (x86)\Webroot\Security\current\plugins\browserextension\WebrootBHO.dll
    0x75fd0000 - 0x75ffa000 C:\Windows\syswow64\imagehlp.dll
    0x70c40000 - 0x70d16000 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\wlidcli.DLL
    0x74d30000 - 0x74d47000 C:\Windows\system32\USERENV.dll
    0x70c10000 - 0x70c33000 C:\Windows\system32\WinSCard.dll
    0x73da0000 - 0x73ed3000 C:\Windows\System32\msxml3.dll
    0x70f80000 - 0x70fae000 C:\Windows\system32\mlang.dll
    0x71a50000 - 0x71a88000 C:\Windows\system32\ncrypt.dll
    0x71a30000 - 0x71a47000 C:\Windows\system32\bcrypt.dll
    0x719f0000 - 0x71a2d000 C:\Windows\SysWOW64\bcryptprimitives.dll
    0x719d0000 - 0x719e6000 C:\Windows\system32\GPAPI.dll
    0x70800000 - 0x708de000 C:\Program Files (x86)\Webroot\Security\current\plugins\browserextension\PTCBHOPlugin.dll
    0x6d440000 - 0x6d44c000 C:\Program Files (x86)\Java\jre1.6.0_20\bin\jp2ssv.dll
    0x7c340000 - 0x7c396000 C:\Program Files (x86)\Java\jre1.6.0_20\bin\MSVCR71.dll
    0x07a00000 - 0x07c0d000 C:\Program Files (x86)\Upromise\upromisetoolbar.dll
    0x745e0000 - 0x74612000 C:\Windows\system32\WINMM.dll
    0x03620000 - 0x0366b000 C:\Program Files (x86)\Upromise\dca-api.DLL
    0x73fa0000 - 0x74130000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
    0x74c50000 - 0x74ca8000 C:\Windows\system32\WINHTTP.dll
    0x74c00000 - 0x74c4f000 C:\Windows\system32\webio.dll
    0x70ba0000 - 0x70c0a000 C:\Windows\SysWOW64\vbscript.dll
    0x71520000 - 0x71572000 C:\Windows\system32\RASAPI32.dll
    0x73460000 - 0x73475000 C:\Windows\system32\rasman.dll
    0x73450000 - 0x7345d000 C:\Windows\system32\rtutils.dll
    0x71950000 - 0x71956000 C:\Windows\system32\sensapi.dll
    0x72ee0000 - 0x72f1c000 C:\Windows\system32\mswsock.dll
    0x72dd0000 - 0x72dd5000 C:\Windows\System32\wshtcpip.dll
    0x72db0000 - 0x72dc0000 C:\Windows\system32\NLAapi.dll
    0x72e80000 - 0x72e86000 C:\Windows\system32\rasadhlp.dll
    0x71420000 - 0x71428000 C:\Windows\system32\credssp.dll
    0x72e70000 - 0x72e76000 C:\Windows\System32\wship6.dll
    0x71cf0000 - 0x71d02000 C:\Windows\system32\dhcpcsvc.DLL
    0x71ce0000 - 0x71ced000 C:\Windows\system32\dhcpcsvc6.DLL
    0x72f20000 - 0x72f47000 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
    0x03740000 - 0x03747000 C:\Program Files (x86)\Upromise\UpromiseGlobalCacheProxy.dll
    0x73ee0000 - 0x73f7b000 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80.dll
    0x72d30000 - 0x72d68000 C:\Windows\System32\fwpuclnt.dll
    0x04b00000 - 0x04b4a000 C:\Program Files (x86)\Upromise\cpturlpassthru.dll
    0x707c0000 - 0x707fa000 C:\Windows\SysWOW64\schannel.dll
    0x705f0000 - 0x707ab000 C:\Windows\SysWOW64\jscript9.dll
    0x707b0000 - 0x707bb000 C:\Windows\system32\msimtf.dll
    0x72760000 - 0x72855000 C:\Windows\system32\PROPSYS.dll
    0x06d00000 - 0x06d65000 C:\Windows\SysWow64\deployJava1.dll
    0x719c0000 - 0x719c7000 C:\Windows\SysWow64\WSOCK32.dll
    0x6d410000 - 0x6d42e000 C:\Program Files (x86)\Java\jre1.6.0_20\bin\jp2iexp.dll
    0x72da0000 - 0x72db0000 C:\Windows\system32\napinsp.dll
    0x72d80000 - 0x72d92000 C:\Windows\system32\pnrpnsp.dll
    0x72d70000 - 0x72d78000 C:\Windows\System32\winrnr.dll
    0x6d800000 - 0x6da97000 C:\PROGRA~2\Java\JRE16~1.0_2\bin\client\jvm.dll
    0x6d7b0000 - 0x6d7bc000 C:\PROGRA~2\Java\JRE16~1.0_2\bin\verify.dll
    0x6d330000 - 0x6d34f000 C:\PROGRA~2\Java\JRE16~1.0_2\bin\java.dll
    0x6d290000 - 0x6d298000 C:\PROGRA~2\Java\JRE16~1.0_2\bin\hpi.dll
    0x6d7f0000 - 0x6d7ff000 C:\PROGRA~2\Java\JRE16~1.0_2\bin\zip.dll
    0x6d430000 - 0x6d436000 C:\Program Files (x86)\Java\jre1.6.0_20\bin\jp2native.dll
    0x6d1d0000 - 0x6d1e3000 C:\Program Files (x86)\Java\jre1.6.0_20\bin\deploy.dll
    0x6d610000 - 0x6d623000 C:\Program Files (x86)\Java\jre1.6.0_20\bin\net.dll
    0x6d630000 - 0x6d639000 C:\Program Files (x86)\Java\jre1.6.0_20\bin\nio.dll

