TechSpot

Stubborn backdoor infection

Solved
By whiteknight1950
Aug 8, 2012
  1. Hello

    I'm a new user here. Terrific forum for troubled users.

    I discovered that Windows Defender preferences had been changed to manual. Ran SystemCare 5 which discovered a Backdoor trojan. Sorry, I did not keep the details.

    Now I can boot up but if I attempt to install another malware like Comodo, I get a BSOD. I have run Roguekiller and attach a report. I have also run the Farbar Recovery Scan and have the frst.txt and services.exe results.

    Rootkiller report is:


    RogueKiller V7.6.5 [08/03/2012] by Tigzy
    mail: tigzyRK<at>gmail<dot>com
    Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
    Blog: http://tigzyrk.blogspot.com

    Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
    Started in : Normal mode
    User: Mikes [Admin rights]
    Mode: Scan -- Date: 08/07/2012 17:22:41

    ¤¤¤ Bad processes: 0 ¤¤¤

    ¤¤¤ Registry Entries: 4 ¤¤¤
    [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
    [HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
    [HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
    [HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver: [LOADED] ¤¤¤

    ¤¤¤ Infection : ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤


    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: WDC WD15 00ADFD-00NLR SCSI Disk Device +++++
    --- User ---
    [MBR] ff2ecf268d7af06607021fb345bdc36f
    [BSP] 681538495c3e4354c8b7457cd59889df : Windows 7 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 89999 Mo
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 184322048 | Size: 53087 Mo
    User = LL1 ... OK!
    Error reading LL2 MBR!

    +++++ PhysicalDrive1: WDC WD50 00AAKS-00UU3 SCSI Disk Device +++++
    --- User ---
    [MBR] c074465a049331b64a83e62ff3ac15bd
    [BSP] 542b1c9950b67d6fe021c7990e059f6f : Windows Vista MBR Code
    Partition table:
    0 - [XXXXXX] UNKNOWN (0xee) [VISIBLE] Offset (sectors): 1 | Size: 2097151 Mo
    User = LL1 ... OK!
    Error reading LL2 MBR!

    Finished : << RKreport[1].txt >>
    RKreport[1].txt

    If someone is interested could they let me know and I will post the frst.txt and services.exe from Farbar Scan. I think that the Virus has created an extensive whitelist of its own which is blocking my attempt to intall another viruskiller !

    Cheers
    Whiteknight
     
  2. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    I mistakenly PM'd Dragonmaster in an attempt to get help and now realize that was against the Forum Rules. I apologize. Her is the frst.text of Farbar Scan.

    Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 08-08-2012
    Ran by SYSTEM at 08-08-2012 14:42:47
    Running from G:\
    Windows 7 Home Premium (X86) OS Language: English(US)
    The current controlset is ControlSet001

    ========================== Registry (Whitelisted) =============

    HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.)
    HKLM\...\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot [296056 2012-05-25] (RealNetworks, Inc.)
    HKLM\...\Run: [Cmaudio8788] RunDll32 cmicnfgp.cpl,CMICtrlWnd [x]
    HKLM\...\Run: [Cmaudio8788GX] C:\Windows\system\HsMgr.exe Envoke [200704 2008-07-11] ()
    HKLM\...\Run: [NVRaidService] C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe [163944 2010-04-09] (NVIDIA Corporation)
    HKLM\...\Run: [Malwarebytes' Anti-Malware] "d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [x]
    HKU\Mikes\...\Run: [Advanced SystemCare 5] "D:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart [x]
    HKU\Mikes\...\Run: [Akamai NetSession Interface] "C:\Users\Mikes\AppData\Local\Akamai\netsession_win.exe" [4327744 2012-05-26] (Akamai Technologies, Inc)
    HKU\Mikes\...\Policies\system: [EnableLUA] 0
    Tcpip\Parameters: [DhcpNameServer] 10.0.1.1

    ================================ Services (Whitelisted) ==================

    2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [20992 2009-07-13] (Microsoft Corporation)
    2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [387616 2009-08-10] ()
    2 IMFservice; C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe [821592 2012-01-09] (IObit)
    2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [11552 2012-03-26] (Microsoft Corporation)
    3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [214952 2012-03-26] (Microsoft Corporation)
    2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [178720 2009-08-10] ()
    2 nvUpdatusService; C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [1262400 2012-05-15] (NVIDIA Corporation)
    2 AdvancedSystemCareService5; C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe [x]
    2 MBAMService; "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [x]
    3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2011.SP4\RpcAgentSrv.exe [x]

    ========================== Drivers (Whitelisted) =============

    3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [1760256 2011-03-10] (C-Media Inc)
    2 cpuz135; \??\C:\Windows\system32\drivers\cpuz135_x32.sys [21992 2010-11-09] (CPUID)
    3 DrvAgent32; \??\C:\Windows\system32\Drivers\DrvAgent32.sys [23456 2012-06-23] (Phoenix Technologies)
    1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [31088 2010-12-16] (Elaborate Bytes AG)
    3 FileMonitor; \??\C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [20336 2012-01-05] (IObit)
    0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
    3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [22344 2012-07-03] (Malwarebytes Corporation)
    0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
    3 NVNET; C:\Windows\System32\DRIVERS\nvmf6232.sys [295272 2009-11-11] (NVIDIA Corporation)
    3 RegFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [30600 2011-09-20] (IObit.com)
    0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [15672 2010-11-26] ()
    0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
    0 sptd; C:\Windows\System32\Drivers\sptd.sys [477240 2012-07-09] (Duplex Secure Ltd.)
    3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26112 2011-07-13] (The OpenVPN Project)
    3 UrlFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [19792 2011-09-20] (IObit.com)
    1 MpKsl692f6064; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{ADA8B66C-DDC9-484E-9A94-A5A08E37B707}\MpKsl692f6064.sys [x]
    3 RTCore32; \??\D:\Program Files\EVGA Precision\RTCore32.sys [x]
    3 SANDRA; \??\d:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP4c\WNt500x86\Sandra.sys [x]

    ========================== NetSvcs (Whitelisted) ===========


    ============ One Month Created Files and Folders ==============

    2012-08-08 13:22 - 2012-08-08 13:22 - 336178085 ____A C:\Windows\MEMORY.DMP
    2012-08-08 13:22 - 2012-08-08 13:22 - 00155288 ____A C:\Windows\Minidump\080812-29998-01.dmp
    2012-08-08 13:22 - 2012-08-08 13:22 - 00000056 ____A C:\Windows\setupact.log
    2012-08-08 13:22 - 2012-08-08 13:22 - 00000000 ____A C:\Windows\setuperr.log
    2012-08-08 13:12 - 2012-08-08 13:12 - 00000000 ____D C:\Program Files\COMODO
    2012-08-08 01:19 - 2012-08-08 01:19 - 03907920 ____A (Piriform Ltd) C:\Users\Mikes\Downloads\ccsetup321.exe
    2012-08-07 17:48 - 2012-08-07 17:48 - 00000000 ____D C:\FRST
    2012-08-07 16:30 - 2012-08-07 16:30 - 00892900 ____A (Farbar) C:\Users\Mikes\Downloads\FRST.exe
    2012-08-07 16:22 - 2012-08-07 16:22 - 00001667 ____A C:\Users\Mikes\Desktop\RKreport[1].txt
    2012-08-07 16:21 - 2012-08-07 16:22 - 00000000 ____D C:\Users\Mikes\Desktop\RK_Quarantine
    2012-08-06 16:01 - 2012-08-07 10:42 - 00000000 ____D C:\Program Files\Vuze
    2012-08-06 15:23 - 2012-08-06 15:23 - 00000000 ____D C:\Users\Mikes\AppData\Local\Apps\2.0
    2012-08-06 15:11 - 2012-08-06 15:11 - 00000689 ____A C:\Users\UpdatusUser\Desktop\Free Window Registry Repair.lnk
    2012-08-06 15:11 - 2012-08-06 15:11 - 00000689 ____A C:\Users\Mikes\Desktop\Free Window Registry Repair.lnk
    2012-08-06 15:11 - 2012-08-06 15:10 - 00799416 ____A C:\Users\Mikes\Downloads\RegpairSetup.exe
    2012-08-06 15:10 - 2012-08-06 15:10 - 00463080 ____A (CNET Download.com) C:\Users\Mikes\Downloads\cnet2_RegpairSetup_exe.exe
    2012-08-06 15:02 - 2012-08-06 15:02 - 00000114 ____A C:\Users\Mikes\Downloads\renew-ip-reset-winsock.bat
    2012-08-05 15:06 - 2012-08-08 02:06 - 00000000 ____D C:\Users\All Users\Malwarebytes
    2012-08-05 15:06 - 2012-08-05 15:06 - 00000763 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2012-08-05 15:06 - 2012-08-05 15:06 - 00000000 ____D C:\Users\Mikes\AppData\Roaming\Malwarebytes
    2012-08-05 15:06 - 2012-07-03 12:46 - 00022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
    2012-08-02 09:05 - 2012-08-02 09:08 - 00000000 ____D C:\Users\Mikes\Documents\Asus Xonar Dx
    2012-08-02 09:04 - 2012-08-08 14:20 - 00000000 ____D C:\Users\Mikes\AppData\Local\Akamai
    2012-08-02 09:04 - 2012-08-02 09:04 - 10720808 ____A (Akamai Technologies, Inc) C:\Users\Mikes\Downloads\AsusInstaller.exe
    2012-08-01 11:56 - 2012-08-01 11:56 - 00000689 ____A C:\Users\UpdatusUser\Desktop\SpeedFan.lnk
    2012-08-01 11:56 - 2012-08-01 11:56 - 00000689 ____A C:\Users\Mikes\Desktop\SpeedFan.lnk
    2012-08-01 11:56 - 2012-08-01 11:56 - 00000045 ____A C:\Windows\System32\initdebug.nfo
    2012-08-01 10:50 - 2012-08-08 02:08 - 00000000 ____D C:\Windows\pss
    2012-07-31 09:41 - 2012-07-31 09:41 - 00000000 ____D C:\Users\Mikes\Documents\SniperEliteV2_Benchmark
    2012-07-30 10:07 - 2012-08-08 02:08 - 00000000 ____D C:\Users\Mikes\AppData\Local\SniperV2
    2012-07-22 17:28 - 2012-08-08 01:20 - 00000000 ____D C:\Users\Mikes\AppData\Roaming\uTorrent
    2012-07-22 17:28 - 2012-07-22 17:28 - 00000637 ____A C:\Users\Public\Desktop\µTorrent.lnk
    2012-07-18 17:50 - 2012-07-18 17:50 - 00000000 ____D C:\Users\Mikes\AppData\Local\Spoon
    2012-07-18 10:33 - 2012-08-08 02:08 - 00000000 ____D C:\Program Files\Vuze_Remote
    2012-07-18 10:33 - 2012-07-18 10:33 - 00000000 ____D C:\Program Files\Conduit
    2012-07-15 15:14 - 2012-07-15 15:14 - 00000000 ____D C:\Windows\Sun
    2012-07-11 15:19 - 2012-06-02 01:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
    2012-07-11 15:19 - 2012-06-02 00:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
    2012-07-11 15:19 - 2012-06-02 00:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
    2012-07-11 15:19 - 2012-06-02 00:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
    2012-07-11 15:19 - 2012-06-02 00:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
    2012-07-11 15:19 - 2012-06-02 00:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
    2012-07-11 15:19 - 2012-06-02 00:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
    2012-07-11 15:19 - 2012-06-02 00:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
    2012-07-11 15:19 - 2012-06-02 00:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
    2012-07-11 15:19 - 2012-06-02 00:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
    2012-07-11 15:19 - 2012-06-02 00:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
    2012-07-11 15:19 - 2012-06-02 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
    2012-07-11 15:19 - 2012-06-02 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
    2012-07-11 15:19 - 2012-06-02 00:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
    2012-07-11 15:17 - 2012-06-11 18:40 - 02345984 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
    2012-07-11 08:30 - 2012-06-08 20:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
    2012-07-11 08:30 - 2012-06-05 21:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
    2012-07-11 08:30 - 2012-06-05 21:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
    2012-07-11 08:30 - 2012-06-05 21:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll
    2012-07-11 08:30 - 2012-06-01 20:45 - 00134000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
    2012-07-11 08:30 - 2012-06-01 20:45 - 00067440 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
    2012-07-11 08:30 - 2012-06-01 20:40 - 00369336 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
    2012-07-11 08:30 - 2012-06-01 20:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
    2012-07-11 08:30 - 2012-06-01 20:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
    2012-07-11 08:30 - 2010-06-25 19:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll
    2012-07-10 09:29 - 2012-07-10 09:29 - 00001106 ____A C:\Users\Public\Desktop\SiSoftware Sandra Professional Business 2011.SP4.lnk
    2012-07-10 09:02 - 2012-08-03 09:49 - 11710464 ____A C:\Users\Mikes\AppData\Roaming\Sandra.mdb
    2012-07-10 08:15 - 2012-07-10 08:15 - 00001769 ____A C:\Users\UpdatusUser\Desktop\MagicISO.lnk
    2012-07-10 08:15 - 2012-07-10 08:15 - 00001769 ____A C:\Users\Mikes\Desktop\MagicISO.lnk
    2012-07-10 08:15 - 2012-07-10 08:15 - 00000000 ____D C:\Program Files\MagicISO
    2012-07-09 17:52 - 2012-07-09 17:53 - 00000000 ____D C:\Users\Mikes\AppData\Roaming\Nero
    2012-07-09 17:51 - 2012-07-09 17:51 - 00002654 ____A C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
    2012-07-09 17:51 - 2012-07-09 17:51 - 00000000 ____D C:\Program Files\Nero
    2012-07-09 17:50 - 2012-07-09 17:51 - 00000000 ____D C:\Users\All Users\Nero
    2012-07-09 17:50 - 2012-07-09 17:51 - 00000000 ____D C:\Program Files\Common Files\Nero
    2012-07-09 17:40 - 2012-07-09 17:40 - 00477240 ____A (Duplex Secure Ltd.) C:\Windows\System32\Drivers\sptd.sys
    2012-07-09 17:39 - 2012-07-09 17:39 - 01065832 ____A C:\Users\Mikes\Downloads\Alcohol120_trial_2.0.2.3931.exe


