TechSpot

Trojan trouble

Solved
By David Templeton
Jul 26, 2012
  1. Hello,

    I recently had some trouble with trojan and other viruses that I removed with Avira Free Anti-virus and Malware bytes Anti-Malware. However, I'm still having symptoms that I don't know how to fix and I need to get full functionality back as soon as I can (doesn't everyone :) ).

    The current symptoms I currently see are not being able to access google calendar. I can get to and use gmail fine, but attempts to get to google calendar reports:

    "Unable to connect
    Firefox can't establish a connection to the server at www.google.com."

    Also, I tried running WinSockFix to correct this and it seemed to fix this once, but then the symptoms returned a bit later.

    I am unable to logoff successfully. After Vista's windowing system exits, I just get stuck on a blank black screen with the hard drive continuing to work off and on endlessly.

    Just before this state, I had removed a few viruses with the aforementioned tools, but afterwards, I noticed something I hadn't encountered before. I kept having one of my instances of svchost.exe grow in memory usage from 300 MB to 1GB (eventually). Then the process would begin to use more and more CPU (up to 35-40 %). I would finally resort to killing that process using Task Manager. After doing this I would notice some oddities in graphics and windowing functionality for a minute or two, then after about 30 minutes to 1 hour, I'd run into the same/similar scenario with the replacement svchost.exe process.

    I ran sfx /SCANNOW after running several more scans using the aforementioned tools, sometimes finding something, sometimes not. I had also previously run CCleaner tool (before all this). I no longer have noticed the svchost.exe symptoms since the last day or two (since running your tools GMER, DDS, etc.).

    Before all these things, I had installed and been using Mumble (open source voice over IP tool). I still have trouble believing this was the cause of all this, but others that also used Mumble with me have had strange events occur on their machines as well. I eventually uninstalled that software and have just been trying to get my machine back to normal.

    Thank you in advance for any and all help as I really need this machine to be back to normal ASAP, but I don't want to reinstall and reconfigure Windows and all applications all over again.

    Here are the logs you require to begin (5 steps):

    Malwarebytes Anti-Malware 1.62.0.1300
    www.malwarebytes.org

    Database version: v2012.07.24.12

    Windows Vista Service Pack 2 x86 NTFS
    Internet Explorer 9.0.8112.16421
    OWNER :: GIFTFROMGOD [administrator]

    7/25/2012 8:59:55 AM
    mbam-log-2012-07-25 (08-59-55).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 188019
    Time elapsed: 10 minute(s), 20 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)


    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2012-07-25 15:28:43
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 ST932032 rev.0001
    Running: xy5dleq6.exe; Driver: C:\Users\OWNER\AppData\Local\Temp\pxrcipow.sys


    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
    AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

    ---- EOF - GMER 1.0.15 ----


    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_33
    Run by OWNER at 15:42:49 on 2012-07-25
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.936 [GMT -4:00]
    .
    AV: Norton 360 *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
    AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
    SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Norton 360 *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
    FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
    FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\Protector Suite QL\upeksvr.exe
    C:\Windows\system32\WLANExt.exe
    C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Windows\system32\agrsmsvc.exe
    C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
    C:\TOSHIBA\IVP\ISM\pinger.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\rundll32.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\TODDSrv.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Program Files\Synaptics\SynTP\SynToshiba.exe
    C:\Program Files\Ask.com\Updater\Updater.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.yahoo.com
    uSearch Bar = Preserve
    mStart Page = hxxp://www.yahoo.com
    mDefault_Page_URL = hxxp://www.yahoo.com
    uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
    uURLSearchHooks: H - No File
    uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    mURLSearchHooks: H - No File
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
    BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    TB: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
    TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    TB: {DD662A0C-12FE-4B38-BA53-247F7EC82F46} - No File
    TB: {7B13EC3E-999A-4B70-B9CB-2617B8323822} - No File
    uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\TOSCDSPD.exe
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    uRun: [Adobe] rundll32.exe "c:\users\owner\appdata\local\apps\adobe\zncvlw.dll",CreateInstance
    uRun: [Google Update] "c:\users\owner\appdata\local\google\update\GoogleUpdate.exe" /c
    mRun: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
    mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
    mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    mRun: [ROC_roc_dec12] "c:\program files\avg secure search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
    mRun: [SynTPStart] c:\program files\synaptics\syntp\SynTPStart.exe
    mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
    mRun: [HF_G_Jul] "c:\program files\avg secure search\HF_G_Jul.exe" /DoAction
    mRun: [<NO NAME>]
    mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    mRun: [ISW]
    mRun: [ZoneAlarm] "c:\program files\checkpoint\zonealarm\zatray.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    dRun: [Adobe] rundll32.exe "c:\users\owner\appdata\local\apps\adobe\zncvlw.dll",CreateInstance
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: DisableCAD = 1 (0x1)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - c:\program files\paltalk messenger\Paltalk.exe
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
    LSP: c:\program files\avira\antivir desktop\avsda.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: DhcpNameServer = 10.0.1.1
    TCP: Interfaces\{01832491-381F-49E0-A5A4-988DB319D2EF} : NameServer = 76.5.159.133,63.162.197.99
    TCP: Interfaces\{6CD59901-EDA4-4072-A93D-9E5CAA909388} : DhcpNameServer = 10.0.1.1
    Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: igfxcui - igfxdev.dll
    Notify: psfus - c:\windows\system32\psqlpwd.dll
    LSA: Notification Packages = scecli psqlpwd
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\owner\appdata\roaming\mozilla\firefox\profiles\gnc54s2q.default-1342793624225\
    FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/outdoors/agriculture/forecast/10-day/24210
    FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
    FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll
    FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
    FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
    FF - plugin: c:\program files\mcafee\siteadvisor\NPMcFFPlg32.dll
    FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
    FF - plugin: c:\users\owner\appdata\local\google\update\1.3.21.115\npGoogleUpdate3.dll
    FF - plugin: c:\users\owner\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
    FF - plugin: c:\users\owner\appdata\roaming\mozilla\plugins\npgoogletalk.dll
    FF - plugin: c:\users\owner\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
    FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_235.dll
    FF - plugin: c:\windows\system32\npdeployJava1.dll
    FF - plugin: c:\windows\system32\npmproxy.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-7-19 36000]
    R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-4-4 63928]
    R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2012-7-19 86224]
    R2 AntiVirService;Avira Realtime Protection;c:\program files\avira\antivir desktop\avguard.exe [2012-7-19 110032]
    R2 AntiVirWebService;Avira Web Protection;c:\program files\avira\antivir desktop\avwebgrd.exe [2012-7-19 465360]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-7-19 83392]
    R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-8-9 21504]
    R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2012-7-9 27056]
    R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2012-7-9 497320]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\sitead~1\mcsacore.exe [2012-1-16 95232]
    R2 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2012-5-30 3048136]
    R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2007-5-8 7168]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-6-7 160944]
    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-5 257696]
    S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2011-6-2 11336]
    S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-25 113120]
    S3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\drivers\PTDUBus.sys [2009-8-28 29824]
    S3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\drivers\PTDUMdm.sys [2009-8-28 41344]
    S3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\drivers\PTDUVsp.sys [2009-8-28 39936]
    S3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\drivers\PTDUWWAN.sys [2009-8-28 59776]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    .
    =============== Created Last 30 ================
    .
    2012-07-24 07:27:10 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{f07a55a0-0590-4dcf-b873-f2c1540c144f}\offreg.dll
    2012-07-24 06:24:26 6891424 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{f07a55a0-0590-4dcf-b873-f2c1540c144f}\mpengine.dll
    2012-07-20 20:50:26 476976 ----a-w- c:\windows\system32\npdeployJava1.dll
    2012-07-20 13:01:20 499082 ----a-w- c:\program files\mozilla firefox\uninstall\uninstaller.exe
    2012-07-20 12:53:35 -------- d-----w- c:\users\owner\appdata\roaming\CheckPoint
    2012-07-20 12:47:07 -------- d-----w- C:\2dda44f8e50167a02f6c581e51e8
    2012-07-20 12:45:29 6891424 ----a-w- c:\programdata\microsoft\windows defender\definition updates\backup\mpengine.dll
    2012-07-20 12:45:24 237072 ------w- c:\windows\system32\MpSigStub.exe
    2012-07-20 04:54:52 -------- d-----w- c:\program files\CheckPoint
    2012-07-20 04:53:45 -------- d-----w- c:\programdata\CheckPoint
    2012-07-19 23:07:09 -------- d-----w- c:\users\owner\appdata\roaming\Avira
    2012-07-19 22:56:55 -------- d-----w- c:\program files\Ask.com
    2012-07-19 22:56:32 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2012-07-19 22:56:32 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
    2012-07-19 22:56:30 -------- d-----w- c:\programdata\Avira
    2012-07-19 22:56:30 -------- d-----w- c:\program files\Avira
    2012-07-17 04:45:19 -------- d-sh--w- c:\windows\system32\%APPDATA%
    2012-07-16 12:30:45 -------- d-----w- c:\users\owner\appdata\local\{F8223472-D0A5-487D-B3E7-947B7EB53286}
    2012-07-16 12:30:41 -------- d-----w- c:\users\owner\appdata\local\{458EFC50-52CB-499A-B5F0-6C4644D127BC}
    2012-07-16 12:30:40 -------- d-----w- c:\users\owner\appdata\local\{5FF343BB-041F-457D-9C23-0441700EE7F6}
    2012-07-14 15:47:05 -------- d-----w- c:\users\owner\appdata\local\{84D2A485-C8F5-48D7-AA7C-424A3AEE6D05}
    2012-07-14 15:46:56 -------- d-----w- c:\users\owner\appdata\local\{327C8E7B-BE2B-4D44-9286-641D999C70A8}
    2012-07-13 14:13:27 -------- d-----w- c:\users\owner\appdata\roaming\Mumble
    2012-07-13 13:39:31 -------- d-----w- c:\program files\Mumble
    2012-07-13 13:14:14 -------- d-----w- c:\users\owner\appdata\local\{C7685BC3-9B44-4480-9FB6-91BC9BB12C58}
    2012-07-13 13:14:07 -------- d-----w- c:\users\owner\appdata\local\{F3762B98-99FD-48B7-AE5F-8A85F55EEC93}
    2012-07-13 00:13:15 -------- d-----w- c:\users\owner\appdata\local\{89D7CD81-38C6-4298-9250-E1403874A2C2}
    2012-07-13 00:13:13 -------- d-----w- c:\users\owner\appdata\local\{AADBD742-3E57-4511-B3E5-7A7D8A3AFBFA}
    2012-07-13 00:12:59 -------- d-----w- c:\users\owner\Tracing
    2012-07-12 23:41:22 537432 ----a-w- c:\program files\common files\windows live\.cache\d75497de1cd608728\DXSETUP.exe
    2012-07-12 23:41:21 89944 ----a-w- c:\program files\common files\windows live\.cache\d75497de1cd608728\DSETUP.dll
    2012-07-12 23:41:21 1801048 ----a-w- c:\program files\common files\windows live\.cache\d75497de1cd608728\dsetup32.dll
    2012-07-12 23:41:15 94040 ----a-w- c:\program files\common files\windows live\.cache\d27be6ae1cd608727\DSETUP.dll
    2012-07-12 23:41:15 525656 ----a-w- c:\program files\common files\windows live\.cache\d27be6ae1cd608727\DXSETUP.exe
    2012-07-12 23:41:15 1691480 ----a-w- c:\program files\common files\windows live\.cache\d27be6ae1cd608727\dsetup32.dll
    2012-07-12 13:45:19 2047488 ----a-w- c:\windows\system32\win32k.sys
    2012-07-12 13:39:54 1401856 ----a-w- c:\windows\system32\msxml6.dll
    2012-07-12 13:39:54 1248768 ----a-w- c:\windows\system32\msxml3.dll
    2012-07-12 13:39:53 708608 ----a-w- c:\program files\common files\system\ado\msado15.dll
    2012-07-12 13:39:42 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys
    2012-07-12 13:39:42 278528 ----a-w- c:\windows\system32\schannel.dll
    2012-07-12 13:39:42 204288 ----a-w- c:\windows\system32\ncrypt.dll
    2012-07-04 19:06:15 -------- d-----w- c:\users\owner\appdata\roaming\Malwarebytes
    2012-07-04 19:05:56 -------- d-----w- c:\programdata\Malwarebytes
    2012-07-04 19:05:55 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-07-04 19:05:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2012-07-04 18:51:51 -------- d-----w- c:\program files\CCleaner
    2012-06-29 03:19:15 -------- d-----w- c:\program files\StudyPost!
    2012-06-29 01:19:06 -------- d-----w- c:\program files\MiniBible Post!
    .
    ==================== Find3M ====================
    .
    2012-07-20 20:50:01 472880 ----a-w- c:\windows\system32\deployJava1.dll
    2012-06-09 00:24:03 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-06-09 00:24:03 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2012-06-02 22:12:32 2422272 ----a-w- c:\windows\system32\wucltux.dll
    2012-06-02 22:12:13 88576 ----a-w- c:\windows\system32\wudriver.dll
    2012-06-02 19:19:42 171904 ----a-w- c:\windows\system32\wuwebv.dll
    2012-06-02 19:12:20 33792 ----a-w- c:\windows\system32\wuapp.exe
    2012-06-02 08:33:25 1800192 ----a-w- c:\windows\system32\jscript9.dll
    2012-06-02 08:25:08 1129472 ----a-w- c:\windows\system32\wininet.dll
    2012-06-02 08:25:03 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
    2012-06-02 08:20:33 142848 ----a-w- c:\windows\system32\ieUnatt.exe
    2012-06-02 08:16:52 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2012-05-01 14:03:49 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    .
    ============= FINISH: 15:43:22.04 ===============