    VM Arguments:
    jvm_args: -Xbootclasspath/a:C:\PROGRA~2\Java\JRE16~1.0_2\lib\deploy.jar;C:\PROGRA~2\Java\JRE16~1.0_2\lib\javaws.jar;C:\PROGRA~2\Java\JRE16~1.0_2\lib\plugin.jar -Xmx32m -Djava.awt.headless=true -Dkernel.background.download=false -Dkernel.download.dialog=false -XX:MaxDirectMemorySize=64m
    java_command: <unknown>
    Launcher Type: generic

    Environment Variables:
    CLASSPATH=.;C:\Program Files (x86)\Java\jre6\lib\ext\QTJava.zip
    PATH=C:\Program Files (x86)\Internet Explorer;;C:\Windows\system32;C:\Windows;C:\Windows\system32\wbem;C:\Program Files\Common Files\Microsoft Shared\Windows Live;C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86;C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files (x86)\QuickTime\QTSystem;C:\Program Files (x86)\Windows Live\Shared
    USERNAME=Owner
    OS=Windows_NT
    PROCESSOR_IDENTIFIER=AMD64 Family 15 Model 124 Stepping 2, AuthenticAMD



    --------------- S Y S T E M ---------------

    OS: Windows 7 Build 7601 Service Pack 1

    CPU:total 1 (1 cores per cpu, 1 threads per core) family 15 model 124 stepping 2, cmov, cx8, fxsr, mmx, sse, sse2, sse3, mmxext, 3dnow, 3dnowext

    Memory: 4k page, physical 2879540k(1689052k free), swap 5757232k(4093788k free)

    vm_info: Java HotSpot(TM) Client VM (16.3-b01) for windows-x86 JRE (1.6.0_20-b02), built on Apr 12 2010 13:52:23 by "java_re" with MS VC++ 7.1 (VS2003)

    time: Mon Mar 05 20:45:18 2012
    elapsed time: 1 seconds

    then 5 called hs_err_pid4884
    as well 2 other both ending with different numbers? for a total of 19 on my desktop, like I need more on this poor laptop lol
     
  22. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    You can delete those logs.
     
  23. debym

    debym TS Rookie Topic Starter Posts: 23

    I have tried many times it wont run it downloads says it is starting then tells me I am not connected to the internet (but I am) ??? So sorry for all the problems, but very thankful for your help.
     
  24. Broni

    Broni Malware Annihilator Posts: 52,904   +344

    You tried to download what?
     
  25. debym

    debym TS Rookie Topic Starter Posts: 23

    This when I click the online scan it starts then tells me I am not online? I could not do the other one either as the other said no proxy.
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...