    ============ 3 Months Modified Files ========================

    2012-08-08 13:40 - 2011-09-07 11:10 - 00000459 ____A C:\Windows\BRWMARK.INI
    2012-08-08 13:40 - 2011-08-26 09:52 - 01107384 ____A C:\Windows\WindowsUpdate.log
    2012-08-08 13:30 - 2009-07-13 20:34 - 00022256 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2012-08-08 13:30 - 2009-07-13 20:34 - 00022256 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2012-08-08 13:25 - 2012-04-03 07:43 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
    2012-08-08 13:22 - 2012-08-08 13:22 - 336178085 ____A C:\Windows\MEMORY.DMP
    2012-08-08 13:22 - 2012-08-08 13:22 - 00155288 ____A C:\Windows\Minidump\080812-29998-01.dmp
    2012-08-08 13:22 - 2012-08-08 13:22 - 00000056 ____A C:\Windows\setupact.log
    2012-08-08 13:22 - 2012-08-08 13:22 - 00000000 ____A C:\Windows\setuperr.log
    2012-08-08 13:22 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
    2012-08-08 01:20 - 2011-08-26 11:03 - 00000689 ____A C:\Users\Public\Desktop\CCleaner.lnk
    2012-08-08 01:19 - 2012-08-08 01:19 - 03907920 ____A (Piriform Ltd) C:\Users\Mikes\Downloads\ccsetup321.exe
    2012-08-08 01:11 - 2011-08-26 09:53 - 00743162 ____A C:\Windows\System32\PerfStringBackup.INI
    2012-08-07 16:30 - 2012-08-07 16:30 - 00892900 ____A (Farbar) C:\Users\Mikes\Downloads\FRST.exe
    2012-08-07 16:22 - 2012-08-07 16:22 - 00001667 ____A C:\Users\Mikes\Desktop\RKreport[1].txt
    2012-08-06 16:32 - 2012-06-19 08:54 - 42381312 ____A C:\Windows\System32\config\software.iobit
    2012-08-06 16:32 - 2012-06-19 08:54 - 19808256 ____A C:\Windows\System32\config\system.iobit
    2012-08-06 16:32 - 2012-06-19 08:54 - 00188416 ____A C:\Windows\System32\config\default.iobit
    2012-08-06 16:32 - 2012-06-19 08:54 - 00061440 ____A C:\Windows\System32\config\sam.iobit
    2012-08-06 16:32 - 2012-06-19 08:54 - 00028672 ____A C:\Windows\System32\config\security.iobit
    2012-08-06 15:11 - 2012-08-06 15:11 - 00000689 ____A C:\Users\UpdatusUser\Desktop\Free Window Registry Repair.lnk
    2012-08-06 15:11 - 2012-08-06 15:11 - 00000689 ____A C:\Users\Mikes\Desktop\Free Window Registry Repair.lnk
    2012-08-06 15:10 - 2012-08-06 15:11 - 00799416 ____A C:\Users\Mikes\Downloads\RegpairSetup.exe
    2012-08-06 15:10 - 2012-08-06 15:10 - 00463080 ____A (CNET Download.com) C:\Users\Mikes\Downloads\cnet2_RegpairSetup_exe.exe
    2012-08-06 15:02 - 2012-08-06 15:02 - 00000114 ____A C:\Users\Mikes\Downloads\renew-ip-reset-winsock.bat
    2012-08-05 15:19 - 2012-03-12 07:20 - 00002198 ____A C:\Windows\epplauncher.mif
    2012-08-05 15:06 - 2012-08-05 15:06 - 00000763 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2012-08-05 14:35 - 2011-12-08 07:59 - 24973312 ____A C:\Windows\System32\config\components.iobit
    2012-08-03 09:49 - 2012-07-10 09:02 - 11710464 ____A C:\Users\Mikes\AppData\Roaming\Sandra.mdb
    2012-08-02 13:25 - 2012-04-03 07:43 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
    2012-08-02 13:25 - 2011-08-26 14:12 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
    2012-08-02 09:09 - 2011-08-27 17:00 - 00413696 ____A (Creative Labs) C:\Windows\System32\wrap_oal.dll
    2012-08-02 09:09 - 2011-08-27 17:00 - 00102400 ____A (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\System32\OpenAL32.dll
    2012-08-02 09:08 - 2011-10-29 14:49 - 00238953 ____A C:\Windows\Cmicnfgp.ini.cfl
    2012-08-02 09:08 - 2011-10-29 14:49 - 00000931 ____A C:\Windows\Cmicnfgp.ini.imi
    2012-08-02 09:04 - 2012-08-02 09:04 - 10720808 ____A (Akamai Technologies, Inc) C:\Users\Mikes\Downloads\AsusInstaller.exe
    2012-08-01 11:56 - 2012-08-01 11:56 - 00000689 ____A C:\Users\UpdatusUser\Desktop\SpeedFan.lnk
    2012-08-01 11:56 - 2012-08-01 11:56 - 00000689 ____A C:\Users\Mikes\Desktop\SpeedFan.lnk
    2012-08-01 11:56 - 2012-08-01 11:56 - 00000045 ____A C:\Windows\System32\initdebug.nfo
    2012-07-22 17:28 - 2012-07-22 17:28 - 00000637 ____A C:\Users\Public\Desktop\µTorrent.lnk
    2012-07-18 10:36 - 2011-08-26 11:45 - 00000629 ____A C:\Users\Public\Desktop\Vuze.lnk
    2012-07-12 07:58 - 2009-07-13 20:33 - 00358048 ____A C:\Windows\System32\FNTCACHE.DAT
    2012-07-11 15:18 - 2011-08-27 15:39 - 57442464 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
    2012-07-11 15:17 - 2009-07-13 18:04 - 00000499 ____A C:\Windows\win.ini
    2012-07-10 09:29 - 2012-07-10 09:29 - 00001106 ____A C:\Users\Public\Desktop\SiSoftware Sandra Professional Business 2011.SP4.lnk
    2012-07-10 08:15 - 2012-07-10 08:15 - 00001769 ____A C:\Users\UpdatusUser\Desktop\MagicISO.lnk
    2012-07-10 08:15 - 2012-07-10 08:15 - 00001769 ____A C:\Users\Mikes\Desktop\MagicISO.lnk
    2012-07-09 17:51 - 2012-07-09 17:51 - 00002654 ____A C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
    2012-07-09 17:40 - 2012-07-09 17:40 - 00477240 ____A (Duplex Secure Ltd.) C:\Windows\System32\Drivers\sptd.sys
    2012-07-09 17:39 - 2012-07-09 17:39 - 01065832 ____A C:\Users\Mikes\Downloads\Alcohol120_trial_2.0.2.3931.exe
    2012-07-03 12:46 - 2012-08-05 15:06 - 00022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
    2012-06-23 10:18 - 2012-06-23 10:18 - 00624672 ____A (Copyright © 2010 eSupport.com. All Rights Reserved.) C:\Users\Mikes\Downloads\biosagentplus_40.exe
    2012-06-23 10:18 - 2012-06-23 10:18 - 00023456 ____A (Phoenix Technologies) C:\Windows\System32\Drivers\DrvAgent32.sys
    2012-06-23 10:18 - 2012-06-23 10:18 - 00001090 ____A C:\Users\Mikes\Desktop\BiosAgent Plus.lnk
    2012-06-23 09:55 - 2009-07-13 20:53 - 00032638 ____A C:\Windows\Tasks\SCHEDLGU.TXT
    2012-06-17 11:15 - 2012-06-17 11:15 - 00514560 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
    2012-06-12 16:33 - 2012-06-12 16:33 - 00001260 ____A C:\Users\Mikes\Desktop\MW3 use me.lnk
    2012-06-11 18:40 - 2012-07-11 15:17 - 02345984 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
    2012-06-08 20:41 - 2012-07-11 08:30 - 12873728 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
    2012-06-07 12:20 - 2012-06-07 12:20 - 00151282 ____N C:\Users\Mikes\Documents\doc-04-78-docsviewer.googleusercontent.com-viewer-securedownload-ponunvtemoqk0uk59r6vfphkre2u5t07-ir7ca55ra7ujcotvanrr2lqkdgslgqhu-1339100100000-Z21haWw=-AGZ5hq_xlJIV0qVl8tNk0aZNeLfC-MTM3OWY5NzBmMjk4NjIxYXwwLjEuMQ==.tif
    2012-06-07 12:19 - 2012-06-07 12:19 - 00198308 ____N C:\Users\Mikes\Documents\MTM3OWY5N2Y4NWUxZDY3MXwwLjEuMQ==.tif
    2012-06-05 21:05 - 2012-07-11 08:30 - 01390080 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
    2012-06-05 21:05 - 2012-07-11 08:30 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
    2012-06-05 21:03 - 2012-07-11 08:30 - 00805376 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll
    2012-06-02 14:19 - 2012-06-21 08:29 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
    2012-06-02 14:19 - 2012-06-21 08:29 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
    2012-06-02 14:19 - 2012-06-21 08:29 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
    2012-06-02 14:19 - 2012-06-21 08:29 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
    2012-06-02 14:19 - 2012-06-21 08:29 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
    2012-06-02 14:19 - 2012-06-21 08:29 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
    2012-06-02 14:12 - 2012-06-21 08:29 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
    2012-06-02 14:12 - 2012-06-21 08:29 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
    2012-06-02 14:12 - 2012-06-21 08:29 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
    2012-06-02 01:07 - 2012-07-11 15:19 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
    2012-06-02 00:43 - 2012-07-11 15:19 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
    2012-06-02 00:33 - 2012-07-11 15:19 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
    2012-06-02 00:26 - 2012-07-11 15:19 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
    2012-06-02 00:25 - 2012-07-11 15:19 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
    2012-06-02 00:25 - 2012-07-11 15:19 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
    2012-06-02 00:23 - 2012-07-11 15:19 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
    2012-06-02 00:21 - 2012-07-11 15:19 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
    2012-06-02 00:20 - 2012-07-11 15:19 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
    2012-06-02 00:19 - 2012-07-11 15:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
    2012-06-02 00:19 - 2012-07-11 15:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
    2012-06-02 00:17 - 2012-07-11 15:19 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
    2012-06-02 00:16 - 2012-07-11 15:19 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
    2012-06-02 00:14 - 2012-07-11 15:19 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
    2012-06-01 20:45 - 2012-07-11 08:30 - 00134000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
    2012-06-01 20:45 - 2012-07-11 08:30 - 00067440 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
    2012-06-01 20:40 - 2012-07-11 08:30 - 00369336 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
    2012-06-01 20:40 - 2012-07-11 08:30 - 00225280 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
    2012-06-01 20:39 - 2012-07-11 08:30 - 00219136 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
    2012-05-25 18:02 - 2012-05-25 18:02 - 00001012 ____A C:\Users\Public\Desktop\RealPlayer.lnk
    2012-05-25 18:01 - 2011-12-28 08:43 - 00499712 ____A (Microsoft Corporation) C:\Windows\System32\msvcp71.dll
    2012-05-25 18:01 - 2011-12-28 08:43 - 00198832 ____A (RealNetworks, Inc.) C:\Windows\System32\rmoc3260.dll
    2012-05-25 18:01 - 2011-12-28 08:43 - 00006656 ____A (RealNetworks, Inc.) C:\Windows\System32\pndx5016.dll
    2012-05-25 18:01 - 2011-12-28 08:43 - 00005632 ____A (RealNetworks, Inc.) C:\Windows\System32\pndx5032.dll
    2012-05-25 18:01 - 2011-10-14 11:56 - 00272896 ____A (Progressive Networks) C:\Windows\System32\pncrt.dll
    2012-05-15 02:26 - 2012-06-23 10:27 - 19607872 ____A (NVIDIA Corporation) C:\Windows\System32\nvoglv32.dll
    2012-05-15 02:26 - 2012-06-23 10:27 - 17551680 ____A (NVIDIA Corporation) C:\Windows\System32\nvcompiler.dll
    2012-05-15 02:26 - 2012-06-23 10:27 - 15322432 ____A (NVIDIA Corporation) C:\Windows\System32\nvd3dum.dll
    2012-05-15 02:26 - 2012-06-23 10:27 - 11354944 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvlddmkm.sys
    2012-05-15 02:26 - 2012-06-23 10:27 - 05982528 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuda.dll
    2012-05-15 02:26 - 2012-06-23 10:27 - 02524992 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvid.dll
    2012-05-15 02:26 - 2012-06-23 10:27 - 02445120 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvenc.dll
    2012-05-15 02:26 - 2012-06-23 10:27 - 00301376 ____A (NVIDIA Corporation) C:\Windows\System32\nvdecodemft.dll
    2012-05-15 02:26 - 2012-06-23 10:27 - 00202048 ____A (NVIDIA Corporation) C:\Windows\System32\nvinit.dll
    2012-05-15 02:26 - 2012-03-13 15:35 - 00061248 ____A (Khronos Group) C:\Windows\System32\OpenCL.dll
    2012-05-15 02:26 - 2012-02-21 11:36 - 00818496 ____A (NVIDIA Corporation) C:\Windows\System32\nvumdshim.dll
    2012-05-15 02:26 - 2011-08-26 10:36 - 08105280 ____A (NVIDIA Corporation) C:\Windows\System32\nvwgf2um.dll
    2012-05-15 02:26 - 2011-08-26 10:36 - 01000768 ____A (NVIDIA Corporation) C:\Windows\System32\nvdispco32.dll
    2012-05-15 02:26 - 2011-08-26 10:36 - 00883008 ____A (NVIDIA Corporation) C:\Windows\System32\nvgenco32.dll
    2012-05-15 02:26 - 2011-05-21 05:01 - 02368832 ____A (NVIDIA Corporation) C:\Windows\System32\nvapi.dll
    2012-05-15 02:26 - 2011-05-21 05:01 - 00011190 ____A C:\Windows\System32\nvinfo.pb
    2012-05-15 01:28 - 2012-02-21 11:36 - 02621723 ____A C:\Windows\System32\nvcoproc.bin
    2012-05-15 01:28 - 2011-08-26 09:59 - 03931456 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
    2012-05-15 01:28 - 2011-08-26 09:59 - 00645440 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    2012-05-15 01:28 - 2011-08-26 09:59 - 00108352 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
    2012-05-15 01:28 - 2011-08-26 09:59 - 00062272 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
    2012-05-15 01:27 - 2011-08-26 09:59 - 02759488 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll
    2012-05-15 01:21 - 2012-05-15 01:21 - 00423744 ____A C:\Windows\System32\nvStreaming.exe
    2012-05-11 08:08 - 2012-05-11 08:08 - 03968368 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
    2012-05-11 08:08 - 2012-05-11 08:08 - 03913072 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
    2012-05-11 08:08 - 2012-05-11 08:08 - 01291632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
    2012-05-11 08:08 - 2012-05-11 08:08 - 00056176 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys
    2012-05-11 08:05 - 2012-05-11 08:05 - 01077248 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll


    ========================= Known DLLs (Whitelisted) ============


    ========================= Bamital & volsnap Check ============

    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

    ==================== EXE ASSOCIATION =====================

    HKLM\...\.exe: exefile => OK
    HKLM\...\exefile\DefaultIcon: %1 => OK
    HKLM\...\exefile\open\command: "%1" %* => OK

    ========================= Memory info ======================

    Percentage of memory in use: 11%
    Total physical RAM: 4094.54 MB
    Available physical RAM: 3609.64 MB
    Total Pagefile: 4092.82 MB
    Available Pagefile: 3611.51 MB
    Total Virtual: 2047.88 MB
    Available Virtual: 1967.22 MB

    ======================= Partitions =========================

    1 Drive c: () (Fixed) (Total:87.89 GB) (Free:49.01 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
    2 Drive d: (NewWest) (Fixed) (Total:465.63 GB) (Free:236.27 GB) NTFS
    3 Drive e: (Games) (Fixed) (Total:51.84 GB) (Free:31.97 GB) NTFS
    5 Drive g: () (Removable) (Total:0.12 GB) (Free:0.12 GB) FAT
    6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

    Disk ### Status Size Free Dyn Gpt
    -------- ------------- ------- ------- --- ---
    Disk 0 Online 139 GB 0 B
    Disk 1 Online 465 GB 1024 KB *
    Disk 2 Online 122 MB 0 B

    Partitions of Disk 0:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Primary 87 GB 1024 KB
    Partition 2 Primary 51 GB 87 GB

    ==================================================================================

    Disk: 0
    Partition 1
    Type : 07
    Hidden: No
    Active: Yes

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 1 C NTFS Partition 87 GB Healthy

    ==================================================================================

    Disk: 0
    Partition 2
    Type : 07
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 2 E Games NTFS Partition 51 GB Healthy

    ==================================================================================

    Partitions of Disk 1:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Reserved 128 MB 17 KB
    Partition 2 Primary 465 GB 129 MB

    ==================================================================================

    Disk: 1
    Partition 1
    Type : e3c9e316-0b5c-4db8-817d-f92df00215ae
    Hidden : Yes
    Required: No
    Attrib : 0000000000000000

    There is no volume associated with this partition.