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft® Windows Vista™ Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 8/9/2009 6:19:53 PM
    System Uptime: 7/25/2012 3:01:45 PM (0 hours ago)
    .
    Motherboard: Intel Corporation | | SANTA ROSA CRB
    Processor: Intel(R) Core(TM)2 Duo CPU T5450 @ 1.66GHz | U2E1 | 1667/mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 297 GiB total, 199.816 GiB free.
    D: is CDROM (CDFS)
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    .
    ==== Installed Programs ======================
    .
    Update for Microsoft Office 2007 (KB2508958)
    Activation Assistant for the 2007 Microsoft Office suites
    Adobe Acrobat 4.0
    Adobe Flash Player 11 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Reader X (10.1.3)
    Adobe Shockwave Player
    Ask Toolbar
    Audacity 1.3.14 (Unicode)
    Avira Free Antivirus
    Avira SearchFree Toolbar plus Web Protection Updater
    Bluetooth Stack for Windows by Toshiba
    Broadcom High Definition Video Decoder 2.6.40.1
    Camera Assistant Software for Toshiba
    CCleaner
    CD/DVD Drive Acoustic Silencer
    D3DX10
    Desktop Dialer
    Diablo II
    DVD MovieFactory for TOSHIBA
    e-Sword
    Google Talk (remove only)
    Google Talk Plugin
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Intel Matrix Storage Manager
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) PROSet/Wireless Software
    Java Auto Updater
    Java(TM) 6 Update 33
    Java(TM) SE Runtime Environment 6
    LADSPA_plugins-win-0.4.15
    LAME v3.98.2 for Audacity
    Malwarebytes Anti-Malware version 1.62.0.1300
    Marvell Miniport Driver
    McAfee SiteAdvisor
    mCore
    mHelp
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Application Error Reporting
    Microsoft Office 2007 Service Pack 3 (SP3)
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office File Validation Add-In
    Microsoft Office Home and Student 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft Works
    Microsoft XML Parser
    MiniBible Post! 5.1c
    mMHouse
    Mozilla Firefox 14.0.1 (x86 en-US)
    Mozilla Maintenance Service
    mPfMgr
    MSVCRT
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Paltalk Messenger 10.2
    Paltalk Messenger Interop
    PANTECH PC USB Modem Software
    PANTECH UM175 Driver
    Protector Suite QL 5.6
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
    Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
    Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
    Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
    Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition
    Security Update for Windows Media Encoder (KB2447961)
    Security Update for Windows Media Encoder (KB954156)
    Security Update for Windows Media Encoder (KB979332)
    Segoe UI
    SimCity 3000
    Skype Click to Call
    Skype™ 5.10
    StudyPost! 3.1c
    Synaptics Pointing Device Driver
    System Requirements Lab for Intel
    Texas Instruments PCIxx21/x515/xx12 drivers.
    TIPCI
    TOSHIBA Assist
    TOSHIBA ConfigFree
    TOSHIBA Disc Creator
    TOSHIBA DVD PLAYER
    TOSHIBA Extended Tiles for Windows Mobility Center
    TOSHIBA Hardware Setup
    TOSHIBA Music
    Toshiba Registration
    TOSHIBA SD Memory Utilities
    TOSHIBA Software Modem
    TOSHIBA Software Upgrades
    TOSHIBA Speech System Applications
    TOSHIBA Speech System SR Engine(U.S.) Version1.0
    TOSHIBA Speech System TTS Engine(U.S.) Version1.0
    TOSHIBA Supervisor Password
    TOSHIBA Value Added Package
    Unity Web Player
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    VLC media player 2.0.1
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Messenger
    Windows Live Photo Common
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Media Encoder 9 Series
    Yahoo! Messenger
    ZoneAlarm Firewall
    ZoneAlarm Free Firewall
    ZoneAlarm LTD Toolbar
    ZoneAlarm Security
    .
    ==== Event Viewer Messages From Past Week ========
    .
    7/25/2012 3:29:48 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer AMYTAYMAY3-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6CD59901-EDA4-4072-A93D-9E5C. The master browser is stopping or an election is being forced.
    7/25/2012 3:05:08 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.0.0.16 for the Network Card with network address 0013E81B5FB9 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    7/25/2012 3:04:16 PM, Error: Service Control Manager [7001] - The Windows Media Player Network Sharing Service service depends on the UPnP Device Host service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    7/25/2012 3:03:45 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    7/24/2012 9:17:08 PM, Error: Service Control Manager [7034] - The Remote Access Connection Manager service terminated unexpectedly. It has done this 5 time(s).
    7/24/2012 9:17:08 PM, Error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    7/24/2012 8:16:15 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.0.0.16 for the Network Card with network address 0013E81B5FB9 has been denied by the DHCP server 10.0.0.1 (The DHCP Server sent a DHCPNACK message).
    7/24/2012 8:15:45 PM, Error: yukonwlh [101] - Driver has encountered an internal error
    7/24/2012 3:03:24 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
    7/24/2012 12:35:26 PM, Error: EventLog [6008] - The previous system shutdown at 12:21:06 PM on 7/24/2012 was unexpected.
    7/24/2012 1:34:48 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Remote Access Connection Manager service, but this action failed with the following error: An instance of the service is already running.
    7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Server service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The IKE and AuthIP IPsec Keying Modules service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Computer Browser service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Application Experience service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    7/23/2012 3:49:52 PM, Error: Microsoft-Windows-ResourcePublication [1002] - Element Provider\Microsoft.Base.Publication/Publication/Computer failed to publish. Ensure that both PKEY_PUBSVCS_METADATA and PKEY_PUBSVCS_TYPE are set properly on the function instance and there were no errors adding the function instance.
    7/23/2012 3:49:26 PM, Error: EventLog [6008] - The previous system shutdown at 3:46:19 PM on 7/23/2012 was unexpected.
    7/22/2012 5:19:42 PM, Error: EventLog [6008] - The previous system shutdown at 5:16:57 PM on 7/22/2012 was unexpected.
    7/21/2012 2:40:44 PM, Error: Service Control Manager [7043] - The Group Policy Client service did not shut down properly after receiving a preshutdown control.
    7/21/2012 12:05:51 PM, Error: EventLog [6008] - The previous system shutdown at 12:03:50 PM on 7/21/2012 was unexpected.
    7/20/2012 9:05:12 AM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.
    7/20/2012 9:01:27 PM, Error: Service Control Manager [7022] - The Server service hung on starting.
    7/20/2012 9:01:27 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: After starting, the service hung in a start-pending state.
    7/20/2012 8:55:02 AM, Error: Service Control Manager [7030] - The TrueVector Internet Monitor service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    7/20/2012 8:49:11 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer TRUEWORSHIPPER that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6CD59901-EDA4-4072-A93D-9E5. The master browser is stopping or an election is being forced.
    7/20/2012 11:07:51 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
    7/20/2012 11:07:51 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    7/20/2012 11:07:50 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    7/20/2012 11:07:18 PM, Error: Microsoft-Windows-PrintSpooler [22] - Failed to upgrade printer settings for printer Send To OneNote 2007,0 driver Send To Microsoft OneNote Driver. Error: 1801. The device settings for the printer are set to those configured by the manufacturer.
    7/19/2012 8:51:21 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.102 for the Network Card with network address 0013E81B5FB9 has been denied by the DHCP server 10.0.0.1 (The DHCP Server sent a DHCPNACK message).
    7/18/2012 9:25:44 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer ADMINJT-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6CD59901-EDA4-4072-A93D-9E5CAA9. The master browser is stopping or an election is being forced.
    .
    ==== End Of File ===========================
  2. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ======================================

    You're running two AV programs, Norton and Avira.
    You must uninstall one of them.
    If Norton use this tool: http://majorgeeks.com/Norton_Removal_Tool_SymNRT_d4749.html

    Next....

    • Download RogueKiller on the desktop
    • Close all the running programs
    • Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • A report (RKreport.txt) should open. Post its content in your next reply. (RKreport could also be found on your desktop)
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    =========================================

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan.
    On completion of the scan click "Save log", save it to your desktop and post in your next reply.

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.
  3. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    RogueKiller V7.6.4 [07/17/2012] by Tigzy
    mail: tigzyRK<at>gmail<dot>com
    Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
    Blog: http://tigzyrk.blogspot.com

    Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
    Started in : Normal mode
    User: OWNER [Admin rights]
    Mode: Scan -- Date: 07/26/2012 18:13:39

    ¤¤¤ Bad processes: 1 ¤¤¤
    [SUSP PATH] c2c_service.exe -- C:\ProgramData\Skype\Toolbars\Skype C2C

    Service\c2c_service.exe -> KILLED [TermProc]

    ¤¤¤ Registry Entries: 11 ¤¤¤
    [BLACKLIST DLL] HKCU\[...]\Run : Adobe (rundll32.exe

    "C:\Users\OWNER\AppData\Local\Apps\Adobe\zncvlw.dll",CreateInstance) -> FOUND
    [BLACKLIST DLL] HKUS\.DEFAULT[...]\Run : Adobe (rundll32.exe

    "C:\Users\OWNER\AppData\Local\Apps\Adobe\zncvlw.dll",CreateInstance) -> FOUND
    [BLACKLIST DLL] HKUS\S-1-5-19[...]\Run : Adobe (rundll32.exe

    "C:\Users\OWNER\AppData\Local\Apps\Adobe\zncvlw.dll",CreateInstance) -> FOUND
    [BLACKLIST DLL] HKUS\S-1-5-20[...]\Run : Adobe (rundll32.exe

    "C:\Users\OWNER\AppData\Local\Apps\Adobe\zncvlw.dll",CreateInstance) -> FOUND
    [BLACKLIST DLL] HKUS\S-1-5-21-758404498-191888814-2096916372-1000[...]\Run : Adobe

    (rundll32.exe "C:\Users\OWNER\AppData\Local\Apps\Adobe\zncvlw.dll",CreateInstance)

    -> FOUND
    [BLACKLIST DLL] HKUS\S-1-5-18[...]\Run : Adobe (rundll32.exe

    "C:\Users\OWNER\AppData\Local\Apps\Adobe\zncvlw.dll",CreateInstance) -> FOUND
    [DNS] HKLM\[...]\ControlSet001\Parameters\Interfaces\{01832491-381F-49E0-A5A4-

    988DB319D2EF} : NameServer (76.5.159.133,63.162.197.99) -> FOUND
    [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{01832491-381F-49E0-A5A4-

    988DB319D2EF} : NameServer (76.5.159.133,63.162.197.99) -> FOUND
    [HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
    [HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
    [HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver: [LOADED] ¤¤¤
    SSDT[289] : NtSetContextThread @ 0x8289F06F -> HOOKED (Unknown @ 0x8EAC9EAB)
    SSDT[314] : NtSetSecurityObject @ 0x827CC038 -> HOOKED (Unknown @ 0x8EAC9EB5)

    ¤¤¤ Infection : Root.MBR ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤


    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: +++++
    --- User ---
    [MBR] 6c2e7549fe4008901490ee6e39ea358a
    [BSP] 18b9a4c796e7464839454b2da1def178 : Windows Vista MBR Code
    Partition table:
    0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo
    1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 303744 Mo
    User != LL1 ... KO!
    --- LL1 ---
    [MBR] 1d1105dedb26f252720eb695fdcb5bb9
    [BSP] 18b9a4c796e7464839454b2da1def178 : Windows Vista MBR Code
    Partition table:
    1 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo
    2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 303744 Mo
    User != LL2 ... KO!
    --- LL2 ---
    [MBR] 1d1105dedb26f252720eb695fdcb5bb9
    [BSP] 18b9a4c796e7464839454b2da1def178 : Windows Vista MBR Code
    Partition table:
    1 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo
    2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 303744 Mo

    Finished : << RKreport[1].txt >>
    RKreport[1].txt



    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
    Run date: 2012-07-26 18:19:05
    -----------------------------
    18:19:05.662 OS Version: Windows 6.0.6002 Service Pack 2
    18:19:05.663 Number of processors: 2 586 0xF0D
    18:19:05.664 ComputerName: GIFTFROMGOD UserName: OWNER
    18:19:15.520 Initialize success
    18:23:08.354 AVAST engine defs: 12072602
    18:25:29.137 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice

    -0
    18:25:29.141 Disk 0 Vendor: ST932032 0001 Size: 305245MB BusType: 3
    18:25:29.146 Disk 0 MBR read successfully
    18:25:29.151 Disk 0 MBR scan
    18:25:29.214 Disk 0 Windows VISTA default MBR code
    18:25:29.219 Disk 0 MBR hidden
    18:25:29.237 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 1500 MB

    offset 2048
    18:25:29.266 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 303744 MB

    offset 3074048
    18:25:29.282 Disk 0 scanning sectors +625141760
    18:25:29.375 Disk 0 scanning C:\Windows\system32\drivers
    18:25:47.037 Service scanning
    18:26:19.717 Modules scanning
    18:26:26.583 Disk 0 trace - called modules:
    18:26:26.594 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN

    [0x864654b1]<<
    18:26:26.600 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x860d1898]
    18:26:26.607 3 CLASSPNP.SYS[885138b3] -> nt!IofCallDriver -> [0x8567f760]
    18:26:26.614 5 acpi.sys[806916bc] -> nt!IofCallDriver -> [0x85671030]
    18:26:26.621 \Driver\iaStor[0x8642a970] -> IRP_MJ_CREATE -> 0x864654b1
    18:26:28.380 AVAST engine scan C:\Windows
    18:26:32.387 AVAST engine scan C:\Windows\system32
    18:32:39.088 AVAST engine scan C:\Windows\system32\drivers
    18:33:10.605 AVAST engine scan C:\Users\OWNER
    18:43:50.034 Disk 0 MBR has been saved successfully to

    "C:\Users\OWNER\Desktop\Fix Computer\MBR.dat"
    18:43:50.045 The log file has been saved successfully to

    "C:\Users\OWNER\Desktop\Fix Computer\aswMBR.txt"
  4. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    Please disable "word wrap" in Notepad because some of your logs are hard to read.