    ==================================================================================

    Disk: 1
    Partition 2
    Type : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Hidden : No
    Required: No
    Attrib : 0000000000000000

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 3 D NewWest NTFS Partition 465 GB Healthy

    ==================================================================================

    Partitions of Disk 2:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Primary 122 MB 16 KB

    ==================================================================================

    Disk: 2
    Partition 1
    Type : 06
    Hidden: No
    Active: Yes

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 4 G FAT Removable 122 MB Healthy

    ==================================================================================

    ==========================================================

    Last Boot: 2012-07-31 10:39

    ======================= End Of Log ==========================
     
  3. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    This is the Services.exe from Farbar Scan

    Farbar Recovery Scan Tool Version: 08-08-2012
    Ran by SYSTEM at 2012-08-08 14:43:50
    Running from G:\

    ================== Search: "services.exe" ===================

    C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe
    [2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6

    C:\Windows\System32\services.exe
    [2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6

    === End Of Search ===
     
  4. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    Any advice about how to get rid of this pesky fellow and preventing its return would be greatly appreciated !!

    Cheers
    Whiteknight1950
     
  5. Broni

    Broni Malware Annihilator Posts: 47,975   +271

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ========================================

    Uninstall Advanced SystemCare 5.
    Registry cleaners/optimizers are not recommended for several reasons:

    • Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

      The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
    • Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
    • Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
    • Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
    • The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".
    Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.

     
  6. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    Hello and thanks for your prompt reply to my post.

    I will download and install Comodo once this process is finished.

    Malwarebytes log is:

    Malwarebytes Anti-Malware (Trial) 1.62.0.1300
    www.malwarebytes.org

    Database version: v2012.08.08.11

    Windows 7 Service Pack 1 x86 NTFS
    Internet Explorer 9.0.8112.16421
    Mikes :: MIKES-PC [administrator]

    Protection: Disabled

    8/8/2012 5:10:19 PM
    mbam-log-2012-08-08 (17-10-19).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 201424
    Time elapsed: 2 minute(s), 49 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)


    The Gmer log is:

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2012-08-08 17:28:43
    Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\00000061 WDC_WD15 rev.21.0
    Running: gmer.exe; Driver: C:\Users\Mikes\AppData\Local\Temp\kgloypow.sys


    ---- Devices - GMER 1.0.15 ----

    Device \Driver\atapi \Device\Ide\IdePort0 857A61E8
    Device \Driver\atapi \Device\Ide\IdePort1 857A61E8
    Device \Driver\VClone \Device\Scsi\VClone1Port5Path0Target0Lun0 86E221E8
    Device \Driver\VClone \Device\Scsi\VClone1 86E221E8
    Device \FileSystem\Ntfs \Ntfs 857AA1E8
    Device \FileSystem\fastfat \Fat 87D2F430

    AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

    ---- EOF - GMER 1.0.15 ----
     
  7. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    Thanks again, the DDS otl is:

    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31
    Run by Mikes at 17:32:03 on 2012-08-08
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2815.1838 [GMT -7:00]
    .
    AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    D:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Program Files\Microsoft Security Client\MsMpEng.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
    C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\taskeng.exe
    D:\Program Files\IObit\Smart Defrag 2\SmartDefrag.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Real\RealPlayer\Update\realsched.exe
    C:\Windows\system\HsMgr.exe
    C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe
    D:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe
    C:\Users\Mikes\AppData\Local\Akamai\netsession_win.exe
    C:\Users\Mikes\AppData\Local\Akamai\netsession_win.exe
    C:\Program Files\ASUS Xonar DX Audio\Customapp\ASUSAUDIOCENTER.EXE
    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\PROGRAM FILES\MICROSOFT INTELLIPOINT\IPOINT.EXE
    C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
    D:\PROGRAM FILES\ITUNES\ITUNESHELPER.EXE
    C:\PROGRAM FILES\MICROSOFT SECURITY CLIENT\MSSECES.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\svchost.exe -k SDRSVC
    D:\Program Files\Mozilla Firefox\firefox.exe
    D:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
    C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://search.babylon.com/?AF=109932&babsrc=HP_ss&mntrId=6024ca09000000000000044b80808004
    uInternet Settings,ProxyOverride = *.local;<local>
    uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuze.dll
    mURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuze.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
    BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuze.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuze.dll
    uRun: [Advanced SystemCare 5] "d:\program files\iobit\advanced systemcare 5\ASCTray.exe" /AutoStart
    uRun: [Akamai NetSession Interface] "c:\users\mikes\appdata\local\akamai\netsession_win.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
    mRun: [Cmaudio8788] RunDll32 cmicnfgp.cpl,CMICtrlWnd
    mRun: [Cmaudio8788GX] c:\windows\system\HsMgr.exe Envoke
    mRun: [NVRaidService] c:\program files\nvidia corporation\raid\nvraidservice.exe
    mRun: [Malwarebytes' Anti-Malware] "d:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    mRunOnce: [Malwarebytes Anti-Malware] d:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
    uPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
    IE: E&xport to Microsoft Excel - d:\progra~1\micros~1\office11\EXCEL.EXE/3000
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\progra~1\micros~1\office11\REFIEBAR.DLL
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    TCP: DhcpNameServer = 10.0.1.1
    TCP: Interfaces\{DA014566-975D-44D4-BB0A-43528C765950} : DhcpNameServer = 10.0.1.1
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\mikes\appdata\roaming\mozilla\firefox\profiles\qhxebwz1.default\
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
    FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
    FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
    FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
    FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
    FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
    FF - plugin: c:\users\mikes\appdata\roaming\mozilla\firefox\profiles\qhxebwz1.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\plugins\np-mswmp.dll
    FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_270.dll
    FF - plugin: d:\program files\itunes\mozilla plugins\npitunes.dll
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: browser.cache.memory.capacity - 65536
    FF - user.js: browser.chrome.favicons - false
    FF - user.js: browser.display.show_image_placeholders - true
    FF - user.js: browser.turbo.enabled - true
    FF - user.js: browser.urlbar.autocomplete.enabled - true
    FF - user.js: browser.urlbar.autofill - true
    FF - user.js: browser.xul.error_pages.enabled - true
    FF - user.js: content.interrupt.parsing - true
    FF - user.js: content.max.tokenizing.time - 3000000
    FF - user.js: content.maxtextrun - 8191
    FF - user.js: content.notify.backoffcount - 5
    FF - user.js: content.notify.interval - 750000
    FF - user.js: content.notify.ontimer - true
    FF - user.js: content.switch.threshold - 750000
    FF - user.js: network.http.max-connections - 32
    FF - user.js: network.http.max-connections-per-server - 8
    FF - user.js: network.http.max-persistent-connections-per-proxy - 8
    FF - user.js: network.http.max-persistent-connections-per-server - 4
    FF - user.js: network.http.pipelining - true
    FF - user.js: network.http.pipelining.maxrequests - 8
    FF - user.js: network.http.proxy.pipelining - true
    FF - user.js: network.http.request.max-start-delay - 0
    FF - user.js: nglayout.initialpaint.delay - 0
    FF - user.js: plugin.expose_full_path - true
    FF - user.js: ui.submenuDelay - 0
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    FF - user.js: extensions.BabylonToolbar_i.id - 6024ca09000000000000044b80808004
    FF - user.js: extensions.BabylonToolbar_i.hardId - 6024ca09000000000000044b80808004
    FF - user.js: extensions.BabylonToolbar_i.instlDay - 15408
    FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1719:21:30
    FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
    FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
    FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
    FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
    FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
    FF - user.js: extensions.BabylonToolbar_i.newTab - false
    FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109932
    FF - user.js: extensions.BabylonToolbar_i.babExt -
    FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
    FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 171064]
    R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2012-1-16 15672]
    R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]
    R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;d:\program files\iobit\advanced systemcare 5\ASCService.exe [2011-12-10 478040]
    R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2011-9-2 21992]
    R2 IMFservice;IMF Service;c:\program files\iobit\iobit malware fighter\IMFsrv.exe [2011-12-17 821592]
    R3 cmudaxp;ASUS Xonar DX Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2011-10-29 1760256]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-8-5 22344]
    R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2012-6-23 148800]
    R3 RegFilter;RegFilter;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\RegFilter.sys [2012-3-10 30600]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 MBAMService;MBAMService;d:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-8-8 655944]
    S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-2-10 1262400]
    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-3 250056]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
    S3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\drivers\BrSerIb.sys [2009-7-13 265088]
    S3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\drivers\BrUsbSIb.sys [2009-7-13 11904]
    S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [2012-6-23 23456]
    S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 74112]
    S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2012-3-26 214952]
    S3 RTCore32;RTCore32;d:\program files\evga precision\RTCore32.sys [2005-5-25 4608]
    S3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\sisoftware\sisoftware sandra professional business 2011.sp4\RpcAgentSrv.exe [2012-7-10 93848]
    S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-8-28 52224]
    S3 UrlFilter;UrlFilter;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\UrlFilter.sys [2012-3-10 19792]
    S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-8-27 1343400]
    S4 FileMonitor;FileMonitor;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\FileMonitor.sys [2012-3-10 20336]
    .
    =============== Created Last 30 ================
    .
    2012-08-09 00:29:29 -------- d-----w- c:\users\mikes\appdata\local\ElevatedDiagnostics
    2012-08-08 21:33:40 6891424 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{dc781c86-bcbb-47e3-b0c6-1ff89675c5ff}\mpengine.dll
    2012-08-08 21:22:49 6891424 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
    2012-08-08 21:12:47 -------- d-----w- c:\program files\COMODO
    2012-08-08 01:48:19 -------- d-----w- C:\FRST
    2012-08-07 00:01:27 -------- d-----w- c:\program files\Vuze
    2012-08-06 23:23:37 -------- d-----w- c:\users\mikes\appdata\local\Apps
    2012-08-05 23:06:56 -------- d-----w- c:\users\mikes\appdata\roaming\Malwarebytes
    2012-08-05 23:06:43 -------- d-----w- c:\programdata\Malwarebytes
    2012-08-05 23:06:42 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-08-02 17:04:53 -------- d-----w- c:\users\mikes\appdata\local\Akamai
    2012-08-01 19:53:06 -------- d-----w- c:\windows\system32\wbem\framework\root\OpenHardwareMonitor
    2012-08-01 19:53:06 -------- d-----w- c:\windows\system32\wbem\framework\root
    2012-08-01 19:53:06 -------- d-----w- c:\windows\system32\wbem\Framework
    2012-08-01 18:50:19 -------- d-----w- c:\windows\pss
    2012-07-30 18:07:46 -------- d-----w- c:\users\mikes\appdata\local\SniperV2
    2012-07-23 01:28:04 -------- d-----w- c:\users\mikes\appdata\roaming\uTorrent
    2012-07-19 01:50:55 -------- d-----w- c:\users\mikes\appdata\local\Spoon
    2012-07-18 18:33:56 -------- d-----w- c:\program files\Conduit
    2012-07-18 18:33:54 -------- d-----w- c:\program files\Vuze_Remote
    2012-07-11 23:17:49 2345984 ----a-w- c:\windows\system32\win32k.sys
    2012-07-10 17:10:41 -------- d-----w- c:\windows\system32\URTTEMP
    2012-07-10 16:15:32 -------- d-----w- c:\program files\MagicISO
    2012-07-10 01:51:02 -------- d-----w- c:\program files\Nero
    2012-07-10 01:50:53 -------- d-----w- c:\programdata\Nero
    2012-07-10 01:40:52 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
    .
    ==================== Find3M ====================
    .
    2012-08-02 21:25:10 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-08-02 21:25:10 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2012-08-02 17:09:00 413696 ----a-w- c:\windows\system32\wrap_oal.dll
    2012-08-02 17:09:00 102400 ----a-w- c:\windows\system32\OpenAL32.dll
    2012-06-23 18:18:50 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
    2012-06-17 19:15:56 514560 ----a-w- c:\windows\system32\qdvd.dll
    2012-06-06 05:05:52 1390080 ----a-w- c:\windows\system32\msxml6.dll
    2012-06-06 05:05:52 1236992 ----a-w- c:\windows\system32\msxml3.dll
    2012-06-06 05:03:06 805376 ----a-w- c:\windows\system32\cdosys.dll
    2012-06-02 22:19:42 171904 ----a-w- c:\windows\system32\wuwebv.dll
    2012-06-02 22:12:32 2422272 ----a-w- c:\windows\system32\wucltux.dll
    2012-06-02 22:12:20 33792 ----a-w- c:\windows\system32\wuapp.exe
    2012-06-02 22:12:13 88576 ----a-w- c:\windows\system32\wudriver.dll
    2012-06-02 08:33:25 1800192 ----a-w- c:\windows\system32\jscript9.dll
    2012-06-02 08:25:08 1129472 ----a-w- c:\windows\system32\wininet.dll
    2012-06-02 08:25:03 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
    2012-06-02 08:20:33 142848 ----a-w- c:\windows\system32\ieUnatt.exe
    2012-06-02 08:16:52 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2012-06-02 04:45:04 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
    2012-06-02 04:45:03 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
    2012-06-02 04:40:59 369336 ----a-w- c:\windows\system32\drivers\cng.sys
    2012-06-02 04:40:39 225280 ----a-w- c:\windows\system32\schannel.dll
    2012-06-02 04:39:10 219136 ----a-w- c:\windows\system32\ncrypt.dll
    2012-05-26 02:01:31 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2012-05-15 09:28:49 645440 ----a-w- c:\windows\system32\nvvsvc.exe
    2012-05-15 09:28:49 62272 ----a-w- c:\windows\system32\nvshext.dll
    2012-05-15 09:28:49 2621723 ----a-w- c:\windows\system32\nvcoproc.bin
    2012-05-15 09:28:49 108352 ----a-w- c:\windows\system32\nvmctray.dll
    2012-05-15 09:28:48 3931456 ----a-w- c:\windows\system32\nvcpl.dll
    2012-05-15 09:27:28 2759488 ----a-w- c:\windows\system32\nvsvc.dll
    2012-05-15 09:21:50 423744 ----a-w- c:\windows\system32\nvStreaming.exe
    2012-05-11 16:08:25 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2012-05-11 16:08:25 3913072 ----a-w- c:\windows\system32\ntoskrnl.exe
    2012-05-11 16:08:15 56176 ----a-w- c:\windows\system32\drivers\partmgr.sys
    2012-05-11 16:08:07 1291632 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2012-05-11 16:05:41 1077248 ----a-w- c:\windows\system32\DWrite.dll
    .
    ============= FINISH: 17:32:26.82 ===============
     
  8. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    The Attach DDS is:

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 8/26/2011 10:58:01 AM
    System Uptime: 8/8/2012 4:55:04 PM (1 hours ago)
    .
    Motherboard: EVGA | | NFORCE 680i LT SLI
    Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz | Socket 775 | 2400/267mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 88 GiB total, 49.078 GiB free.
    D: is FIXED (NTFS) - 466 GiB total, 236.253 GiB free.
    E: is FIXED (NTFS) - 52 GiB total, 31.969 GiB free.
    F: is CDROM ()
    G: is CDROM ()
    H: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP403: 8/4/2012 2:09:24 PM - Windows Update
    RP404: 8/6/2012 4:14:19 PM - Windows Backup
    RP405: 8/7/2012 6:10:32 PM - Windows Update
    RP406: 8/8/2012 2:20:50 AM - Windows Update
    RP407: 8/8/2012 2:33:29 PM - Windows Update
    .
    ==== Installed Programs ======================
    .
    µTorrent
    Adobe Flash Player 11 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Reader X (10.1.3)
    Adobe Shockwave Player 11.6
    Advanced SystemCare 5
    Advertising Center
    Akamai NetSession Interface
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ASUS Xonar DX Audio Driver
    AVS4YOU Software Navigator 1.4
    Bonjour
    Brother MFL-Pro Suite MFC-9440CN
    Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
    Call of Duty: Modern Warfare 3
    Call of Duty: Modern Warfare 3 - Dedicated Server
    Call of Duty: Modern Warfare 3 - Multiplayer
    CCleaner
    Company of Heroes
    Company of Heroes - FAKEMSI
    Compatibility Pack for the 2007 Office system
    CPUID CPU-Z 1.58
    DriverAgent by eSupport.com
    EVGA Precision 2.1.2
    Free Window Registry Repair
    ImgBurn
    IObit Malware Fighter
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 31
    Left 4 Dead
    Magic ISO Maker v5.5 (build 0281)
    Malwarebytes Anti-Malware version 1.62.0.1300
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Application Error Reporting
    Microsoft IntelliPoint 8.2
    Microsoft Office File Validation Add-In
    Microsoft Office Professional Edition 2003
    Microsoft Security Client
    Microsoft Security Essentials
    Microsoft Silverlight
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Mozilla Firefox 10.0.2 (x86 en-US)
    Mozilla Firefox 7.0.1 (x86 en-US)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Nero 9 Essentials
    Nero ControlCenter
    Nero Installer
    Nero Online Upgrade
    Nero StartSmart
    Nero StartSmart OEM
    neroxml
    NVIDIA 3D Vision Controller Driver 301.42
    NVIDIA 3D Vision Driver 301.42
    NVIDIA Control Panel 301.42
    NVIDIA Drivers
    NVIDIA ForceWare Network Access Manager
    NVIDIA Graphics Driver 301.42
    NVIDIA HD Audio Driver 1.3.16.0
    NVIDIA Install Application
    NVIDIA MediaShield
    NVIDIA PhysX
    NVIDIA PhysX System Software 9.12.0213
    NVIDIA Update 1.8.15
    NVIDIA Update Components
    OpenAL
    PaperPort Image Printer
    PCSafeDoctor
    PeerBlock 1.1 (r518)
    QuickTime
    RealNetworks - Microsoft Visual C++ 2008 Runtime
    RealPlayer
    RealUpgrade 1.1
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
    SiSoftware Sandra Lite 2012.SP4c
    SiSoftware Sandra Professional Business 2011.SP4
    Smart Defrag 2
    Sniper Elite V2
    SpeedFan (remove only)
    Steam
    swMSM
    The Elder Scrolls V: Skyrim
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
    ViewSonic Monitor Drivers
    VirtualCloneDrive
    Vuze
    Vuze Remote Toolbar
    WinRAR 4.01 (32-bit)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    8/8/2012 5:29:23 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    8/8/2012 5:29:16 PM, Error: NVNET [5008] - NVIDIA nForce 10/100/1000 Mbps Ethernet : Has encountered an invalid network address.
    8/8/2012 4:57:35 PM, Error: Service Control Manager [7038] - The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error: Logon failure: the specified account password has expired. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
    8/8/2012 4:57:35 PM, Error: Service Control Manager [7000] - The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not start due to a logon failure.
    8/8/2012 4:57:35 PM, Error: Service Control Manager [7000] - The MBAMService service failed to start due to the following error: The system cannot find the file specified.
    8/8/2012 4:55:21 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xc0000005, 0x92d2352e, 0xaeac7580, 0xaeac7160). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080812-14352-01.
    8/8/2012 2:22:49 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.131.1460.0;1.131.1460.0 Engine version: 1.1.8601.0
    8/8/2012 2:22:47 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007f (0x00000000, 0x00000000, 0x00000000, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080812-29998-01.
    8/8/2012 2:10:21 AM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.131.1460.0;1.131.1460.0 Engine version: 1.1.8601.0
    8/7/2012 5:26:57 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.131.1460.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8601.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
    8/7/2012 5:16:50 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000004e (0x00000099, 0x000a2f00, 0x00000003, 0x000a3000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080712-14882-01.
    8/7/2012 2:36:26 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR2.
    8/7/2012 12:55:07 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.131.1460.0;1.131.1460.0 Engine version: 1.1.8601.0
    8/7/2012 10:44:05 AM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.131.1460.0;1.131.1460.0 Engine version: 1.1.8601.0
    8/7/2012 1:12:05 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.131.1460.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8601.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
    8/6/2012 5:27:25 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xcaf0596a, 0x00000000, 0x923cbd85, 0x00000002). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080612-14804-01.
    8/6/2012 4:46:52 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000, 0x00000002, 0x00000001, 0x830820af). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080612-19047-01.
    8/6/2012 4:29:48 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x005d9159, 0x00000002, 0x00000001, 0x83008829). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080612-14835-01.
    8/6/2012 4:15:37 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.131.1523.0).
    8/6/2012 4:14:57 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.131.1460.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8601.0 Error code: 0x80246007 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
    8/6/2012 4:02:59 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    8/6/2012 3:56:32 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    8/6/2012 3:56:26 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    8/6/2012 3:56:22 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache ElbyCDIO MpFilter spldr Wanarpv6
    8/6/2012 3:56:01 PM, Error: sptd [4] - Driver detected an internal error in its data structures for .
    8/5/2012 3:54:58 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x00000000, 0x8cbee9c4, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080512-22885-01.
    8/2/2012 2:22:12 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
    8/2/2012 2:22:12 PM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    8/2/2012 12:39:04 PM, Error: Service Control Manager [7030] - The ForceWare Intelligent Application Manager (IAM) service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    8/2/2012 12:39:00 PM, Error: Service Control Manager [7030] - The ForceWare IP service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    8/2/2012 12:36:28 PM, Error: NVNET [5008] - NVIDIA nForce Networking Controller : Has encountered an invalid network address.
    .
    ==== End Of File ===========================

    Please advise the next step at your convenience.

    Cheers
    Whiteknight1950
     
  9. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    I hear what you say about SystemCare5, have uninstalled it and will deal with registry in a different way in the future....thanks for the advice.

    Whiteknight1950
     
  10. Broni

    Broni Malware Annihilator Posts: 47,975   +271

    There is absolutely no need to play with registry whatsoever.

    =====================================

    Please download the below tool named Rkill (courtesy of BleepingComputer.com) to your desktop.

    There are 2 different versions. If one of them won't run then download and try to run the other one.

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    http://download.bleepingcomputer.com/grinler/beta/rkill.exe
    http://download.bleepingcomputer.com/grinler/beta/iExplore.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    If normal mode still doesn't work, run the tool from safe mode.

    When the scan is done Notepad will open with rKill log.
    Post it in your next reply.

    NOTE. rKill.txt log will also be present on your desktop.

    ========================================

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan.
    On completion of the scan click "Save log", save it to your desktop and post in your next reply.

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.
     
  11. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    This is the rootkill result

    Rkill 2.1.0 by Lawrence Abrams (Grinler)
    http://www.bleepingcomputer.com/
    Copyright 2008-2012 BleepingComputer.com
    More Information about Rkill can be found at this link:
    http://www.bleepingcomputer.com/forums/topic308364.html

    Program started at: 08/08/2012 06:21:02 PM in x86 mode.
    Windows Version: Windows 7

    Checking for Windows services to stop.

    * No malware services found to stop.

    Checking for processes to terminate.

    * No malware processes found to kill.

    Checking Registry for malware related settings.

    * No issues found in the Registry.

    Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

    Performing miscellaneous checks.

    * No issues found.

    Searching for Missing Digital Signatures:

    * No issues found.

    Restarting Explorer.exe in order to apply changes.

    Program finished at: 08/08/2012 06:21:18 PM
    Execution time: 0 hours(s), 0 minute(s), and 16 seconds(s)
     
     
  12. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    This is the MBR log:

    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
    Run date: 2012-08-08 18:27:40
    -----------------------------
    18:27:40.682 OS Version: Windows 6.1.7601 Service Pack 1
    18:27:40.682 Number of processors: 4 586 0xF0B
    18:27:40.682 ComputerName: MIKES-PC UserName: Mikes
    18:27:40.906 Initialize success
    18:27:45.330 AVAST engine defs: 12080801
    18:27:49.151 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000061
    18:27:49.153 Disk 0 Vendor: WDC_WD15 21.0 Size: 143089MB BusType: 3
    18:27:49.155 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000062
    18:27:49.157 Disk 1 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
    18:27:49.167 Disk 0 MBR read successfully
    18:27:49.170 Disk 0 MBR scan
    18:27:49.173 Disk 0 Windows 7 default MBR code
    18:27:49.185 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 89999 MB offset 2048
    18:27:49.201 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 53087 MB offset 184322048
    18:27:49.207 Disk 0 scanning sectors +293044224
    18:27:49.237 Disk 0 scanning C:\Windows\system32\drivers
    18:27:54.921 Service scanning
    18:28:00.151 Service MpKsl4bdbdff9 C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{382FB52C-A063-4CC8-9389-FBC73A60CD48}\MpKsl4bdbdff9.sys **LOCKED** 32
    18:28:07.460 Modules scanning
    18:28:10.925 Disk 0 trace - called modules:
    18:28:10.941 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x857a81e8]<<
    18:28:10.946 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x869a1030]
    18:28:10.951 3 CLASSPNP.SYS[8b38e59e] -> nt!IofCallDriver -> [0x86518930]
    18:28:10.956 5 ACPI.sys[8379e3d4] -> nt!IofCallDriver -> \Device\00000061[0x86550a28]
    18:28:10.965 \Driver\nvstor32[0x85844a98] -> IRP_MJ_CREATE -> 0x857a81e8
    18:28:11.303 AVAST engine scan C:\Windows
    18:28:12.143 AVAST engine scan C:\Windows\system32
    18:29:50.573 AVAST engine scan C:\Windows\system32\drivers
    18:29:56.847 AVAST engine scan C:\Users\Mikes
    18:31:09.664 AVAST engine scan C:\ProgramData
    18:31:22.201 Scan finished successfully
    18:31:55.370 Disk 0 MBR has been saved successfully to "C:\Users\Mikes\Desktop\MBR.dat"
    18:31:55.378 The log file has been saved successfully to "C:\Users\Mikes\Desktop\aswMBR.txt"


    Thanks again
     
  13. Broni

    Broni Malware Annihilator Posts: 47,975   +271

    I don't see much so far...

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
    There are 4 different versions. If one of them won't run then download and try to run the other one.
    Vista and Win7 users need to right click Rkill and choose Run as Administrator
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    * Rkill.com
    * Rkill.scr
    * Rkill.exe
    • Double-click on the Rkill icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.
    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  14. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    ComboFix ran ok....here is the log:

    ComboFix 12-08-08.03 - Mikes 08/08/2012 21:04:50.1.4 - x86
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2815.1785 [GMT -7:00]
    Running from: c:\users\Mikes\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
    SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Mikes\AppData\Roaming\mm
    c:\windows\system32\drivers\RKHit.sys
    c:\windows\system32\URTTemp
    c:\windows\system32\URTTemp\regtlib.exe
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-07-09 to 2012-08-09 )))))))))))))))))))))))))))))))
    .
    .
    2012-08-09 04:09 . 2012-08-09 04:09 -------- d-----w- c:\users\Mikes\AppData\Local\temp
    2012-08-09 04:09 . 2012-08-09 04:09 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
    2012-08-09 04:09 . 2012-08-09 04:09 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-08-09 02:18 . 2012-06-29 08:44 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB8500EF-699E-4AFF-870B-97DFD88D5BFE}\mpengine.dll
    2012-08-09 02:07 . 2012-06-29 08:44 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2012-08-09 00:29 . 2012-08-09 00:29 -------- d-----w- c:\users\Mikes\AppData\Local\ElevatedDiagnostics
    2012-08-08 21:12 . 2012-08-08 21:12 -------- d-----w- c:\program files\COMODO
    2012-08-08 01:48 . 2012-08-08 01:48 -------- d-----w- C:\FRST
    2012-08-07 00:01 . 2012-08-07 18:42 -------- d-----w- c:\program files\Vuze
    2012-08-06 23:23 . 2012-08-06 23:23 -------- d-----w- c:\users\Mikes\AppData\Local\Apps
    2012-08-05 23:06 . 2012-08-05 23:06 -------- d-----w- c:\users\Mikes\AppData\Roaming\Malwarebytes
    2012-08-05 23:06 . 2012-08-08 10:06 -------- d-----w- c:\programdata\Malwarebytes
    2012-08-05 23:06 . 2012-07-03 20:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-08-02 17:04 . 2012-08-09 03:06 -------- d-----w- c:\users\Mikes\AppData\Local\Akamai
    2012-08-01 19:53 . 2012-08-01 19:53 -------- d-----w- c:\windows\system32\wbem\Framework
    2012-07-30 18:07 . 2012-08-09 03:06 -------- d-----w- c:\users\Mikes\AppData\Local\SniperV2
    2012-07-23 01:28 . 2012-08-08 09:20 -------- d-----w- c:\users\Mikes\AppData\Roaming\uTorrent
    2012-07-19 01:50 . 2012-07-19 01:50 -------- d-----w- c:\users\Mikes\AppData\Local\Spoon
    2012-07-18 18:33 . 2012-07-18 18:33 -------- d-----w- c:\program files\Conduit
    2012-07-15 23:14 . 2012-07-15 23:14 -------- d-----w- c:\windows\Sun
    2012-07-11 23:17 . 2012-06-12 02:40 2345984 ----a-w- c:\windows\system32\win32k.sys
    2012-07-10 16:15 . 2012-07-10 16:15 -------- d-----w- c:\program files\MagicISO
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-08-02 21:25 . 2012-04-03 15:43 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2012-08-02 21:25 . 2011-08-26 22:12 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-08-02 17:09 . 2011-08-28 01:00 413696 ----a-w- c:\windows\system32\wrap_oal.dll
    2012-08-02 17:09 . 2011-08-28 01:00 102400 ----a-w- c:\windows\system32\OpenAL32.dll
    2012-07-10 01:40 . 2012-07-10 01:40 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
    2012-06-23 18:18 . 2012-06-23 18:18 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
    2012-06-17 19:15 . 2012-06-17 19:15 514560 ----a-w- c:\windows\system32\qdvd.dll
    2012-06-02 22:19 . 2012-06-21 16:29 171904 ----a-w- c:\windows\system32\wuwebv.dll
    2012-06-02 22:19 . 2012-06-21 16:29 53784 ----a-w- c:\windows\system32\wuauclt.exe
    2012-06-02 22:19 . 2012-06-21 16:29 45080 ----a-w- c:\windows\system32\wups2.dll
    2012-06-02 22:19 . 2012-06-21 16:29 35864 ----a-w- c:\windows\system32\wups.dll
    2012-06-02 22:19 . 2012-06-21 16:29 577048 ----a-w- c:\windows\system32\wuapi.dll
    2012-06-02 22:19 . 2012-06-21 16:29 1933848 ----a-w- c:\windows\system32\wuaueng.dll
    2012-06-02 22:12 . 2012-06-21 16:29 2422272 ----a-w- c:\windows\system32\wucltux.dll
    2012-06-02 22:12 . 2012-06-21 16:29 33792 ----a-w- c:\windows\system32\wuapp.exe
    2012-06-02 22:12 . 2012-06-21 16:29 88576 ----a-w- c:\windows\system32\wudriver.dll
    2012-05-26 02:01 . 2011-12-28 16:43 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2012-05-15 10:26 . 2012-06-23 18:27 5982528 ----a-w- c:\windows\system32\nvcuda.dll
    2012-05-15 10:26 . 2012-06-23 18:27 301376 ----a-w- c:\windows\system32\nvdecodemft.dll
    2012-05-15 10:26 . 2012-06-23 18:27 2524992 ----a-w- c:\windows\system32\nvcuvid.dll
    2012-05-15 10:26 . 2012-06-23 18:27 2445120 ----a-w- c:\windows\system32\nvcuvenc.dll
    2012-05-15 10:26 . 2012-06-23 18:27 202048 ----a-w- c:\windows\system32\nvinit.dll
    2012-05-15 10:26 . 2012-06-23 18:27 19607872 ----a-w- c:\windows\system32\nvoglv32.dll
    2012-05-15 10:26 . 2012-06-23 18:27 15322432 ----a-w- c:\windows\system32\nvd3dum.dll
    2012-05-15 10:26 . 2012-06-23 18:27 11354944 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
    2012-05-15 10:26 . 2012-06-23 18:27 17551680 ----a-w- c:\windows\system32\nvcompiler.dll
    2012-05-15 10:26 . 2012-03-13 23:35 61248 ----a-w- c:\windows\system32\OpenCL.dll
    2012-05-15 10:26 . 2012-02-21 19:36 818496 ----a-w- c:\windows\system32\nvumdshim.dll
    2012-05-15 10:26 . 2011-08-26 18:36 8105280 ----a-w- c:\windows\system32\nvwgf2um.dll
    2012-05-15 10:26 . 2011-08-26 18:36 883008 ----a-w- c:\windows\system32\nvgenco32.dll
    2012-05-15 10:26 . 2011-08-26 18:36 1000768 ----a-w- c:\windows\system32\nvdispco32.dll
    2012-05-15 10:26 . 2011-05-21 13:01 2368832 ----a-w- c:\windows\system32\nvapi.dll
    2012-05-15 09:28 . 2011-08-26 17:59 645440 ----a-w- c:\windows\system32\nvvsvc.exe
    2012-05-15 09:28 . 2011-08-26 17:59 62272 ----a-w- c:\windows\system32\nvshext.dll
    2012-05-15 09:28 . 2011-08-26 17:59 108352 ----a-w- c:\windows\system32\nvmctray.dll
    2012-05-15 09:28 . 2011-08-26 17:59 3931456 ----a-w- c:\windows\system32\nvcpl.dll
    2012-05-15 09:27 . 2011-08-26 17:59 2759488 ----a-w- c:\windows\system32\nvsvc.dll
    2012-05-15 09:21 . 2012-05-15 09:21 423744 ----a-w- c:\windows\system32\nvStreaming.exe
    2012-05-11 16:08 . 2012-05-11 16:08 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2012-05-11 16:08 . 2012-05-11 16:08 3913072 ----a-w- c:\windows\system32\ntoskrnl.exe
    2012-05-11 16:08 . 2012-05-11 16:08 56176 ----a-w- c:\windows\system32\drivers\partmgr.sys
    2012-05-11 16:08 . 2012-05-11 16:08 1291632 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2012-05-11 16:05 . 2012-05-11 16:05 1077248 ----a-w- c:\windows\system32\DWrite.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\prxtbVuze.dll" [2011-05-09 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
    2011-05-09 08:49 176936 ----a-w- c:\program files\Vuze_Remote\prxtbVuze.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\prxtbVuze.dll" [2011-05-09 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Akamai NetSession Interface"="c:\users\Mikes\AppData\Local\Akamai\netsession_win.exe" [2012-05-26 4327744]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
    "TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2012-05-26 296056]
    "Cmaudio8788GX"="c:\windows\system\HsMgr.exe" [2008-07-11 200704]
    "NVRaidService"="c:\program files\NVIDIA Corporation\Raid\nvraidservice.exe" [2010-04-09 163944]
    "Malwarebytes' Anti-Malware"="d:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0SmartDefragBootTime.exe
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio8788
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW6
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Essentials TM
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
    2011-11-02 06:25 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
    2009-05-26 23:46 1159168 ------w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio8788GX]
    2008-07-11 22:04 200704 ------w- c:\windows\system\HsMgr.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
    2008-12-24 17:26 114688 ------w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
    2011-08-01 22:56 1821576 ----a-w- c:\program files\Microsoft IntelliPoint\ipoint.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2012-01-17 00:22 421736 ----a-w- d:\program files\iTunes\iTunesHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
    2012-03-27 00:08 931200 ----a-w- c:\program files\Microsoft Security Client\msseces.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRaidService]
    2010-04-09 09:42 163944 ----a-w- c:\program files\NVIDIA Corporation\Raid\nvraidservice.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2011-10-24 21:28 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    2012-01-18 21:02 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    2012-05-26 02:01 296056 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
    2011-03-07 13:33 89456 ----a-w- d:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    .
    R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;d:\program files\IObit\Advanced SystemCare 5\ASCService.exe [x]
    R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [x]
    R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
    R3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys [x]
    R3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys [x]
    R3 DrvAgent32;DrvAgent32;c:\windows\system32\Drivers\DrvAgent32.sys [x]
    R3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [x]
    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]
    R3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [x]
    R3 RTCore32;RTCore32;d:\program files\EVGA Precision\RTCore32.sys [x]
    R3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\SiSoftware\SiSoftware Sandra Professional Business 2011.SP4\RpcAgentSrv.exe [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [x]
    S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
    S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
    S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [x]
    S2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [x]
    S2 MBAMService;MBAMService;d:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
    S3 cmudaxp;ASUS Xonar DX Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [x]
    S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
    S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - WS2IFSL
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-08-09 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 21:25]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://search.babylon.com/?AF=109932&babsrc=HP_ss&mntrId=6024ca09000000000000044b80808004
    uInternet Settings,ProxyOverride = *.local;<local>
    IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    TCP: DhcpNameServer = 10.0.1.1
    FF - ProfilePath - c:\users\Mikes\AppData\Roaming\Mozilla\Firefox\Profiles\qhxebwz1.default\
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - user.js: browser.cache.memory.capacity - 65536
    FF - user.js: browser.chrome.favicons - false
    FF - user.js: browser.display.show_image_placeholders - true
    FF - user.js: browser.turbo.enabled - true
    FF - user.js: browser.urlbar.autocomplete.enabled - true
    FF - user.js: browser.urlbar.autofill - true
    FF - user.js: browser.xul.error_pages.enabled - true
    FF - user.js: content.interrupt.parsing - true
    FF - user.js: content.max.tokenizing.time - 3000000
    FF - user.js: content.maxtextrun - 8191
    FF - user.js: content.notify.backoffcount - 5
    FF - user.js: content.notify.interval - 750000
    FF - user.js: content.notify.ontimer - true
    FF - user.js: content.switch.threshold - 750000
    FF - user.js: network.http.max-connections - 32
    FF - user.js: network.http.max-connections-per-server - 8
    FF - user.js: network.http.max-persistent-connections-per-proxy - 8
    FF - user.js: network.http.max-persistent-connections-per-server - 4
    FF - user.js: network.http.pipelining - true
    FF - user.js: network.http.pipelining.maxrequests - 8
    FF - user.js: network.http.proxy.pipelining - true
    FF - user.js: network.http.request.max-start-delay - 0
    FF - user.js: nglayout.initialpaint.delay - 0
    FF - user.js: plugin.expose_full_path - true
    FF - user.js: ui.submenuDelay - 0
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    FF - user.js: extensions.BabylonToolbar_i.id - 6024ca09000000000000044b80808004
    FF - user.js: extensions.BabylonToolbar_i.hardId - 6024ca09000000000000044b80808004
    FF - user.js: extensions.BabylonToolbar_i.instlDay - 15408
    FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1719:21
    FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
    FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
    FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
    FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
    FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
    FF - user.js: extensions.BabylonToolbar_i.newTab - false
    FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109932
    FF - user.js: extensions.BabylonToolbar_i.babExt -
    FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
    FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKCU-Run-Advanced SystemCare 5 - d:\program files\IObit\Advanced SystemCare 5\ASCTray.exe
    HKLM-Run-Cmaudio8788 - cmicnfgp.cpl
    MSConfigStartUp-Advanced SystemCare 5 - d:\program files\IObit\Advanced SystemCare 5\ASCTray.exe
    AddRemove-Advanced SystemCare 5_is1 - d:\program files\IObit\Advanced SystemCare 5\unins000.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2012-08-08 21:10:21
    ComboFix-quarantined-files.txt 2012-08-09 04:10
    .
    Pre-Run: 53,196,877,824 bytes free
    Post-Run: 53,064,036,352 bytes free
    .
    - - End Of File - - 1E4924E11EEF03D22D5620C3872F4D0D
     
  15. Broni

    Broni Malware Annihilator Posts: 47,975   +271

    Looks good :)

    How is computer doing?

    =========================

    Download OTL to your Desktop.
    Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  16. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

  17. Broni

    Broni Malware Annihilator Posts: 47,975   +271

    You posted Combofix log already.
    Read my previous reply.
     
  18. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    Sorry, I reposted the Combo fix report, I initially couldnt see it on the thread.

    OTL here:

    OTL logfile created on: 8/8/2012 9:45:23 PM - Run 1
    OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Mikes\Desktop
    Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.75 Gb Total Physical Memory | 1.78 Gb Available Physical Memory | 64.76% Memory free
    5.50 Gb Paging File | 4.28 Gb Available in Paging File | 77.80% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 87.89 Gb Total Space | 49.01 Gb Free Space | 55.76% Space Free | Partition Type: NTFS
    Drive D: | 465.63 Gb Total Space | 236.35 Gb Free Space | 50.76% Space Free | Partition Type: NTFS
    Drive E: | 51.84 Gb Total Space | 31.97 Gb Free Space | 61.66% Space Free | Partition Type: NTFS
    Drive H: | 121.85 Mb Total Space | 120.97 Mb Free Space | 99.28% Space Free | Partition Type: FAT

    Computer Name: MIKES-PC | User Name: Mikes | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2012/08/08 21:41:51 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Mikes\Desktop\OTL.exe
    PRC - [2012/08/02 14:25:10 | 001,536,712 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
    PRC - [2012/07/18 11:38:16 | 000,913,888 | ---- | M] (Mozilla Corporation) -- D:\Program Files\Mozilla Firefox\firefox.exe
    PRC - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    PRC - [2012/05/26 06:32:24 | 004,327,744 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\Mikes\AppData\Local\Akamai\netsession_win.exe
    PRC - [2012/05/25 19:01:32 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
    PRC - [2012/05/15 02:28:16 | 001,820,480 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    PRC - [2012/05/15 02:27:34 | 000,857,920 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    PRC - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\MsMpEng.exe
    PRC - [2012/03/11 21:13:22 | 001,983,232 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
    PRC - [2012/03/11 21:13:02 | 006,749,512 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
    PRC - [2012/01/09 20:17:44 | 000,821,592 | ---- | M] (IObit) -- C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
    PRC - [2012/01/04 14:26:46 | 001,606,488 | ---- | M] (IObit) -- D:\Program Files\IObit\Smart Defrag 2\SmartDefrag.exe
    PRC - [2012/01/03 06:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    PRC - [2011/11/23 03:27:04 | 001,052,472 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe
    PRC - [2011/02/24 22:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
    PRC - [2010/11/20 05:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
    PRC - [2010/04/09 02:42:28 | 000,163,944 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe
    PRC - [2009/08/10 15:59:50 | 000,178,720 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
    PRC - [2009/08/10 15:59:48 | 000,387,616 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
    PRC - [2009/07/20 11:51:52 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
    PRC - [2008/07/11 15:04:22 | 000,200,704 | ---- | M] () -- C:\Windows\system\HsMgr.exe


    ========== Modules (No Company Name) ==========

    MOD - [2012/08/02 14:25:09 | 009,465,032 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_270.dll
    MOD - [2012/07/18 11:38:01 | 002,003,424 | ---- | M] () -- D:\Program Files\Mozilla Firefox\mozjs.dll
    MOD - [2011/08/19 16:33:28 | 000,047,960 | ---- | M] () -- D:\Program Files\IObit\Smart Defrag 2\NtfsData.dll
    MOD - [2011/05/28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
    MOD - [2008/07/11 15:04:22 | 000,200,704 | ---- | M] () -- C:\Windows\system\HsMgr.exe


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [Auto | Stopped] -- D:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe -- (AdvancedSystemCareService5)
    SRV - [2012/08/02 14:25:11 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
    SRV - [2012/08/01 18:16:03 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
    SRV - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2012/05/15 03:26:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
    SRV - [2012/03/26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
    SRV - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
    SRV - [2012/03/11 21:13:22 | 001,983,232 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
    SRV - [2012/01/09 20:17:44 | 000,821,592 | ---- | M] (IObit) [Auto | Running] -- C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe -- (IMFservice)
    SRV - [2012/01/03 06:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
    SRV - [2011/11/23 03:27:04 | 001,052,472 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe -- (CLPSLS)
    SRV - [2011/08/27 16:38:24 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
    SRV - [2009/08/10 15:59:50 | 000,178,720 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
    SRV - [2009/08/10 15:59:48 | 000,387,616 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)
    SRV - [2009/07/20 11:51:52 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
    SRV - [2009/07/13 19:15:38 | 000,093,848 | ---- | M] (SiSoftware) [On_Demand | Stopped] -- d:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2011.SP4\RpcAgentSrv.exe -- (SandraAgentSrv)
    SRV - [2009/07/13 18:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
    SRV - [2009/07/13 18:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Mikes\AppData\Local\Temp\catchme.sys -- (catchme)
    DRV - [2012/07/09 18:40:52 | 000,477,240 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
    DRV - [2012/07/03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
    DRV - [2012/06/23 11:18:50 | 000,023,456 | ---- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DrvAgent32.sys -- (DrvAgent32)
    DRV - [2012/05/15 03:26:00 | 011,354,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
    DRV - [2012/04/18 10:08:04 | 000,148,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
    DRV - [2012/03/20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
    DRV - [2012/03/11 21:13:38 | 000,039,640 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\cmdhlp.sys -- (cmdHlp)
    DRV - [2012/03/11 21:13:36 | 000,491,816 | ---- | M] (COMODO) [File_System | System | Running] -- C:\Windows\System32\drivers\cmdGuard.sys -- (cmdGuard)
    DRV - [2012/02/03 19:27:48 | 000,082,400 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\inspect.sys -- (inspect)
    DRV - [2012/01/05 18:07:20 | 000,020,336 | ---- | M] (IObit) [File_System | On_Demand | Stopped] -- C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys -- (FileMonitor)
    DRV - [2011/09/20 14:28:18 | 000,019,792 | ---- | M] (IObit.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\UrlFilter.sys -- (UrlFilter)
    DRV - [2011/09/20 14:28:14 | 000,030,600 | ---- | M] (IObit.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\RegFilter.sys -- (RegFilter)
    DRV - [2011/07/13 07:00:14 | 000,026,112 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)
    DRV - [2011/05/18 08:09:04 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d)
    DRV - [2011/03/18 09:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\Windows\System32\speedfan.sys -- (speedfan)
    DRV - [2011/03/10 15:43:40 | 001,760,256 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\cmudaxp.sys -- (cmudaxp)
    DRV - [2010/11/26 18:02:20 | 000,015,672 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SmartDefragDriver.sys -- (SmartDefragDriver)
    DRV - [2010/11/20 03:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
    DRV - [2010/11/09 15:35:30 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\cpuz135_x32.sys -- (cpuz135)
    DRV - [2010/04/09 01:32:36 | 000,215,656 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
    DRV - [2009/11/11 15:47:16 | 000,295,272 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
    DRV - [2009/08/07 23:46:56 | 000,023,112 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- d:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP4c\WNt500x86\sandra.sys -- (SANDRA)
    DRV - [2009/07/13 17:56:07 | 000,265,088 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BrSerIb.sys -- (BrSerIb)
    DRV - [2009/07/13 15:53:33 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BrUsbSIb.sys -- (BrUsbSIb)
    DRV - [2009/07/13 15:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
    DRV - [2005/05/25 12:39:06 | 000,004,608 | ---- | M] () [Kernel | On_Demand | Stopped] -- D:\Program Files\EVGA Precision\RTCore32.sys -- (RTCore32)
    DRV - [1996/04/03 12:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\giveio.sys -- (giveio)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
    IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?AF=109932&babsrc=HP_ss&mntrId=6024ca09000000000000044b80808004
    IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
    IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 70 79 BE 2D 1B 64 CC 01 [binary data]
    IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
    IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
    IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
    IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searc...SP_ss&mntrId=6024ca09000000000000044b80808004
    IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>

    ========== FireFox ==========

    FF - prefs.js..browser.startup.homepage: "www.google.com"


    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
    FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/08/08 20:06:20 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: d:\Program Files\Mozilla Firefox\components [2012/07/18 11:38:16 | 000,000,000 | ---D | M]
    FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2012/07/18 11:38:16 | 000,000,000 | ---D | M]

    [2011/08/26 11:13:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mikes\AppData\Roaming\Mozilla\Extensions
    [2012/07/18 11:34:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mikes\AppData\Roaming\Mozilla\Firefox\Profiles\qhxebwz1.default\extensions
    [2012/07/18 11:34:06 | 000,000,000 | ---D | M] (Vuze Remote) -- C:\Users\Mikes\AppData\Roaming\Mozilla\Firefox\Profiles\qhxebwz1.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
    [2012/03/08 19:21:30 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Mikes\AppData\Roaming\Mozilla\Firefox\Profiles\qhxebwz1.default\extensions\ffxtlbr@babylon.com
    [2012/02/21 13:49:59 | 000,000,000 | ---D | M] (Java Console) -- D:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

    ========== Chrome ==========

    CHR - default_search_provider: Google (Enabled)
    CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:eek:riginalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
    CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
    CHR - homepage: http://www.google.com
    CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\13.0.782.218\gcswf32.dll
    CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
    CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
    CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
    CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
    CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
    CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
    CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
    CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
    CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
    CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
    CHR - plugin: Chrome NaCl (Disabled) = C:\Program Files\Google\Chrome\Application\13.0.782.218\ppGoogleNaClPluginChrome.dll
    CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\13.0.782.218\pdf.dll
    CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll
    CHR - plugin: iTunes Application Detector (Enabled) = D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
    CHR - plugin: Default Plug-in (Enabled) = default_plugin

    O1 HOSTS File: ([2012/08/08 21:09:08 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
    O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
    O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
    O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
    O4 - HKLM..\Run: [Cmaudio8788GX] C:\Windows\system\HsMgr.exe ()
    O4 - HKLM..\Run: [COMODO] C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLA.exe (COMODO)
    O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
    O4 - HKLM..\Run: [CPA] C:\Program Files\COMODO\COMODO GeekBuddy\VALA.exe (COMODO)
    O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    O4 - HKLM..\Run: [NVRaidService] C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe (NVIDIA Corporation)
    O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
    O4 - HKU\S-1-5-21-376916492-290187006-1338432341-1001..\Run: [Akamai NetSession Interface] C:\Users\Mikes\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-376916492-290187006-1338432341-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
    O8 - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
    O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
    O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DA014566-975D-44D4-BB0A-43528C765950}: DhcpNameServer = 10.0.1.1
    O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) - C:\Windows\System32\guard32.dll (COMODO)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O32 - AutoRun File - [2011/08/23 12:44:30 | 000,000,000 | R--D | M] - D:\autorun.inf -- [ NTFS ]
    O32 - AutoRun File - [2011/08/23 12:44:30 | 000,000,000 | R--D | M] - E:\autorun.inf -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O34 - HKLM BootExecute: (SmartDefragBootTime.exe)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
    O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

    ========== Files/Folders - Created Within 30 Days ==========

    [2012/08/08 21:41:51 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Mikes\Desktop\OTL.exe
    [2012/08/08 21:30:32 | 000,000,000 | ---D | C] -- C:\Users\Mikes\Desktop\Virus Disablers
    [2012/08/08 21:27:53 | 000,000,000 | ---D | C] -- C:\ProgramData\CPA_VA
    [2012/08/08 21:26:51 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\COMODO
    [2012/08/08 21:17:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\COMODO
    [2012/08/08 21:17:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
    [2012/08/08 21:15:44 | 062,855,008 | ---- | C] (COMODO) -- C:\Users\Mikes\Desktop\cfw_installer.exe
    [2012/08/08 21:10:24 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2012/08/08 21:10:22 | 000,000,000 | ---D | C] -- C:\Windows\temp
    [2012/08/08 21:10:22 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\temp
    [2012/08/08 20:59:27 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2012/08/08 20:59:27 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2012/08/08 20:59:27 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2012/08/08 19:16:59 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2012/08/08 19:16:46 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
    [2012/08/08 19:08:55 | 004,727,758 | R--- | C] (Swearware) -- C:\Users\Mikes\Desktop\ComboFix.exe
    [2012/08/08 17:29:29 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\ElevatedDiagnostics
    [2012/08/08 14:12:47 | 000,000,000 | ---D | C] -- C:\Program Files\COMODO
    [2012/08/07 18:48:19 | 000,000,000 | ---D | C] -- C:\FRST
    [2012/08/06 17:01:27 | 000,000,000 | ---D | C] -- C:\Program Files\Vuze
    [2012/08/06 16:23:37 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\Apps
    [2012/08/06 16:11:52 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free Window Registry Repair
    [2012/08/06 16:11:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Window Registry Repair
    [2012/08/05 16:06:56 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Roaming\Malwarebytes
    [2012/08/05 16:06:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2012/08/05 16:06:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2012/08/05 16:06:42 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2012/08/02 10:05:24 | 000,000,000 | ---D | C] -- C:\Users\Mikes\Documents\Asus Xonar Dx
    [2012/08/02 10:04:53 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\Akamai
    [2012/08/01 11:50:19 | 000,000,000 | ---D | C] -- C:\Windows\pss
    [2012/07/31 10:41:10 | 000,000,000 | ---D | C] -- C:\Users\Mikes\Documents\SniperEliteV2_Benchmark
    [2012/07/30 11:07:46 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\SniperV2
    [2012/07/22 18:28:04 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Roaming\uTorrent
    [2012/07/18 18:50:55 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\Spoon
    [2012/07/18 11:33:56 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
    [2012/07/18 11:33:54 | 000,000,000 | ---D | C] -- C:\Program Files\Vuze_Remote
    [2012/07/15 16:14:45 | 000,000,000 | ---D | C] -- C:\Windows\Sun
    [2012/07/10 10:02:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SiSoftware
    [2012/07/10 09:15:37 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MagicISO
    [2012/07/10 09:15:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MagicISO
    [2012/07/10 09:15:32 | 000,000,000 | ---D | C] -- C:\Program Files\MagicISO

    ========== Files - Modified Within 30 Days ==========

    [2012/08/08 21:46:13 | 000,000,459 | ---- | M] () -- C:\Windows\BRWMARK.INI
    [2012/08/08 21:41:51 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Mikes\Desktop\OTL.exe
    [2012/08/08 21:34:29 | 000,000,017 | ---- | M] () -- C:\Users\Mikes\AppData\Local\resmon.resmoncfg
    [2012/08/08 21:33:41 | 000,022,256 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    [2012/08/08 21:33:41 | 000,022,256 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    [2012/08/08 21:26:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2012/08/08 21:26:23 | 2213,441,536 | -HS- | M] () -- C:\hiberfil.sys
    [2012/08/08 21:18:06 | 000,001,846 | ---- | M] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
    [2012/08/08 21:17:44 | 000,001,222 | ---- | M] () -- C:\Users\Mikes\Application Data\Microsoft\Internet Explorer\Quick Launch\COMODO GeekBuddy.lnk
    [2012/08/08 21:17:44 | 000,001,198 | ---- | M] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
    [2012/08/08 21:16:14 | 062,855,008 | ---- | M] (COMODO) -- C:\Users\Mikes\Desktop\cfw_installer.exe
    [2012/08/08 21:09:08 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
    [2012/08/08 21:03:25 | 004,727,758 | R--- | M] (Swearware) -- C:\Users\Mikes\Desktop\ComboFix.exe
    [2012/08/08 20:25:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
    [2012/08/08 14:22:41 | 336,178,085 | ---- | M] () -- C:\Windows\MEMORY.DMP
    [2012/08/08 02:20:12 | 000,000,689 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
    [2012/08/08 02:11:56 | 000,634,808 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2012/08/08 02:11:56 | 000,111,342 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2012/08/06 16:11:52 | 000,000,689 | ---- | M] () -- C:\Users\Mikes\Desktop\Free Window Registry Repair.lnk
    [2012/08/05 16:19:23 | 000,002,198 | ---- | M] () -- C:\Windows\epplauncher.mif
    [2012/08/05 16:06:47 | 000,000,763 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2012/08/03 10:49:54 | 011,710,464 | ---- | M] () -- C:\Users\Mikes\AppData\Roaming\Sandra.mdb
    [2012/08/02 10:09:00 | 000,413,696 | ---- | M] (Creative Labs) -- C:\Windows\System32\wrap_oal.dll
    [2012/08/02 10:08:55 | 000,238,953 | ---- | M] () -- C:\Windows\Cmicnfgp.ini.cfl
    [2012/08/02 10:08:54 | 000,000,931 | ---- | M] () -- C:\Windows\Cmicnfgp.ini.imi
    [2012/08/02 10:08:54 | 000,000,870 | ---- | M] () -- C:\Windows\System\Cmicnfgp.ini
    [2012/08/02 10:08:54 | 000,000,138 | ---- | M] () -- C:\Windows\System\Dlap.pfx
    [2012/08/01 12:56:57 | 000,000,689 | ---- | M] () -- C:\Users\Mikes\Desktop\SpeedFan.lnk
    [2012/08/01 12:56:55 | 000,000,045 | ---- | M] () -- C:\Windows\System32\initdebug.nfo
    [2012/07/22 18:28:55 | 000,000,637 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
    [2012/07/22 18:28:55 | 000,000,637 | ---- | M] () -- C:\Users\Mikes\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
    [2012/07/18 11:36:58 | 000,000,629 | ---- | M] () -- C:\Users\Public\Desktop\Vuze.lnk
    [2012/07/18 11:36:58 | 000,000,629 | ---- | M] () -- C:\Users\Mikes\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
    [2012/07/12 08:58:39 | 000,358,048 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
    [2012/07/10 10:29:17 | 000,001,106 | ---- | M] () -- C:\Users\Public\Desktop\SiSoftware Sandra Professional Business 2011.SP4.lnk
    [2012/07/10 09:15:37 | 000,001,769 | ---- | M] () -- C:\Users\Mikes\Desktop\MagicISO.lnk

    ========== Files Created - No Company Name ==========

    [2012/08/08 21:34:29 | 000,000,017 | ---- | C] () -- C:\Users\Mikes\AppData\Local\resmon.resmoncfg
    [2012/08/08 21:18:06 | 000,001,846 | ---- | C] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
    [2012/08/08 21:17:44 | 000,001,222 | ---- | C] () -- C:\Users\Mikes\Application Data\Microsoft\Internet Explorer\Quick Launch\COMODO GeekBuddy.lnk
    [2012/08/08 21:17:44 | 000,001,198 | ---- | C] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
    [2012/08/08 20:59:27 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2012/08/08 20:59:27 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2012/08/08 20:59:27 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2012/08/08 20:59:27 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2012/08/08 20:59:27 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2012/08/08 17:09:22 | 000,000,763 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2012/08/08 14:22:41 | 336,178,085 | ---- | C] () -- C:\Windows\MEMORY.DMP
    [2012/08/06 17:01:43 | 000,000,629 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vuze.lnk
    [2012/08/06 16:11:52 | 000,000,689 | ---- | C] () -- C:\Users\Mikes\Desktop\Free Window Registry Repair.lnk
    [2012/08/01 12:56:57 | 000,000,689 | ---- | C] () -- C:\Users\Mikes\Desktop\SpeedFan.lnk
    [2012/08/01 12:56:54 | 000,000,045 | ---- | C] () -- C:\Windows\System32\initdebug.nfo
    [2012/07/22 18:28:55 | 000,000,637 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
    [2012/07/22 18:28:55 | 000,000,637 | ---- | C] () -- C:\Users\Mikes\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
    [2012/07/10 10:29:17 | 000,001,106 | ---- | C] () -- C:\Users\Public\Desktop\SiSoftware Sandra Professional Business 2011.SP4.lnk
    [2012/07/10 10:02:26 | 011,710,464 | ---- | C] () -- C:\Users\Mikes\AppData\Roaming\Sandra.mdb
    [2012/07/10 09:15:37 | 000,001,769 | ---- | C] () -- C:\Users\Mikes\Desktop\MagicISO.lnk
    [2012/05/15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
    [2012/03/12 08:59:02 | 000,000,066 | ---- | C] () -- C:\Windows\Brfaxrx.ini
    [2012/03/12 08:59:02 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat
    [2012/02/21 12:36:58 | 002,621,723 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin
    [2012/01/16 10:44:59 | 000,015,672 | ---- | C] () -- C:\Windows\System32\drivers\SmartDefragDriver.sys
    [2011/11/27 18:25:49 | 003,002,368 | ---- | C] () -- C:\Users\Mikes\s-1-5-21-376916492-290187006-1338432341-1001.rrr
    [2011/11/23 13:24:29 | 000,020,312 | ---- | C] () -- C:\Windows\System32\RegistryDefragBootTime.exe
    [2011/10/29 15:49:50 | 000,000,048 | ---- | C] () -- C:\Windows\System32\cmasiop.ini
    [2011/10/29 15:49:49 | 000,238,953 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.cfl
    [2011/10/29 15:49:31 | 000,000,931 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.imi
    [2011/10/29 15:49:28 | 000,004,969 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.cfg
    [2011/10/29 15:49:27 | 000,000,560 | ---- | C] () -- C:\Windows\cmudaxp.ini
    [2011/09/07 12:18:52 | 000,000,244 | ---- | C] () -- C:\Windows\Brpfx04a.ini
    [2011/09/07 12:18:52 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini
    [2011/09/07 12:18:09 | 000,106,496 | ---- | C] () -- C:\Windows\System32\BrMuSNMP.dll
    [2011/09/07 12:10:12 | 000,000,459 | ---- | C] () -- C:\Windows\BRWMARK.INI
    [2011/09/07 12:10:12 | 000,000,065 | ---- | C] () -- C:\Windows\System32\bd9440cn.dat
    [2011/09/07 12:10:12 | 000,000,026 | ---- | C] () -- C:\Windows\BRPP2KA.INI
    [2011/09/07 11:39:00 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
    [2011/08/27 18:00:06 | 000,561,152 | ---- | C] () -- C:\Windows\System32\Cmeauoxy.exe
    [2011/08/27 17:59:47 | 000,303,104 | ---- | C] () -- C:\Windows\System32\CmiInstallResAll.dll
    [2011/08/26 11:58:36 | 000,009,548 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
    [2010/09/14 09:37:41 | 000,045,056 | ---- | C] () -- C:\Windows\System32\BRTCPCON.DLL
    [2010/09/14 09:37:41 | 000,000,114 | ---- | C] () -- C:\Windows\System32\BRLMW03A.INI
    [2010/09/14 09:37:41 | 000,000,050 | ---- | C] () -- C:\Windows\System32\BAOCH06A.DAT

    ========== LOP Check ==========

    [2011/10/29 15:49:57 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\ASUS
    [2012/08/08 03:08:04 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\Azureus
    [2012/03/08 19:21:24 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\Babylon
    [2012/07/10 09:08:40 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\ImgBurn
    [2012/08/08 03:08:04 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\IObit
    [2011/09/24 22:36:41 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\Registry Mechanic
    [2012/08/08 02:20:43 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\uTorrent
    [2012/03/12 08:14:09 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\Zeon
    [2012/06/23 10:55:41 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:D1B5B4F1

    < End of report >
     
  19. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    And then the Extras txt.......:

    OTL Extras logfile created on: 8/8/2012 9:45:23 PM - Run 1
    OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Mikes\Desktop
    Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.75 Gb Total Physical Memory | 1.78 Gb Available Physical Memory | 64.76% Memory free
    5.50 Gb Paging File | 4.28 Gb Available in Paging File | 77.80% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 87.89 Gb Total Space | 49.01 Gb Free Space | 55.76% Space Free | Partition Type: NTFS
    Drive D: | 465.63 Gb Total Space | 236.35 Gb Free Space | 50.76% Space Free | Partition Type: NTFS
    Drive E: | 51.84 Gb Total Space | 31.97 Gb Free Space | 61.66% Space Free | Partition Type: NTFS
    Drive H: | 121.85 Mb Total Space | 120.97 Mb Free Space | 99.28% Space Free | Partition Type: FAT

    Computer Name: MIKES-PC | User Name: Mikes | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

    [HKEY_USERS\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- D:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    htmlfile [edit] -- "D:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "VistaSp1" = Reg Error: Unknown registry data type -- File not found
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{09BFD90B-E5FB-40F8-97B9-0803E041F423}" = lport=rpc | protocol=6 | dir=in | app=d:\program files\sisoftware\sisoftware sandra professional business 2011.sp4\wnt500x86\rpcsandrasrv.exe |
    "{0F3CBE63-1937-4639-BE4F-E3A91AC54795}" = rport=445 | protocol=6 | dir=out | app=system |
    "{1007D92E-869A-470F-959D-E84F24F96172}" = rport=137 | protocol=17 | dir=out | app=system |
    "{16B17EAD-3B7F-4220-9534-ED4C677BAF44}" = lport=49181 | protocol=6 | dir=in | name=akamai netsession interface |
    "{1A2CF81E-BBC5-4502-8190-2E08B831F3FE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{33579719-6EE3-4B8F-9AD7-E5DD6D3BB007}" = rport=10243 | protocol=6 | dir=out | app=system |
    "{3CD7B1E4-B6E3-46D8-BC25-63D7483EA270}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
    "{405E38D6-1A65-43EB-9A48-680F09194FF0}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{40A0C57A-A2D7-4C8E-88B9-E1664B0C6359}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{47074FC3-4612-4ACF-B4BC-074F6E12215D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{53FA826E-77AB-473F-A102-BC298DEAD44F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{56881F16-A21C-4CEB-B590-17BF45C7BD89}" = lport=2869 | protocol=6 | dir=in | app=system |
    "{5AD8D200-2D7B-4F0D-8EF9-4E26A16DB60F}" = lport=rpc | protocol=6 | dir=in | app=d:\program files\sisoftware\sisoftware sandra lite 2012.sp4c\wnt500x86\rpcsandrasrv.exe |
    "{5E20342A-1D67-4A47-A61C-B91374A9C309}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{5FB8800C-E29B-46FF-8E78-02059CD5D387}" = lport=rpc | protocol=6 | dir=in | app=d:\program files\sisoftware\sisoftware sandra professional business 2011.sp4\rpcagentsrv.exe |
    "{760C832B-A923-45BB-A094-6CEB4E6C6E11}" = lport=10243 | protocol=6 | dir=in | app=system |
    "{820ECF2A-0335-4ADE-81F3-6A2E7E168988}" = lport=rpc | protocol=6 | dir=in | app=d:\program files\sisoftware\sisoftware sandra lite 2012.sp4c\rpcagentsrv.exe |
    "{84FAA3E0-F856-414F-88D3-F3FD61B2A522}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{8A2415FC-0D74-4C10-877A-84255847EA72}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
    "{9F49C630-3101-412B-BA90-FE93A0E52852}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{A315273D-C166-4662-A402-8E5670180A4B}" = rport=139 | protocol=6 | dir=out | app=system |
    "{AC7603B7-387C-486D-906E-5B8AE60D86DD}" = lport=445 | protocol=6 | dir=in | app=system |
    "{AFA2F36F-6032-4C72-92D3-C4C735B459FC}" = rport=138 | protocol=17 | dir=out | app=system |
    "{C020E2F6-9DBC-41E7-91E3-DC536C1A03DB}" = lport=138 | protocol=17 | dir=in | app=system |
    "{CC55021D-8BE4-4999-A001-510713488C49}" = lport=139 | protocol=6 | dir=in | app=system |
    "{E41565D3-8710-4A9F-992D-852678B9F2B9}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{F475FEF7-5BE3-4070-BB1D-F1FA5676580C}" = lport=137 | protocol=17 | dir=in | app=system |
    "{F6C00DE9-840C-4911-A3A2-E02759CE23E8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
    "{FDFF2316-BF7A-4BAE-9EA1-B9FD6456F03D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{03AABE8C-B47A-47A8-B744-CE7CF51F18ED}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
    "{03F9031E-1435-4DF8-9C5C-1EF81BAAE8AE}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
    "{0779C0C8-63F6-42AC-BA36-C821555EAAEF}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\skyrim\skyrimlauncher.exe |
    "{0AE6E346-96D4-4027-8A43-7DEFE9B9F21C}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
    "{10D8FD7F-7955-434F-A955-D0096C3FB11A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{1E974C1D-9ECB-4CEE-9CCA-833F0768C15C}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
    "{222B1B13-3930-4DE6-83DF-A6A43843D93E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{22F94E1F-0631-41B4-8309-82F08C0D82D4}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{24BF35F4-8104-491A-8950-63576887B851}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
    "{25BBD7CF-A3C7-4C44-A9E4-7EB811B12CAC}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
    "{27C4C9E0-5B12-4F38-8E5F-3E0D0B7E0BF7}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
    "{2DFD8866-3DC4-4B6C-9410-BB29C3612C9A}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
    "{2E44C0C8-AEAB-4A71-805D-AF1441AFFDC2}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe |
    "{382A27DC-E85A-4F9A-8518-4214A3012568}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{3F91E16A-697E-49DA-8094-397A5B89D150}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
    "{40036157-8EF7-48D8-9583-6314E986153D}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\company of heroes\reliccoh.exe |
    "{40ACD0DE-CA22-44DB-B094-C91E5B7A77BD}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
    "{46FA2F44-D89D-49B5-88F2-30BBFD4CCCA9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
    "{486AB1FF-DEAB-43C5-BB33-9DC583114DEC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{51AE10D6-781A-4BE6-AEDD-EFD756A0AE2B}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\company of heroes\reliccoh.exe |
    "{5422C1D6-B187-4D58-A945-54116F94C129}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
    "{578E8F00-F93E-435A-8F7D-C4EA570DA4EF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{59AE800F-530A-44BA-86A8-CDA32AA2A59C}" = protocol=1 | dir=in | name=sisoftware sandra agent service (icmp-in) |
    "{5FBDDD15-40D7-4B56-B8C3-1BAAEEB72C3C}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steam.exe |
    "{6573CF89-847E-4048-980E-D493FCE61081}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty black ops\blackops.exe |
    "{67BFAE46-0FF1-4D30-9121-496CED361785}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
    "{6A07776E-2E04-4E77-B450-0B2FD780DD41}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{6F029C2B-4412-41FD-BD63-A75708D1E782}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{7BED965B-F94D-4AB5-BABF-5A9AE18C57EC}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{83420CB4-932E-40A6-A1B6-C10BC902F83B}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\skyrim\skyrimlauncher.exe |
    "{86119663-F893-4F4B-9B9D-16B0E69C628D}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe |
    "{8E49AF06-7134-4405-B540-2E038D44BA29}" = protocol=6 | dir=in | app=d:\program files\azureus.exe |
    "{8FEB6CB2-B5E8-442B-8571-185F894759CB}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\left 4 dead\left4dead.exe |
    "{907400C7-16EB-4F83-A7A5-0CF8D95DD3B5}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty black ops\blackops.exe |
    "{9075B8D1-8846-459B-9121-64ED6A9BBFE9}" = protocol=17 | dir=in | app=d:\program files\utorrent\utorrent.exe |
    "{90BA3E75-851E-4344-9662-9842C373BDBA}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steam.exe |
    "{9BFE1E55-8351-4F40-8CF2-3DF7BC4A549D}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steam.exe |
    "{9DE34B6A-150B-452C-8E83-DB1143794F79}" = protocol=6 | dir=out | app=system |
    "{A1E1FA4F-9D8E-4462-89D0-203DB9110669}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe |
    "{A960DE5C-EE12-4E4D-8E99-C5242B1D2534}" = protocol=17 | dir=in | app=d:\program files\azureus.exe |
    "{ACC4DC7D-39D1-48D0-91B2-43631C686F52}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{BB0C3A18-1AB5-4CB4-B406-2A28C554212B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
    "{BC7CAADF-748A-4103-BE06-362C2D942C00}" = protocol=1 | dir=in | name=sisoftware deployment agent service (icmp-in) |
    "{CED9153F-DDED-45A9-A1DE-07519A6DE7DA}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steam.exe |
    "{D33CB4B9-D419-4924-A183-B887B0E4DA78}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{D3C6A69A-DED9-40B2-AD4A-387772ED4638}" = protocol=1 | dir=in | name=sisoftware deployment agent service (icmp-in) |
    "{D3E5242D-66E1-4AF7-A426-513134831E7C}" = protocol=6 | dir=in | app=d:\program files\utorrent\utorrent.exe |
    "{D595FBED-9517-4E1E-9C9F-F68DFF4B229A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{D8F74FE3-5896-411A-89AF-83830C504CEB}" = protocol=1 | dir=in | name=sisoftware sandra agent service (icmp-in) |
    "{D9A93F60-4D07-48E9-9768-5B2192241309}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
    "{DE7FBDED-7E8A-4476-8CF9-98A690623F1C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{E1BA0E75-4537-4946-903A-03E9C22AF86A}" = dir=in | app=d:\program files\itunes\itunes.exe |
    "{E90E8801-298B-4DAF-A0D8-2CBAF7B64C1A}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
    "{EE44B7F0-E4B8-4C62-B9D1-8D531717B172}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{F11AA888-3964-43C2-A116-6724CA079D59}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
    "{F7FA8AAA-EA87-47B8-88E5-D12F4F944692}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe |
    "{FC2C4435-5A92-45C9-A724-5840906301AF}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
    "{FC346ECF-2A36-4789-B6B9-A0EB2E6CEFF8}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\left 4 dead\left4dead.exe |
    "TCP Query User{34A8C645-74A9-49EB-9B74-CC432D397494}C:\users\mikes\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\mikes\appdata\local\akamai\netsession_win.exe |
    "TCP Query User{501D09F4-D8A5-48DC-9222-C2D720DD89B0}D:\program files\azureus.exe" = protocol=6 | dir=in | app=d:\program files\azureus.exe |
    "TCP Query User{8C8DAB26-1846-4470-8B81-D31491BDB89E}D:\users\michael2\programs\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe |
    "TCP Query User{9F5D9DDC-A8AF-47F7-A252-2379CF0329F4}D:\users\michael2\programs\steam\reliccoh.exe" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\reliccoh.exe |
    "UDP Query User{06137134-62DD-491E-A11B-E1C0B3C8324D}D:\users\michael2\programs\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe |
    "UDP Query User{977C8D54-2CC6-4A00-A4DA-CDEEABD2F03C}D:\users\michael2\programs\steam\reliccoh.exe" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\reliccoh.exe |
    "UDP Query User{A633D05B-7B8F-4CB7-8EF4-DFB2300CD08B}C:\users\mikes\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\mikes\appdata\local\akamai\netsession_win.exe |
    "UDP Query User{B9107E23-A4FE-4B24-9CC7-FC23893C3A53}D:\program files\azureus.exe" = protocol=17 | dir=in | app=d:\program files\azureus.exe |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.1 (r518)
    "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
    "{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
    "{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI
    "{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI
    "{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
    "{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
    "{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer
    "{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI
    "{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{48963B63-7A10-49D6-8B08-61E6132453D0}" = ViewSonic Monitor Drivers
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4D43D635-6FDA-4fa5-AA9B-23CF73D058EA}" = Nero StartSmart OEM
    "{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI
    "{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI
    "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
    "{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
    "{5d8d6048-e45a-499d-a6ee-fc02e4448548}" = Nero 9 Essentials
    "{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
    "{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
    "{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
    "{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
    "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
    "{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
    "{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
    "{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
    "{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI
    "{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI
    "{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
    "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
    "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
    "{942E5031-2BD6-4C1B-918C-C8A1CBAE7B8C}" = Microsoft IntelliPoint 8.2
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI
    "{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
    "{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 301.42
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 301.42
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 301.42
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 301.42
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.12.0213
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.8.15
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.3.16.0
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
    "{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI
    "{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
    "{C3113E55-7BCB-4de3-8EBF-60E6CE6B2296}_is1" = SiSoftware Sandra Professional Business 2011.SP4
    "{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1" = SiSoftware Sandra Lite 2012.SP4c
    "{C83FB11D-9EC6-49D7-99A7-DDDB2264883C}" = Brother MFL-Pro Suite MFC-9440CN
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CC452A50-5C87-4A1F-B295-445C3C69BF7D}" = NVIDIA MediaShield
    "{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI
    "{D6AB1F5B-FED6-49A9-9747-327BD28FB3C7}" = COMODO Internet Security
    "{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
    "{dba84796-8503-4ff0-af57-1747dd9a166d}" = Nero Online Upgrade
    "{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
    "{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI
    "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    "{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes
    "8461-7759-5462-8226" = Vuze
    "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.6
    "AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
    "CCleaner" = CCleaner
    "C-Media Oxygen HD Audio Driver" = ASUS Xonar DX Audio Driver
    "COMODO GeekBuddy" = COMODO GeekBuddy
    "Company of Heroes" = Company of Heroes
    "CPUID CPU-Z_is1" = CPUID CPU-Z 1.58
    "DriverAgent.exe" = DriverAgent by eSupport.com
    "Free Window Registry Repair" = Free Window Registry Repair
    "ImgBurn" = ImgBurn
    "InstallShield_{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
    "InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
    "IObit Malware Fighter_is1" = IObit Malware Fighter
    "Magic ISO Maker v5.5 (build 0281)" = Magic ISO Maker v5.5 (build 0281)
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
    "Microsoft Security Client" = Microsoft Security Essentials
    "Mozilla Firefox 7.0.1 (x86 en-US)" = Mozilla Firefox 7.0.1 (x86 en-US)
    "NVIDIA Drivers" = NVIDIA Drivers
    "OpenAL" = OpenAL
    "PCSafeDoctor_is1" = PCSafeDoctor
    "Precision" = EVGA Precision 2.1.2
    "RealPlayer 15.0" = RealPlayer
    "Smart Defrag 2_is1" = Smart Defrag 2
    "SpeedFan" = SpeedFan (remove only)
    "Steam App 42680" = Call of Duty: Modern Warfare 3
    "Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
    "Steam App 42750" = Call of Duty: Modern Warfare 3 - Dedicated Server
    "Steam App 500" = Left 4 Dead
    "Steam App 63380" = Sniper Elite V2
    "Steam App 72850" = The Elder Scrolls V: Skyrim
    "uTorrent" = µTorrent
    "VirtualCloneDrive" = VirtualCloneDrive
    "Vuze_Remote Toolbar" = Vuze Remote Toolbar
    "WinRAR archiver" = WinRAR 4.01 (32-bit)

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Akamai" = Akamai NetSession Interface
    "Mozilla Firefox 10.0.2 (x86 en-US)" = Mozilla Firefox 10.0.2 (x86 en-US)

    ========== Last 20 Event Log Errors ==========

    [ Application Events ]
    Error - 8/6/2012 10:25:57 PM | Computer Name = Mikes-PC | Source = SideBySide | ID = 16842785
    Description = Activation context generation failed for "d:\program files\sisoftware\sisoftware
    sandra professional business 2011.sp4\wnt500x64\RpcSandraSrv.exe". Dependent Assembly
    Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
    could not be found. Please use sxstrace.exe for detailed diagnosis.