    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
    There are 4 different versions. If one of them won't run then download and try to run the other one.
    Vista and Win7 users need to right click Rkill and choose Run as Administrator
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    * Rkill.com
    * Rkill.scr
    * Rkill.exe
    • Double-click on the Rkill icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.
    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
  5. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    ComboFix 12-07-27.02 - OWNER 07/26/2012 21:15:58.1.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.1046 [GMT -4:00]
    Running from: c:\users\OWNER\Desktop\ComboFix.exe
    AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
    FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
    SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\program files\AV7
    c:\programdata\Roaming
    c:\programdata\Roaming\Intel\Wireless\Settings\Settings.ini
    c:\users\OWNER\AppData\Local\Apps\Adobe\zncvlw.dll
    c:\windows\system32\Cache
    c:\windows\system32\Cache\07c04ac1ca7b01b1.fb
    c:\windows\system32\Cache\272512937d9e61a4.fb
    c:\windows\system32\Cache\287204568329e189.fb
    c:\windows\system32\Cache\28bc8f716fd76a47.fb
    c:\windows\system32\Cache\2c53092c95605355.fb
    c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
    c:\windows\system32\Cache\32c84fe32bb74d60.fb
    c:\windows\system32\Cache\3917078cb68ec657.fb
    c:\windows\system32\Cache\3bcf75db9204def5.fb
    c:\windows\system32\Cache\424c36e1e907914c.fb
    c:\windows\system32\Cache\590ba23ce359fd0c.fb
    c:\windows\system32\Cache\610289e025a3ee9a.fb
    c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
    c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
    c:\windows\system32\Cache\6d03dad1035885d3.fb
    c:\windows\system32\Cache\a8556537add6dfc5.fb
    c:\windows\system32\Cache\ad10a52aff5e038d.fb
    c:\windows\system32\Cache\c1fa887b03019701.fb
    c:\windows\system32\Cache\c4d28dca2e7648be.fb
    c:\windows\system32\Cache\d201ef9910cd39de.fb
    c:\windows\system32\Cache\d2e94710a5708128.fb
    c:\windows\system32\Cache\d79b9dfe81484ec4.fb
    c:\windows\system32\Cache\e0de16f883bea794.fb
    c:\windows\system32\Cache\e1fe5da940ced515.fb
    c:\windows\system32\Cache\f998975c9cc711ee.fb
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-06-27 to 2012-07-27 )))))))))))))))))))))))))))))))
    .
    .
    2012-07-27 01:24 . 2012-07-27 01:24 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-07-24 06:24 . 2012-07-16 06:41 6891424 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F07A55A0-0590-4DCF-B873-F2C1540C144F}\mpengine.dll
    2012-07-20 20:50 . 2012-07-20 20:50 476976 ----a-w- c:\windows\system32\npdeployJava1.dll
    2012-07-20 13:01 . 2012-07-20 13:01 499082 ----a-w- c:\program files\Mozilla Firefox\uninstall\uninstaller.exe
    2012-07-20 12:53 . 2012-07-20 12:53 -------- d-----w- c:\users\OWNER\AppData\Roaming\CheckPoint
    2012-07-20 12:47 . 2012-07-20 12:47 -------- d-----w- C:\2dda44f8e50167a02f6c581e51e8
    2012-07-20 12:45 . 2012-05-31 16:25 237072 ------w- c:\windows\system32\MpSigStub.exe
    2012-07-20 04:54 . 2012-07-20 12:52 -------- d-----w- c:\program files\CheckPoint
    2012-07-20 04:53 . 2012-07-20 04:53 -------- d-----w- c:\programdata\CheckPoint
    2012-07-19 23:07 . 2012-07-19 23:07 -------- d-----w- c:\users\OWNER\AppData\Roaming\Avira
    2012-07-19 22:56 . 2012-07-19 22:57 -------- d-----w- c:\program files\Ask.com
    2012-07-19 22:56 . 2012-04-27 14:20 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2012-07-19 22:56 . 2012-04-25 04:32 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2012-07-19 22:56 . 2012-04-17 01:18 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
    2012-07-19 22:56 . 2012-07-19 22:57 -------- d-----w- c:\programdata\Avira
    2012-07-19 22:56 . 2012-07-19 22:56 -------- d-----w- c:\program files\Avira
    2012-07-17 04:45 . 2012-07-17 04:45 -------- d-sh--w- c:\windows\system32\%APPDATA%
    2012-07-13 14:13 . 2012-07-19 01:38 -------- d-----w- c:\users\OWNER\AppData\Roaming\Mumble
    2012-07-13 13:39 . 2012-07-19 16:05 -------- d-----w- c:\program files\Mumble
    2012-07-13 00:12 . 2012-07-13 00:12 -------- d-----w- c:\users\OWNER\Tracing
    2012-07-12 23:44 . 2012-07-12 23:46 -------- d-----w- c:\program files\Windows Live
    2012-07-12 23:41 . 2012-07-12 23:41 537432 ----a-w- c:\program files\Common Files\Windows Live\.cache\d75497de1cd608728\DXSETUP.exe
    2012-07-12 23:41 . 2012-07-12 23:41 89944 ----a-w- c:\program files\Common Files\Windows Live\.cache\d75497de1cd608728\DSETUP.dll
    2012-07-12 23:41 . 2012-07-12 23:41 1801048 ----a-w- c:\program files\Common Files\Windows Live\.cache\d75497de1cd608728\dsetup32.dll
    2012-07-12 23:41 . 2012-07-12 23:41 94040 ----a-w- c:\program files\Common Files\Windows Live\.cache\d27be6ae1cd608727\DSETUP.dll
    2012-07-12 23:41 . 2012-07-12 23:41 525656 ----a-w- c:\program files\Common Files\Windows Live\.cache\d27be6ae1cd608727\DXSETUP.exe
    2012-07-12 23:41 . 2012-07-12 23:41 1691480 ----a-w- c:\program files\Common Files\Windows Live\.cache\d27be6ae1cd608727\dsetup32.dll
    2012-07-12 13:45 . 2012-06-13 13:40 2047488 ----a-w- c:\windows\system32\win32k.sys
    2012-07-12 13:39 . 2012-06-05 16:47 1401856 ----a-w- c:\windows\system32\msxml6.dll
    2012-07-12 13:39 . 2012-06-05 16:47 1248768 ----a-w- c:\windows\system32\msxml3.dll
    2012-07-12 13:39 . 2012-06-05 16:47 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
    2012-07-12 13:39 . 2012-06-04 15:26 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys
    2012-07-12 13:39 . 2012-06-02 00:04 278528 ----a-w- c:\windows\system32\schannel.dll
    2012-07-12 13:39 . 2012-06-02 00:03 204288 ----a-w- c:\windows\system32\ncrypt.dll
    2012-07-04 19:06 . 2012-07-04 19:06 -------- d-----w- c:\users\OWNER\AppData\Roaming\Malwarebytes
    2012-07-04 19:05 . 2012-07-04 19:05 -------- d-----w- c:\programdata\Malwarebytes
    2012-07-04 19:05 . 2012-07-17 18:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2012-07-04 19:05 . 2012-07-03 17:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-07-04 18:51 . 2012-07-04 18:51 -------- d-----w- c:\program files\CCleaner
    2012-06-29 03:19 . 2012-06-29 03:57 -------- d-----w- c:\program files\StudyPost!
    2012-06-29 01:19 . 2012-07-21 20:44 -------- d-----w- c:\program files\MiniBible Post!
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-07-20 20:50 . 2010-05-24 21:31 472880 ----a-w- c:\windows\system32\deployJava1.dll
    2012-07-12 23:44 . 2011-03-28 22:36 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2012-06-09 00:24 . 2012-04-05 17:52 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2012-06-09 00:24 . 2011-07-20 20:57 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-06-02 22:19 . 2012-06-22 14:13 53784 ----a-w- c:\windows\system32\wuauclt.exe
    2012-06-02 22:19 . 2012-06-22 14:13 45080 ----a-w- c:\windows\system32\wups2.dll
    2012-06-02 22:19 . 2012-06-22 14:12 35864 ----a-w- c:\windows\system32\wups.dll
    2012-06-02 22:19 . 2012-06-22 14:12 577048 ----a-w- c:\windows\system32\wuapi.dll
    2012-06-02 22:19 . 2012-06-22 14:13 1933848 ----a-w- c:\windows\system32\wuaueng.dll
    2012-06-02 22:12 . 2012-06-22 14:13 2422272 ----a-w- c:\windows\system32\wucltux.dll
    2012-06-02 22:12 . 2012-06-22 14:12 88576 ----a-w- c:\windows\system32\wudriver.dll
    2012-06-02 19:19 . 2012-06-22 14:12 171904 ----a-w- c:\windows\system32\wuwebv.dll
    2012-06-02 19:12 . 2012-06-22 14:12 33792 ----a-w- c:\windows\system32\wuapp.exe
    2012-05-01 14:03 . 2012-06-19 14:01 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2012-07-18 14:22 . 2012-01-19 18:58 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-06-20 1519824]
    .
    [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
    2012-06-20 17:18 1519824 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-06-20 1519824]
    .
    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
    @="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
    [HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
    2006-12-04 00:03 2854912 ----a-w- c:\program files\Protector Suite QL\farchns.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
    @="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
    [HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
    2006-12-04 00:03 2854912 ----a-w- c:\program files\Protector Suite QL\farchns.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2007-01-22 417792]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-03-22 448632]
    "HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]
    "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-20 411768]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-08-15 1021224]
    "SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-15 102400]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-20 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-20 154136]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-20 129560]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
    "googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
    "ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-06-20 1568976]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-02 348624]
    "ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2012-07-11 73392]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "DisableCAD"= 1 (0x1)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
    2006-12-03 23:50 90112 ----a-w- c:\windows\System32\psqlpwd.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux4"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0cdasnative
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Notification Packages REG_MULTI_SZ scecli psqlpwd
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AV7
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nclccusm
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\seeocxfo
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001
    .
    R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
    S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - ASWMBR
    *NewlyCreated* - TRUESIGHT
    *Deregistered* - aswMBR
    *Deregistered* - TrueSight
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-07-27 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 00:24]
    .
    2012-07-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-758404498-191888814-2096916372-1000Core.job
    - c:\users\OWNER\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-09 19:37]
    .
    2012-07-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-758404498-191888814-2096916372-1000UA.job
    - c:\users\OWNER\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-09 19:37]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com
    mStart Page = hxxp://www.yahoo.com
    LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
    TCP: DhcpNameServer = 10.0.0.1
    TCP: Interfaces\{01832491-381F-49E0-A5A4-988DB319D2EF}: NameServer = 76.5.159.133,63.162.197.99
    FF - ProfilePath - c:\users\OWNER\AppData\Roaming\Mozilla\Firefox\Profiles\gnc54s2q.default-1342793624225\
    FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/outdoors/agriculture/forecast/10-day/24210
    .
    - - - - ORPHANS REMOVED - - - -
    .
    URLSearchHooks-{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - (no file)
    WebBrowser-{DD662A0C-12FE-4B38-BA53-247F7EC82F46} - (no file)
    WebBrowser-{7B13EC3E-999A-4B70-B9CB-2617B8323822} - (no file)
    HKCU-Run-Adobe - c:\users\OWNER\AppData\Local\Apps\Adobe\zncvlw.dll
    HKLM-Run-ROC_roc_dec12 - c:\program files\AVG Secure Search\ROC_roc_dec12.exe
    HKLM-Run-HF_G_Jul - c:\program files\AVG Secure Search\HF_G_Jul.exe
    HKLM-Run-ISW - (no file)
    HKU-Default-Run-Adobe - c:\users\OWNER\AppData\Local\Apps\Adobe\zncvlw.dll
    MSConfigStartUp-CyberDefender Registry Cleaner - c:\program files\cyberdefender\registry cleaner\Startcdrc.exe
    MSConfigStartUp-mcagent_exe - c:\program files\McAfee.com\Agent\mcagent.exe
    MSConfigStartUp-MskAgentexe - c:\program files\McAfee\MSK\MskAgent.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2012-07-26 21:30
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/I??????58?????????8???p?????????
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
    @Denied: (2) (LocalSystem)
    "{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,
    eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c
    "{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8,
    89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b
    "{7B13EC3E-999A-4B70-B9CB-2617B8323822}"=hex:51,66,7a,6c,4c,1d,38,12,50,ef,00,
    7f,a8,d7,1e,0e,c6,dd,65,57,bd,6c,7c,36
    "{DD662A0C-12FE-4B38-BA53-247F7EC82F46}"=hex:51,66,7a,6c,4c,1d,38,12,62,29,75,
    d9,cc,5c,56,0e,c5,45,67,3f,7b,96,6b,52
    "{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,
    06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64
    "{3049C3E9-B461-4BC5-8870-4C09146192CA}"=hex:51,66,7a,6c,4c,1d,38,12,87,c0,5a,
    34,53,fa,ab,0e,f7,66,0f,49,11,3f,d6,de
    "{6EBF7485-159F-4BFF-A14F-B9E3AAC4465B}"=hex:51,66,7a,6c,4c,1d,38,12,eb,77,ac,
    6a,ad,5b,91,0e,de,59,fa,a3,af,9a,02,4f
    "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
    94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
    "{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce,
    9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d
    "{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,
    d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b
    "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
    df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
    "{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,
    f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95
    "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
    fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
    "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
    b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
    @Denied: (2) (LocalSystem)
    "Timestamp"=hex:f0,1a,8e,a9,92,d4,cc,01
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f9,8b,91,24,4e,54,a2,49,ac,13,ec,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f9,8b,91,24,4e,54,a2,49,ac,13,ec,\
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="YMP.Media"
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'lsass.exe'(660)
    c:\windows\system32\psqlpwd.dll
    c:\program files\Protector Suite QL\homefus2.dll
    c:\program files\Protector Suite QL\infra.dll
    c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
    .
    Completion time: 2012-07-26 21:34:27
    ComboFix-quarantined-files.txt 2012-07-27 01:34
    .
    Pre-Run: 214,356,463,616 bytes free
    Post-Run: 215,684,464,640 bytes free
    .
    - - End Of File - - 3D561A439B02ADFF2B581858D5076EA4
  6. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    Looks good :)

    Any current issues?

    =================================

    Uninstall Ask Toolbar, typical foistware.

    =================================

    Download OTL to your Desktop.
    Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
  7. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    Still can't open google calendar.

    OTL logfile created on: 7/27/2012 12:07:35 AM - Run 1
    OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\OWNER\Desktop
    Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1.99 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.34% Memory free
    4.21 Gb Paging File | 2.76 Gb Available in Paging File | 65.54% Paging File free
    Paging file location(s): ?:\pagefile.sys

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 296.62 Gb Total Space | 200.22 Gb Free Space | 67.50% Space Free | Partition Type: NTFS
    Drive D: | 542.65 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: GIFTFROMGOD | User Name: OWNER | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2012/07/26 23:47:19 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\OWNER\Desktop\OTL.exe
    PRC - [2012/07/11 14:32:24 | 002,445,880 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
    PRC - [2012/07/11 14:00:44 | 000,073,392 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
    PRC - [2012/07/09 07:44:46 | 000,497,320 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe
    PRC - [2012/07/09 07:44:00 | 000,738,984 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
    PRC - [2012/06/15 12:26:22 | 000,095,232 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    PRC - [2012/05/02 01:42:31 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
    PRC - [2012/05/02 00:34:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    PRC - [2012/05/02 00:31:38 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    PRC - [2012/04/24 02:11:59 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    PRC - [2012/04/04 01:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
    PRC - [2007/08/15 16:31:50 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    PRC - [2007/08/15 15:58:02 | 000,200,704 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynToshiba.exe
    PRC - [2007/03/29 20:52:22 | 000,114,688 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
    PRC - [2007/02/26 00:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
    PRC - [2007/02/12 15:38:04 | 000,355,096 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    PRC - [2007/02/12 15:37:58 | 000,174,872 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    PRC - [2007/01/25 19:47:50 | 000,136,816 | ---- | M] () -- C:\TOSHIBA\IVP\ISM\pinger.exe
    PRC - [2007/01/22 11:59:08 | 000,417,792 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
    PRC - [2006/12/20 02:15:44 | 000,428,152 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
    PRC - [2006/12/03 19:51:38 | 000,021,504 | ---- | M] (UPEK Inc.) -- C:\Program Files\Protector Suite QL\upeksvr.exe
    PRC - [2006/11/14 23:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
    PRC - [2006/10/05 15:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
    PRC - [2006/08/23 19:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    PRC - [2006/05/25 21:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe


    ========== Modules (No Company Name) ==========

    MOD - [2011/10/05 04:52:30 | 000,756,048 | ---- | M] () -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSPTLS.DLL
    MOD - [2007/09/13 16:11:18 | 000,249,856 | ---- | M] () -- C:\Windows\System32\igfxTMM.dll


    ========== Win32 Services (SafeList) ==========

    SRV - [2012/07/18 10:22:52 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
    SRV - [2012/07/11 14:32:24 | 002,445,880 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe -- (vsmon)
    SRV - [2012/07/09 07:44:46 | 000,497,320 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe -- (IswSvc)
    SRV - [2012/06/15 12:26:22 | 000,095,232 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
    SRV - [2012/06/08 20:24:03 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
    SRV - [2012/06/07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
    SRV - [2012/05/30 13:56:52 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
    SRV - [2012/05/02 01:42:31 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
    SRV - [2012/05/02 00:34:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
    SRV - [2012/04/04 01:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
    SRV - [2008/01/18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV - [2007/03/29 20:52:22 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv)
    SRV - [2007/02/26 00:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
    SRV - [2007/02/12 15:38:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
    SRV - [2007/01/25 19:47:50 | 000,136,816 | ---- | M] () [Auto | Running] -- C:\TOSHIBA\IVP\ISM\pinger.exe -- (pinger)
    SRV - [2006/12/20 02:15:44 | 000,428,152 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)
    SRV - [2006/11/14 23:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
    SRV - [2006/10/05 15:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
    SRV - [2006/08/23 19:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
    SRV - [2006/05/25 21:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (Tosrfcom)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\PTDMWWAN.sys -- (PTDMWWAN)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\PTDMVsp.sys -- (PTDMVsp)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\PTDMMdm.sys -- (PTDMMdm)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\PTDMBus.sys -- (PTDMBus)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
    DRV - File not found [Kernel | On_Demand | Unknown] -- C:\ComboFix\mbr.sys -- (mbr)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\RTKVHDA.sys -- (IntcAzAudAddService)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\CyberDefender\CDAntiSpyware\cdasprot.sys -- (CDASPROT)
    DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\OWNER\AppData\Local\Temp\catchme.sys -- (catchme)
    DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
    DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\OWNER\AppData\Local\Temp\aswMBR.sys -- (aswMBR)
    DRV - [2012/07/09 07:45:00 | 000,027,056 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
    DRV - [2012/04/27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
    DRV - [2012/04/25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
    DRV - [2012/04/16 21:18:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
    DRV - [2011/06/02 11:08:34 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv)
    DRV - [2011/05/07 17:51:26 | 000,451,160 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)
    DRV - [2010/06/17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
    DRV - [2009/04/11 00:45:24 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST)
    DRV - [2008/03/11 18:58:56 | 000,059,776 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDUWWAN.sys -- (PTDUWWAN)
    DRV - [2008/03/11 18:58:50 | 000,039,936 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDUVsp.sys -- (PTDUVsp)
    DRV - [2008/03/11 18:58:48 | 000,041,344 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDUMdm.sys -- (PTDUMdm)
    DRV - [2008/03/11 18:58:44 | 000,029,824 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDUBus.sys -- (PTDUBus)
    DRV - [2007/11/09 06:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ)
    DRV - [2007/09/26 14:12:22 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32)
    DRV - [2007/04/16 13:19:10 | 000,011,776 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR)
    DRV - [2007/03/29 20:50:38 | 000,285,184 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\tos_sps32.sys -- (tos_sps32)
    DRV - [2007/01/24 17:44:06 | 000,290,304 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21)
    DRV - [2007/01/03 04:43:19 | 000,479,488 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\kr3npxp.sys -- (KR3NPXP)
    DRV - [2007/01/03 04:43:19 | 000,207,104 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\KR10N.sys -- (KR10N)
    DRV - [2007/01/03 04:43:18 | 000,216,320 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\KR10I.sys -- (KR10I)
    DRV - [2006/11/28 18:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
    DRV - [2006/11/20 01:11:14 | 000,007,168 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FwLnk.sys -- (FwLnk)
    DRV - [2006/10/18 14:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
    DRV - [2005/08/17 07:47:48 | 000,073,696 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdserd.sys -- (sscdserd)
    DRV - [2005/08/17 07:46:26 | 000,093,872 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
    DRV - [2005/08/17 07:46:20 | 000,008,272 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
    DRV - [2005/08/17 07:45:00 | 000,058,352 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    IE - HKLM\..\SearchScopes,DefaultScope = {7C19B0CC-FBB6-4173-AE0C-BEE9A71FA6FF}
    IE - HKLM\..\SearchScopes\{7C19B0CC-FBB6-4173-AE0C-BEE9A71FA6FF}: "URL" = http://www.google.com/search?q={sea...artIndex={startIndex?}&startPage={startPage};
    IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2438727


    IE - HKU\.DEFAULT\..\URLSearchHook: - No CLSID value found
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    IE - HKU\S-1-5-18\..\URLSearchHook: - No CLSID value found
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
    IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
    IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\SearchScopes\{7C19B0CC-FBB6-4173-AE0C-BEE9A71FA6FF}: "URL" = http://www.google.com/search?q={sea...={outputEncoding}&sourceid=ie7&rlz=1I7TSHB_en
    IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={...afdbebffc2f&lang=en&ds=AVG&pr=fr&d=2012-01-16 17:46:06&v=10.0.0.7&sap=dsp&q={searchTerms}
    IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\SearchScopes\{A8669243-DEFC-4C30-820F-2C2D8D9AC149}: "URL" = http://websearch.ask.com/redirect?c...pn_sauid=A92791F2-8C29-4461-B432-950296D07240
    IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?q={SEARCHTERMS}&o=15527&l=dis&prt=360&chn=retail&geo=US&ver=4
    IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2438727
    IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}
    IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultengine: "Ask.com"
    FF - prefs.js..browser.search.defaultenginename: "Ask.com"
    FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p="
    FF - prefs.js..browser.search.order.1: "Ask.com"
    FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
    FF - prefs.js..browser.startup.homepage: "http://www.weather.com/outdoors/agriculture/forecast/10-day/24210"
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
    FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
    FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3
    FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.7
    FF - prefs.js..extensions.enabledItems: support@lastpass.com:1.80.0
    FF - prefs.js..extensions.enabledItems: SkipScreen@SkipScreen:0.6.3
    FF - prefs.js..extensions.enabledItems: {5F590AA2-1221-4113-A6F4-A4BB62414FAC}:0.45.6.20100202.1
    FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:12.0.0.1894
    FF - prefs.js..extensions.enabledItems: avg@toolbar:9.0.0.23
    FF - prefs.js..extensions.enabledItems: {4ED1F68A-5463-4931-9384-8FFF5ED91D92}:3.4.1
    FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid={...lang=en&pr=fr&d=2012-01-16 17:46:06&sap=ku&q="