    Error - 8/6/2012 10:26:01 PM | Computer Name = Mikes-PC | Source = SideBySide | ID = 16842785
    Description = Activation context generation failed for "d:\program files\sisoftware\sisoftware
    sandra lite 2012.sp4c\wnt500x64\RpcSandraSrv.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
    could not be found. Please use sxstrace.exe for detailed diagnosis.

    Error - 8/7/2012 3:47:46 PM | Computer Name = Mikes-PC | Source = Application Error | ID = 1000
    Description = Faulting application name: MsMpEng.exe, version: 4.0.1526.0, time
    stamp: 0x4f710236 Faulting module name: mprtp.dll, version: 4.0.1526.0, time stamp:
    0x4f71024d Exception code: 0xc0000005 Fault offset: 0x00024f00 Faulting process id:
    0x40c Faulting application start time: 0x01cd74c43bfde164 Faulting application path:
    C:\Program Files\Microsoft Security Client\MsMpEng.exe Faulting module path: C:\Program
    Files\Microsoft Security Client\mprtp.dll Report Id: c28368c4-e0c8-11e1-97d1-044b80808004

    Error - 8/8/2012 8:39:39 PM | Computer Name = Mikes-PC | Source = VSS | ID = 8194
    Description =

    Error - 8/8/2012 9:25:49 PM | Computer Name = Mikes-PC | Source = Application Error | ID = 1000
    Description = Faulting application name: aswMBR.exe, version: 0.9.9.1665, time stamp:
    0x4f5f9c86 Faulting module name: aswMBR.exe, version: 0.9.9.1665, time stamp: 0x4f5f9c86
    Exception
    code: 0xc0000005 Fault offset: 0x0004f5db Faulting process id: 0xb1c Faulting application
    start time: 0x01cd75cda1e6b1f4 Faulting application path: C:\Users\Mikes\Desktop\aswMBR.exe
    Faulting
    module path: C:\Users\Mikes\Desktop\aswMBR.exe Report Id: 262db73c-e1c1-11e1-aa92-044b80808004

    Error - 8/8/2012 9:39:28 PM | Computer Name = Mikes-PC | Source = IMFservice | ID = 0
    Description =

    Error - 8/8/2012 10:16:56 PM | Computer Name = Mikes-PC | Source = Application Error | ID = 1000
    Description = Faulting application name: taskhost.exe, version: 6.1.7601.17514,
    time stamp: 0x4ce78ca9 Faulting module name: HsSrv.dll_unloaded, version: 0.0.0.0,
    time stamp: 0x4c930239 Exception code: 0xc0000005 Fault offset: 0x1000ab9e Faulting
    process id: 0x920 Faulting application start time: 0x01cd75d3c29e87b8 Faulting application
    path: C:\Windows\system32\taskhost.exe Faulting module path: HsSrv.dll Report Id:
    4a2d3ebc-e1c8-11e1-8067-044b80808004

    Error - 8/8/2012 10:52:14 PM | Computer Name = Mikes-PC | Source = SideBySide | ID = 16842785
    Description = Activation context generation failed for "d:\program files\sisoftware\sisoftware
    sandra lite 2012.sp4c\wnt500x64\RpcSandraSrv.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
    could not be found. Please use sxstrace.exe for detailed diagnosis.

    Error - 8/8/2012 10:52:20 PM | Computer Name = Mikes-PC | Source = SideBySide | ID = 16842785
    Description = Activation context generation failed for "d:\program files\sisoftware\sisoftware
    sandra professional business 2011.sp4\wnt500x64\RpcSandraSrv.exe". Dependent Assembly
    Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
    could not be found. Please use sxstrace.exe for detailed diagnosis.

    Error - 8/8/2012 10:52:24 PM | Computer Name = Mikes-PC | Source = SideBySide | ID = 16842785
    Description = Activation context generation failed for "d:\program files\sisoftware\sisoftware
    sandra professional home 2010.sp2\wnt500x64\RpcSandraSrv.exe". Dependent Assembly
    Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
    could not be found. Please use sxstrace.exe for detailed diagnosis.

    [ System Events ]
    Error - 4/13/2012 3:55:43 PM | Computer Name = Mikes-PC | Source = NVNET | ID = 5008
    Description = NVIDIA nForce 10/100/1000 Mbps Ethernet : Has encountered an invalid
    network address.

    Error - 4/13/2012 3:56:34 PM | Computer Name = Mikes-PC | Source = NVNET | ID = 5008
    Description = NVIDIA nForce 10/100/1000 Mbps Ethernet : Has encountered an invalid
    network address.

    Error - 4/13/2012 3:57:01 PM | Computer Name = Mikes-PC | Source = Service Control Manager | ID = 7001
    Description = The HomeGroup Provider service depends on the Function Discovery Provider
    Host service which failed to start because of the following error: %%1058

    Error - 4/14/2012 1:15:23 PM | Computer Name = Mikes-PC | Source = NVNET | ID = 5008
    Description = NVIDIA nForce 10/100/1000 Mbps Ethernet : Has encountered an invalid
    network address.

    Error - 4/14/2012 1:15:29 PM | Computer Name = Mikes-PC | Source = BugCheck | ID = 1001
    Description =

    Error - 4/14/2012 1:19:16 PM | Computer Name = Mikes-PC | Source = Service Control Manager | ID = 7001
    Description = The HomeGroup Provider service depends on the Function Discovery Provider
    Host service which failed to start because of the following error: %%1058

    Error - 4/15/2012 2:11:32 PM | Computer Name = Mikes-PC | Source = NVNET | ID = 5008
    Description = NVIDIA nForce 10/100/1000 Mbps Ethernet : Has encountered an invalid
    network address.

    Error - 4/15/2012 2:12:48 PM | Computer Name = Mikes-PC | Source = Service Control Manager | ID = 7001
    Description = The HomeGroup Provider service depends on the Function Discovery Provider
    Host service which failed to start because of the following error: %%1058

    Error - 4/15/2012 6:32:11 PM | Computer Name = Mikes-PC | Source = Service Control Manager | ID = 7009
    Description = A timeout was reached (30000 milliseconds) while waiting for the Steam
    Client Service service to connect.

    Error - 4/15/2012 6:32:11 PM | Computer Name = Mikes-PC | Source = Service Control Manager | ID = 7000
    Description = The Steam Client Service service failed to start due to the following
    error: %%1053


    < End of report >

    Running better....have downloaded and installed Comodo now.....thank
     
  20. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    Oops, just had a BSOD ....event viewer had a series of errors showing like Function Discovery Provider Host Service would not start,

    custom dynamic link libraries are being loaded for every service,

    Advanced System Care 5 failed to start bc the system cant find the file (I had already deleted the program)

    Audit events have been dropped by the transport

    Microsoft Security client OOBE stopped due to error 0xC000000D

    Nvidia Nforce has encountered an invalid network address

    The computer rebooted from a bugcheck with dump saved,
     
  21. Broni

    Broni Malware Annihilator Posts: 47,975   +271

    You may have some other issues as well beside being infected.
    Let's finish cleaning process and we'll see how it goes.
    BTW, those registry cleaning tools could be one of the reasons for your troubles.

    Uninstall Free Window Registry Repair for the very same reason as Advanced System Care.

    ==============================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      SRV - File not found [Auto | Stopped] -- D:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe -- (AdvancedSystemCareService5)
      IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
      [2012/08/07 18:48:19 | 000,000,000 | ---D | C] -- C:\FRST
      @Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:D1B5B4F1
      [2011/09/24 22:36:41 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\Registry Mechanic
      
      
      :Services
      
      :Reg
      
      :Files
      D:\Program Files\IObit
      
      :Commands
      [purity]
      [emptytemp]
      [emptyjava]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =====================================

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

    2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.


    3. Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    4. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click on List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  22. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    Thanks Broni, OTL custom scan log here:

    All processes killed
    ========== OTL ==========
    Service AdvancedSystemCareService5 stopped successfully!
    Service AdvancedSystemCareService5 deleted successfully!
    File D:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe not found.
    HKU\S-1-5-21-376916492-290187006-1338432341-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
    C:\FRST\Quarantine folder moved successfully.
    C:\FRST\Logs folder moved successfully.
    C:\FRST\Hives folder moved successfully.
    C:\FRST folder moved successfully.
    ADS C:\ProgramData\TEMP:D1B5B4F1 deleted successfully.
    C:\Users\Mikes\AppData\Roaming\Registry Mechanic\log folder moved successfully.
    C:\Users\Mikes\AppData\Roaming\Registry Mechanic\Health folder moved successfully.
    C:\Users\Mikes\AppData\Roaming\Registry Mechanic folder moved successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    D:\Program Files\IObit\Smart Defrag 2\Skins\White folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\Skins\Black folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\Skins folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\Log folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\LatestNews folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\Language folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\Help\Images folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\Help folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\Freeware folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\drivers\wxp_x86 folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\drivers\wxp_x64 folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\drivers\wnet_x86 folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\drivers\wnet_x64 folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\drivers\wlh_x86 folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\drivers\wlh_x64 folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\drivers\win7_x86 folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\drivers\win7_x64 folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2\drivers folder moved successfully.
    D:\Program Files\IObit\Smart Defrag 2 folder moved successfully.
    D:\Program Files\IObit\IObit Malware Fighter\Quarantine Zone folder moved successfully.
    D:\Program Files\IObit\IObit Malware Fighter\log\scan folder moved successfully.
    D:\Program Files\IObit\IObit Malware Fighter\log\realtime folder moved successfully.
    D:\Program Files\IObit\IObit Malware Fighter\log folder moved successfully.
    D:\Program Files\IObit\IObit Malware Fighter folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 5\Update folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 5\SecurityHole_Backup folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 5\LatestNews folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 5\BootTimeLog folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 5\ASCServiceLog folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 5 folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 4\Update folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 4\LatestNews folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 4\Freeware\FreeSoftwareDownload folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 4\Freeware folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 4 folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Update\Skin\White folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Update\Skin\Black folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Update\Skin folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Update\Language folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Update folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Skin\White folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Skin\Black folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Skin folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\News\Css folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\News folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Language folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Images folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\ViewSonic VX2235wm-7 folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\ViewSonic VX2235wm-3 folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\NVIDIA nForce Serial ATA Controller folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\NVIDIA nForce 101001000 Mbps Ethernet folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\NVIDIA High Definition Audio folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\NVIDIA GeForce GTX 580 folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\MagicISO SCSI Host Controller folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\Brother MFC-9440CN Remote Setup Port folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\Brother MFC-9440CN Printer folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\Brother MFC-9440CN folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\ASUS Xonar DX Audio Device folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\Apple iPod USB Driver folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3\Backup folder moved successfully.
    D:\Program Files\IObit\Advanced SystemCare 3 folder moved successfully.
    D:\Program Files\IObit folder moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Mikes
    ->Temp folder emptied: 1098792 bytes
    ->Temporary Internet Files folder emptied: 40836 bytes
    ->Java cache emptied: 811422 bytes
    ->FireFox cache emptied: 81006857 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 1646 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    User: UpdatusUser
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 7004 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 79.00 mb


    [EMPTYJAVA]

    User: All Users

    User: Default

    User: Default User

    User: Mikes
    ->Java cache emptied: 0 bytes

    User: Public

    User: UpdatusUser

    Total Java Files Cleaned = 0.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default

    User: Default User

    User: Mikes
    ->Flash cache emptied: 0 bytes

    User: Public

    User: UpdatusUser

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.56.0 log created on 08092012_102357

    Files\Folders moved on Reboot...

    PendingFileRenameOperations files...

    Registry entries deleted on Reboot...
     
  23. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    Security Check log here:

    Results of screen317's Security Check version 0.99.43
    Windows 7 Service Pack 1 x86 (UAC is disabled!)
    Internet Explorer 9
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Disabled!
    Microsoft Security Essentials
    (On Access scanning disabled!)
    Error obtaining update status for antivirus!
    `````````Anti-malware/Other Utilities Check:`````````
    Malwarebytes Anti-Malware version 1.62.0.1300
    CCleaner
    Java(TM) 6 Update 31
    Java version out of Date!
    Adobe Flash Player 11.3.300.270
    Adobe Reader X (10.1.3)
    Mozilla Firefox (7.0.1)
    ````````Process Check: objlist.exe by Laurent````````
    Microsoft Security Essentials MSMpEng.exe
    Malwarebytes Anti-Malware mbamservice.exe
    Comodo Firewall cmdagent.exe
    Comodo Firewall cfp.exe
    IObit IObit Malware Fighter IMFsrv.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: 0%
    ````````````````````End of Log``````````````````````
     
  24. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    Farbar Log here:

    Farbar Service Scanner Version: 06-08-2012
    Ran by Mikes (administrator) on 09-08-2012 at 10:35:32
    Running from "C:\Users\Mikes\Desktop"
    Microsoft Windows 7 Home Premium Service Pack 1 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo IP is accessible.
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall"=DWORD:0


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Action Center:
    ============

    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend service is OK.
    The ServiceDll of WinDefend service is OK.


    Windows Defender Disabled Policy:
    ==========================
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1


    Other Services:
    ==============


    File Check:
    ========
    C:\Windows\system32\nsisvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\system32\dhcpcore.dll => MD5 is legit
    C:\Windows\system32\Drivers\afd.sys => MD5 is legit
    C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
    C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\system32\dnsrslvr.dll => MD5 is legit
    C:\Windows\system32\mpssvc.dll => MD5 is legit
    C:\Windows\system32\bfe.dll => MD5 is legit
    C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\system32\SDRSVC.dll => MD5 is legit
    C:\Windows\system32\vssvc.exe => MD5 is legit
    C:\Windows\system32\wscsvc.dll => MD5 is legit
    C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\system32\wuaueng.dll => MD5 is legit
    C:\Windows\system32\qmgr.dll => MD5 is legit
    C:\Windows\system32\es.dll => MD5 is legit
    C:\Windows\system32\cryptsvc.dll => MD5 is legit
    C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
    C:\Windows\system32\svchost.exe => MD5 is legit
    C:\Windows\system32\rpcss.dll => MD5 is legit


    **** End of log ****
     
  25. whiteknight1950

    whiteknight1950 TS Rookie Topic Starter Posts: 28

    Temp file Cleaner ran ok:

    The ESET ONline Scanner text file is:

    C:\Program Files\FoxTabVideoConverter\VideoConverter.exe a variant of Win32/InstallCore.A application
    C:\Qoobox\Quarantine\C\Windows\System32\drivers\RKHit.sys.vir Win32/Adware.SpywareCease application
    C:\Users\Mikes\Downloads\Alcohol120_trial_2.0.2.3931.exe a variant of Win32/InstallCore.T application
    C:\Users\Mikes\Downloads\cnet2_RegpairSetup_exe.exe a variant of Win32/InstallCore.D application
    D:\MIKES-PC\Backup Set 2012-03-18 190001\Backup Files 2012-03-18 190001\Backup files 5.zip HTML/Hoax.FastDownload.A.Gen application
    D:\MIKES-PC\Backup Set 2012-03-18 190001\Backup Files 2012-03-30 111111\Backup files 2.zip Java/Exploit.CVE-2011-3544.BB trojan
    D:\MIKES-PC\Backup Set 2012-05-27 190002\Backup Files 2012-06-03 190005\Backup files 2.zip HTML/ScrInject.B.Gen virus
    D:\MIKES-PC\Backup Set 2012-05-27 190002\Backup Files 2012-07-16 110612\Backup files 1.zip multiple threats
    D:\MIKES-PC\Backup Set 2012-05-27 190002\Backup Files 2012-07-16 110612\Backup files 7.zip Win32/Toolbar.AskSBar application
    D:\MIKES-PC\Backup Set 2012-08-06 161406\Backup Files 2012-08-06 161406\Backup files 6.zip multiple threats


    Darn it !!!

    Cheers
    Mike
     


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.