    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
    FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
    FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll File not found
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\OWNER\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
    FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\OWNER\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
    FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\OWNER\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
    FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\OWNER\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
    FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\OWNER\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/07/17 00:43:37 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2012/07/20 08:53:26 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/07/18 10:22:53 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/07/20 23:06:52 | 000,000,000 | ---D | M]

    [2010/10/03 14:23:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\OWNER\AppData\Roaming\mozilla\Extensions
    [2012/07/27 00:03:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\OWNER\AppData\Roaming\mozilla\Firefox\Profiles\71jlrk59.default\extensions
    [2012/01/16 17:39:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\OWNER\AppData\Roaming\mozilla\Firefox\Profiles\71jlrk59.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2012/01/16 18:50:13 | 000,000,000 | ---D | M] (SmoothWheel (mozdev.org)) -- C:\Users\OWNER\AppData\Roaming\mozilla\Firefox\Profiles\71jlrk59.default\extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}
    [2012/06/14 13:59:39 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\OWNER\AppData\Roaming\mozilla\Firefox\Profiles\71jlrk59.default\extensions\foxmarks@kei.com
    [2012/03/24 12:01:33 | 000,000,000 | ---D | M] (LastPass) -- C:\Users\OWNER\AppData\Roaming\mozilla\Firefox\Profiles\71jlrk59.default\extensions\support@lastpass.com
    [2012/07/26 08:58:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\OWNER\AppData\Roaming\mozilla\Firefox\Profiles\gnc54s2q.default-1342793624225\extensions
    [2012/07/20 10:19:14 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\OWNER\AppData\Roaming\mozilla\Firefox\Profiles\gnc54s2q.default-1342793624225\extensions\foxmarks@kei.com
    [2012/07/24 20:52:15 | 000,000,000 | ---D | M] (LastPass) -- C:\Users\OWNER\AppData\Roaming\mozilla\Firefox\Profiles\gnc54s2q.default-1342793624225\extensions\support@lastpass.com
    [2012/07/19 19:07:42 | 000,002,585 | ---- | M] () -- C:\Users\OWNER\AppData\Roaming\Mozilla\Firefox\Profiles\71jlrk59.default\searchplugins\askcom.xml
    [2012/07/20 16:50:29 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2012/06/18 13:40:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
    [2012/07/20 16:50:30 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
    [2012/07/17 00:43:37 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES\MCAFEE\SITEADVISOR
    [2012/05/19 01:52:12 | 000,697,058 | ---- | M] () (No name found) -- C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\71JLRK59.DEFAULT\EXTENSIONS\{DC572301-7619-498C-A57D-39143191B318}.XPI
    [2012/02/29 11:59:21 | 000,072,222 | ---- | M] () (No name found) -- C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\71JLRK59.DEFAULT\EXTENSIONS\SKIPSCREEN@SKIPSCREEN.XPI
    File not found (No name found) -- C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\71JLRK59.DEFAULT\EXTENSIONS\TOOLBAR@ASK.COM
    [2008/01/18 21:49:14 | 000,004,819 | ---- | M] () (No name found) -- C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\71JLRK59.DEFAULT\EXTENSIONS\VEKLHHBCLQ@VEKLHHBCLQ.ORG.XPI
    [2012/07/18 10:22:53 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2012/07/09 11:00:25 | 000,003,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
    [2012/02/05 21:10:11 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
    [2012/02/05 21:10:11 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

    ========== Chrome ==========

    CHR - default_search_provider: Google (Enabled)
    CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:eek:riginalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
    CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
    CHR - homepage: http://www.google.com/
    CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\OWNER\AppData\Local\Google\Chrome\Application\12.0.742.122\pdf.dll
    CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\OWNER\AppData\Local\Google\Chrome\Application\12.0.742.122\gears.dll
    CHR - plugin: Shockwave Flash (Enabled) = C:\Users\OWNER\AppData\Local\Google\Chrome\Application\12.0.742.122\gcswf32.dll
    CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Acrobat 4.0\Reader\Browser\nppdf32.dll
    CHR - plugin: Java Deployment Toolkit 6.0.210.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    CHR - plugin: Java(TM) Platform SE 6 U21 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
    CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\OWNER\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
    CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\OWNER\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
    CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
    CHR - plugin: Bing Bar (Enabled) = C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll
    CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files\Veetle\Player\npvlc.dll
    CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files\Veetle\plugins\npVeetle.dll
    CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
    CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll
    CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
    CHR - plugin: Default Plug-in (Enabled) = default_plugin
    CHR - Extension: Entanglement = C:\Users\OWNER\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.4.6_0\
    CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\OWNER\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.3_0\
    CHR - Extension: Poppit = C:\Users\OWNER\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\

    O1 HOSTS File: ([2012/07/26 14:04:28 | 000,000,000 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
    O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
    O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
    O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
    O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
    O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
    O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - No CLSID value found.
    O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {DD662A0C-12FE-4B38-BA53-247F7EC82F46} - No CLSID value found.
    O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - No CLSID value found.
    O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {DD662A0C-12FE-4B38-BA53-247F7EC82F46} - No CLSID value found.
    O3 - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
    O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
    O4 - HKLM..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google)
    O4 - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
    O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
    O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
    O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
    O4 - HKLM..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
    O4 - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
    O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
    O4 - HKU\@1..\Run: [TOSCDSPD] C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
    O4 - HKU\@1..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
    O4 - HKU\S-1-5-21-758404498-191888814-2096916372-1000..\Run: [TOSCDSPD] C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\@1\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\@3\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-758404498-191888814-2096916372-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-758404498-191888814-2096916372-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
    O7 - HKU\S-1-5-21-758404498-191888814-2096916372-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O9 - Extra Button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\paltalk.exe (AVM Software Inc.)
    O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
    O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
    O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{01832491-381F-49E0-A5A4-988DB319D2EF}: NameServer = 76.5.159.133,63.162.197.99
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6CD59901-EDA4-4072-A93D-9E5CAA909388}: DhcpNameServer = 10.0.0.1
    O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
    O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.)
    O20 - Winlogon\Notify\psfus: DllName - (C:\Windows\system32\psqlpwd.dll) - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)
    O24 - Desktop WallPaper: C:\Users\OWNER\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
    O24 - Desktop BackupWallPaper: C:\Users\OWNER\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O32 - AutoRun File - [2001/04/18 03:23:00 | 000,000,041 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O34 - HKLM BootExecute: (cdasnative)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

    ========== Files/Folders - Created Within 30 Days ==========

    [2012/07/26 23:47:18 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\OWNER\Desktop\OTL.exe
    [2012/07/26 21:34:34 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2012/07/26 21:13:16 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2012/07/26 21:13:16 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2012/07/26 21:13:16 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2012/07/26 21:12:59 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2012/07/26 21:12:14 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
    [2012/07/26 20:58:06 | 004,719,912 | R--- | C] (Swearware) -- C:\Users\OWNER\Desktop\ComboFix.exe
    [2012/07/26 18:08:20 | 000,000,000 | ---D | C] -- C:\Users\OWNER\Desktop\RK_Quarantine
    [2012/07/26 18:00:44 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\OWNER\Desktop\aswMBR.exe
    [2012/07/25 15:27:28 | 000,000,000 | ---D | C] -- C:\Users\OWNER\Desktop\Fix Computer
    [2012/07/25 15:26:02 | 000,000,000 | ---D | C] -- C:\Users\OWNER\Desktop\Tech Spot_files
    [2012/07/20 08:53:39 | 000,000,000 | ---D | C] -- C:\Users\OWNER\Documents\ForceField Shared Files
    [2012/07/20 08:53:35 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Roaming\CheckPoint
    [2012/07/20 08:52:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
    [2012/07/20 08:47:07 | 000,000,000 | ---D | C] -- C:\2dda44f8e50167a02f6c581e51e8
    [2012/07/20 00:54:52 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint
    [2012/07/20 00:53:45 | 000,000,000 | ---D | C] -- C:\ProgramData\CheckPoint
    [2012/07/19 19:07:09 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Roaming\Avira
    [2012/07/19 18:57:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
    [2012/07/19 18:56:33 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
    [2012/07/19 18:56:32 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
    [2012/07/19 18:56:32 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
    [2012/07/19 18:56:32 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
    [2012/07/19 18:56:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
    [2012/07/19 18:56:30 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
    [2012/07/17 00:45:19 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
    [2012/07/16 08:30:45 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\{F8223472-D0A5-487D-B3E7-947B7EB53286}
    [2012/07/16 08:30:41 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\{458EFC50-52CB-499A-B5F0-6C4644D127BC}
    [2012/07/16 08:30:40 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\{5FF343BB-041F-457D-9C23-0441700EE7F6}
    [2012/07/14 11:47:05 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\{84D2A485-C8F5-48D7-AA7C-424A3AEE6D05}
    [2012/07/14 11:46:56 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\{327C8E7B-BE2B-4D44-9286-641D999C70A8}
    [2012/07/13 10:13:27 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Roaming\Mumble
    [2012/07/13 09:39:31 | 000,000,000 | ---D | C] -- C:\Program Files\Mumble
    [2012/07/13 09:14:14 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\{C7685BC3-9B44-4480-9FB6-91BC9BB12C58}
    [2012/07/13 09:14:07 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\{F3762B98-99FD-48B7-AE5F-8A85F55EEC93}
    [2012/07/12 20:13:15 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\{89D7CD81-38C6-4298-9250-E1403874A2C2}
    [2012/07/12 20:13:13 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\{AADBD742-3E57-4511-B3E5-7A7D8A3AFBFA}
    [2012/07/12 20:12:59 | 000,000,000 | ---D | C] -- C:\Users\OWNER\Tracing
    [2012/07/12 19:44:28 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
    [2012/07/09 15:40:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Talk
    [2012/07/08 17:55:23 | 000,000,000 | ---D | C] -- C:\Users\OWNER\Documents\Registry Backup
    [2012/07/04 15:06:15 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Roaming\Malwarebytes
    [2012/07/04 15:05:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2012/07/04 15:05:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2012/07/04 15:05:55 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2012/07/04 15:05:55 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2012/07/04 14:51:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
    [2012/07/04 14:51:51 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
    [2012/06/28 23:19:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StudyPost!
    [2012/06/28 23:19:15 | 000,000,000 | ---D | C] -- C:\Program Files\StudyPost!
    [2012/06/28 21:19:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiniBible Post!
    [2012/06/28 21:19:06 | 000,000,000 | ---D | C] -- C:\Program Files\MiniBible Post!
    [2012/06/27 11:20:16 | 000,000,000 | ---D | C] -- C:\Users\OWNER\Documents\ShareSpiritual
    [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2012/07/27 00:11:18 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
    [2012/07/27 00:07:09 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2012/07/27 00:07:08 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2012/07/26 23:51:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-758404498-191888814-2096916372-1000UA.job
    [2012/07/26 23:47:19 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\OWNER\Desktop\OTL.exe
    [2012/07/26 20:58:17 | 004,719,912 | R--- | M] (Swearware) -- C:\Users\OWNER\Desktop\ComboFix.exe
    [2012/07/26 19:51:00 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-758404498-191888814-2096916372-1000Core.job
    [2012/07/26 18:06:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2012/07/26 18:01:15 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\OWNER\Desktop\aswMBR.exe
    [2012/07/26 17:59:55 | 001,552,384 | ---- | M] () -- C:\Users\OWNER\Desktop\RogueKiller.exe
    [2012/07/26 14:04:28 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\etc\lmhosts
    [2012/07/26 14:04:28 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
    [2012/07/25 15:26:04 | 000,059,352 | ---- | M] () -- C:\Users\OWNER\Desktop\Tech Spot.htm
    [2012/07/22 17:19:13 | 243,603,809 | ---- | M] () -- C:\Windows\MEMORY.DMP
    [2012/07/21 16:44:21 | 000,000,788 | ---- | M] () -- C:\Users\OWNER\Desktop\MiniBible Post!.lnk
    [2012/07/20 08:58:59 | 000,415,877 | ---- | M] () -- C:\Windows\System32\drivers\vsconfig.xml
    [2012/07/20 08:52:17 | 000,000,639 | ---- | M] () -- C:\Users\Public\Desktop\ZoneAlarm Security.lnk
    [2012/07/19 18:57:17 | 000,001,818 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
    [2012/07/18 21:36:46 | 000,000,691 | ---- | M] () -- C:\Users\OWNER\Desktop\Murmur.lnk
    [2012/07/17 14:22:25 | 000,000,877 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2012/07/15 13:02:09 | 000,047,710 | ---- | M] () -- C:\Users\OWNER\Desktop\PhotoShare.png
    [2012/07/13 10:13:39 | 000,002,379 | ---- | M] () -- C:\Users\OWNER\Documents\MumbleAutomaticCertificateBackup.p12
    [2012/07/13 09:23:36 | 017,904,640 | ---- | M] () -- C:\Users\OWNER\Desktop\mumble-1.2.3a.msi
    [2012/07/12 09:51:19 | 000,323,592 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
    [2012/07/07 07:52:04 | 000,000,000 | ---- | M] () -- C:\extensions.sqlite
    [2012/07/04 14:51:53 | 000,000,775 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
    [2012/07/03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2012/06/28 23:19:17 | 000,000,799 | ---- | M] () -- C:\Users\OWNER\Desktop\StudyPost!.lnk
    [2012/06/27 21:28:00 | 000,002,337 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
    [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2012/07/26 21:13:16 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2012/07/26 21:13:16 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2012/07/26 21:13:16 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2012/07/26 21:13:16 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2012/07/26 21:13:16 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2012/07/26 17:59:51 | 001,552,384 | ---- | C] () -- C:\Users\OWNER\Desktop\RogueKiller.exe
    [2012/07/25 15:26:01 | 000,059,352 | ---- | C] () -- C:\Users\OWNER\Desktop\Tech Spot.htm
    [2012/07/20 08:53:41 | 000,415,877 | ---- | C] () -- C:\Windows\System32\drivers\vsconfig.xml
    [2012/07/20 08:52:17 | 000,000,639 | ---- | C] () -- C:\Users\Public\Desktop\ZoneAlarm Security.lnk
    [2012/07/19 18:57:17 | 000,001,818 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
    [2012/07/18 21:36:46 | 000,000,691 | ---- | C] () -- C:\Users\OWNER\Desktop\Murmur.lnk
    [2012/07/17 00:43:38 | 243,603,809 | ---- | C] () -- C:\Windows\MEMORY.DMP
    [2012/07/15 13:01:43 | 000,047,710 | ---- | C] () -- C:\Users\OWNER\Desktop\PhotoShare.png
    [2012/07/13 10:13:39 | 000,002,379 | ---- | C] () -- C:\Users\OWNER\Documents\MumbleAutomaticCertificateBackup.p12
    [2012/07/13 09:38:34 | 017,904,640 | ---- | C] () -- C:\Users\OWNER\Desktop\mumble-1.2.3a.msi
    [2012/07/12 19:46:18 | 000,001,996 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
    [2012/07/09 15:37:31 | 000,000,908 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-758404498-191888814-2096916372-1000UA.job
    [2012/07/09 15:37:30 | 000,000,856 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-758404498-191888814-2096916372-1000Core.job
    [2012/07/07 07:52:04 | 000,000,000 | ---- | C] () -- C:\extensions.sqlite
    [2012/07/04 15:06:01 | 000,000,877 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2012/07/04 14:51:53 | 000,000,775 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
    [2012/06/28 23:19:17 | 000,000,799 | ---- | C] () -- C:\Users\OWNER\Desktop\StudyPost!.lnk
    [2012/06/28 21:19:08 | 000,000,788 | ---- | C] () -- C:\Users\OWNER\Desktop\MiniBible Post!.lnk
    [2012/02/11 12:31:09 | 000,136,448 | ---- | C] () -- C:\Windows\RMTOOLS.DLL
    [2012/01/26 21:04:43 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat
    [2012/01/26 21:04:43 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat
    [2012/01/19 18:41:25 | 000,005,864 | ---- | C] () -- C:\Users\OWNER\AppData\Local\d3d9caps.dat
    [2011/02/04 11:55:42 | 001,048,576 | ---- | C] () -- C:\Users\OWNER\test.1meg
    [2010/12/29 17:10:02 | 000,000,600 | ---- | C] () -- C:\Users\OWNER\AppData\Local\PUTTY.RND
    [2009/12/11 17:21:52 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
    [2009/08/13 13:31:49 | 000,027,136 | ---- | C] () -- C:\Users\OWNER\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

    ========== LOP Check ==========

    [2012/03/09 21:34:49 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\.purple
    [2012/02/13 19:11:00 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\3v
    [2012/05/28 19:08:49 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\Ad-Aware Antivirus
    [2012/07/20 22:10:48 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\Audacity
    [2012/01/16 18:48:48 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\AVG2012
    [2012/07/20 08:53:35 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\CheckPoint
    [2010/06/08 10:42:43 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\DarkParablesBriarRoseSE_BFG
    [2010/04/18 11:55:42 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\funkitron
    [2010/09/14 20:17:53 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\Gaijin Ent
    [2012/07/18 21:38:01 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\Mumble
    [2010/09/11 14:10:02 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\MysteryStudio
    [2010/06/10 19:01:14 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\Namco
    [2012/02/01 22:20:30 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\Paltalk
    [2011/10/31 13:32:14 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\PlayFirst
    [2010/06/09 15:45:32 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\Quirky Games
    [2010/04/20 15:43:06 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\Smith Micro
    [2012/02/05 15:38:59 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\SystemRequirementsLab
    [2009/09/07 13:54:42 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\TOSHIBA
    [2010/01/13 17:44:45 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\Ulead Systems
    [2011/10/29 18:11:41 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\Unity
    [2010/09/04 10:28:55 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\WildTangentv1000
    [2012/02/05 15:03:03 | 000,000,000 | ---D | M] -- C:\Users\OWNER\AppData\Roaming\WinBatch
    [2012/07/26 18:04:55 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 192 bytes -> C:\ProgramData\TEMP:0B4227B4

    < End of report >
  8. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    OTL Extras logfile created on: 7/27/2012 12:07:35 AM - Run 1
    OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\OWNER\Desktop
    Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1.99 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.34% Memory free
    4.21 Gb Paging File | 2.76 Gb Available in Paging File | 65.54% Paging File free
    Paging file location(s): ?:\pagefile.sys

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 296.62 Gb Total Space | 200.22 Gb Free Space | 67.50% Space Free | Partition Type: NTFS
    Drive D: | 542.65 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: GIFTFROMGOD | User Name: OWNER | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

    [HKEY_USERS\S-1-5-21-758404498-191888814-2096916372-1000\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
    Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0
    "VistaSp1" = Reg Error: Unknown registry data type -- File not found
    "VistaSp2" = Reg Error: Unknown registry data type -- File not found

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0
    "DoNotAllowExceptions" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0
    "DoNotAllowExceptions" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 0
    "DoNotAllowExceptions" = 0

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\TOSHIBA\ivp\NetInt\Netint.exe" = C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine -- (TOSHIBA Corporation)
    "C:\TOSHIBA\Ivp\ISM\pinger.exe" = C:\TOSHIBA\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger -- ()


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{015DC8FC-6F8B-48F0-9F2D-D6AE9BD865A4}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
    "{08D20159-9D38-4B76-9841-FADB136C6220}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
    "{1E17DCD6-66BA-4532-98F4-D4040D300A1E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{23CC9A75-C4DC-47AB-A3FD-9766CD3E2AF7}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
    "{2FAE888F-AA11-4C43-B529-1B20788F85B7}" = lport=10243 | protocol=6 | dir=in | app=system |
    "{43F79C53-8BB3-4DD4-83BE-022EB3E15EE9}" = lport=139 | protocol=6 | dir=in | app=system |
    "{45870486-21FF-4C81-A3DE-6A8D623943FC}" = rport=137 | protocol=17 | dir=out | app=system |
    "{4998A6A3-1DE3-452D-8E83-49DE1830E840}" = lport=445 | protocol=6 | dir=in | app=system |
    "{577A8ACB-D817-4E22-887A-3EAF1CB5EFB9}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{5AA9232C-B38D-4D75-AC07-622419433DE2}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
    "{5DAAA7B3-EA84-413E-840E-C7595CCDCFDA}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{6A4DF12A-91A0-4278-82A3-5F542CD9BE04}" = lport=137 | protocol=17 | dir=in | app=system |
    "{84B0FED8-12CC-4B65-9BF0-31AA1087D636}" = rport=10243 | protocol=6 | dir=out | app=system |
    "{85F34FA2-5EC8-4D6D-BB17-3F550BAA8A4C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{9BF508A6-CAA8-4BB1-A15E-A676D30DA94A}" = lport=2869 | protocol=6 | dir=in | app=system |
    "{9CDBB799-5AFA-488C-A875-F2D04D721AB0}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{A2F073DC-AE5D-41A1-B177-8C8A10EBAB2E}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
    "{A932199E-E08F-431D-8983-67E7F4B3FD9A}" = rport=138 | protocol=17 | dir=out | app=system |
    "{AEBB38F0-1693-413C-B875-B0EBB97D2E08}" = rport=445 | protocol=6 | dir=out | app=system |
    "{BEA3C529-E25F-4260-B345-FEEB2B57F599}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{C95E6D9D-B31B-40C2-A2B3-F9B2CB3866B2}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{C96E0922-6B07-4855-8224-8ADFF171DD95}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
    "{CD5CDDA7-D372-401E-8F30-827A475B5809}" = lport=138 | protocol=17 | dir=in | app=system |
    "{D604D352-A864-471B-A9BA-BFAA33C34F44}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{DCA2CDB3-43B4-4B88-985F-FA38465AF6A2}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
    "{EAAB5250-F9FC-41FE-8DEB-AAB56B619017}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{F2B703AE-2250-415A-A74E-76F52746C7C4}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
    "{F3B5E916-B375-4335-80E8-F348BAFF2969}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{FCF9C7A9-BC5F-47CC-AD5D-F4DD876C4167}" = rport=139 | protocol=6 | dir=out | app=system |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{014CA057-2796-411C-B038-7F64DAFA0B01}" = protocol=17 | dir=in | app=c:\users\owner\appdata\local\google\google talk plugin\googletalkplugin.exe |
    "{046FA723-4166-46C8-8C57-FA8563B6BFE5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
    "{0800FDA3-26B2-45E0-B3FF-21E27E93F64A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{08FC4245-2414-4D81-A9BB-FE384B0CB3B3}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgnsx.exe |
    "{0E96948F-59DD-4E7C-9442-0CCEC8D4CF6E}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
    "{142B507A-3C3B-4780-A99F-511E2C05F25B}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgnsx.exe |
    "{195A7817-E9C5-466A-9CEC-0F6BBDDFBC30}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{1CF7DACA-A404-4825-B376-095F0976BBFF}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
    "{1E06C24A-A646-473F-BF0D-F8C2554931C8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
    "{25FE60D4-A250-439E-B34F-85D1A5F6DD2D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
    "{27E42603-A981-4BC7-84F7-7A7668C2D2FD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{2DD3D2E0-381E-4396-96F6-60565082FCDA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{322ED7E4-D4BD-4DD0-86F0-0EC3700C1313}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
    "{32979806-43A6-48E4-8C69-C10DE52C05DE}" = protocol=17 | dir=in | app=c:\program files\google\google talk\googletalk.exe |
    "{4BA2EC9B-DA75-4939-8B71-A98740FDF905}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe |
    "{4F3DAF9C-300C-4A9D-A732-36E3D58D5333}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
    "{5332C286-B1AF-41F5-B8D3-C1E6BD54F127}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{56C4CA14-4BBB-4B4E-8785-F782318A368C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{5B437508-008A-489D-A2EA-1C87AF81F913}" = protocol=6 | dir=in | app=c:\users\owner\appdata\local\google\google talk plugin\googletalkplugin.exe |
    "{64A18B0D-230A-4411-B2D2-3B7FA4685715}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
    "{6C2DFF5E-4982-42B9-9672-2C7688882E9B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{6FC02DB0-B8F5-4BC8-A372-2C259F3F94AD}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgemcx.exe |
    "{7B1C6614-AD1F-4EE9-A722-9B2C7B50F900}" = protocol=6 | dir=out | app=system |
    "{88913D45-BAC8-435C-98DE-4758A7323858}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
    "{944E732F-CC23-4A98-99C0-35C4979DAE48}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgdiagex.exe |
    "{AF454159-CA70-4890-982B-D1E445D6C34B}" = protocol=6 | dir=in | app=c:\program files\google\google talk\googletalk.exe |
    "{B1D4A88C-9F55-4B7E-A1D6-ACE492E5559E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
    "{B4B344CA-C1CD-4E20-86EC-4C4273C9D614}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{B947E230-F703-4185-BA59-1FBB47495200}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
    "{BBD38137-F1D1-425E-9E47-CCE1CE789F89}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{BBF70A38-6467-40D0-A96D-7E5D0210D1CD}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
    "{D824F367-DC55-406E-B7DB-4E112811C536}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgemcx.exe |
    "{E2F64B35-8221-47F3-A336-4ADDE7F7463A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{E8DA395A-4F1C-44F4-86D4-97CBF677C7D8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
    "{F1B91FE7-A666-4EA5-BF69-A9C809870779}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe |
    "{FBF3DFB3-AA00-4DC4-833C-591BF7889E3A}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
    "{FCFFC41D-A718-433A-9BA2-3B553A58C9C5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
    "{FF6D3FCE-C9ED-47C2-8640-9078341B07B6}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgdiagex.exe |
    "TCP Query User{08DCF9F2-146B-4A12-A241-DD6498B78D18}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
    "TCP Query User{0C650990-DDBB-4DE9-8EF3-3AFA9469A8AB}C:\windows\system32\ftp.exe" = protocol=6 | dir=in | app=c:\windows\system32\ftp.exe |
    "TCP Query User{6E8D681B-57F0-48A3-B8B9-D0969F9FB686}C:\program files\diablo ii\game.exe" = protocol=6 | dir=in | app=c:\program files\diablo ii\game.exe |
    "TCP Query User{9D90A2EF-13A5-4D81-8398-A3452E21DC02}C:\program files\mumble\murmur.exe" = protocol=6 | dir=in | app=c:\program files\mumble\murmur.exe |
    "TCP Query User{F70E5A27-9493-4B0F-8D58-6C77F519F096}C:\program files\paltalk messenger\paltalk.exe" = protocol=6 | dir=in | app=c:\program files\paltalk messenger\paltalk.exe |
    "TCP Query User{FF28A6E3-F6F8-4B6B-880F-82ADA85A7DFB}C:\program files\paltalk messenger\paltalk.exe" = protocol=6 | dir=in | app=c:\program files\paltalk messenger\paltalk.exe |
    "UDP Query User{4DA08CAB-5EDE-4B45-B5F6-A0766CF6A83E}C:\program files\paltalk messenger\paltalk.exe" = protocol=17 | dir=in | app=c:\program files\paltalk messenger\paltalk.exe |
    "UDP Query User{5EEDDC49-E8CE-4E23-9D22-AD6D071A8ACA}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
    "UDP Query User{8AFF73D8-DAAE-421A-B723-EB43C33F1481}C:\program files\diablo ii\game.exe" = protocol=17 | dir=in | app=c:\program files\diablo ii\game.exe |
    "UDP Query User{8B8091ED-064A-4B5A-A9C2-DB6438571EF1}C:\program files\mumble\murmur.exe" = protocol=17 | dir=in | app=c:\program files\mumble\murmur.exe |
    "UDP Query User{9ABC4482-5C51-4B2E-BA83-ED424D0F8F0A}C:\program files\paltalk messenger\paltalk.exe" = protocol=17 | dir=in | app=c:\program files\paltalk messenger\paltalk.exe |
    "UDP Query User{D5B10FD4-2719-4507-AA4F-F64B33442A32}C:\windows\system32\ftp.exe" = protocol=17 | dir=in | app=c:\windows\system32\ftp.exe |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
    "{02327B3D-44BA-498F-AB63-CD520B0585D2}" = e-Sword
    "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
    "{0E9C4531-58C4-4349-AD2F-A4D999E451EC}" = TOSHIBA Music
    "{10113A44-CBFF-4FF7-8A13-BD1EC4180C56}" = Protector Suite QL 5.6
    "{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
    "{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
    "{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
    "{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
    "{2BDF38E0-1A7F-4220-B4B7-118DD45E5E13}" = TOSHIBA Supervisor Password
    "{2E865E71-9A04-48F5-8ED7-0D33B3E6B424}" = ZoneAlarm Firewall
    "{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
    "{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor
    "{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
    "{425A2BC2-AA64-4107-9C29-484245BBEA05}" = TOSHIBA Software Upgrades
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
    "{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
    "{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
    "{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
    "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
    "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
    "{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
    "{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}" = TOSHIBA ConfigFree
    "{7DE0DEC1-FCAD-4464-84C6-6A237D8AF549}" = ZoneAlarm Security
    "{83A5D4E9-7FE6-336D-9525-F1C879496014}" = Google Talk Plugin
    "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
    "{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
    "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
    "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
    "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Matrix Storage Manager
    "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
    "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
    "{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
    "{B29B0066-547B-402c-9C0D-090E2F928A01}" = PANTECH PC USB Modem Software
    "{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
    "{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
    "{BFC85CDC-BD7C-4FDD-9507-8D74B5A79404}" = TOSHIBA Hardware Setup
    "{C13AF9C7-8E06-4354-B629-DF6192CE4A66}" = PANTECH UM175 Driver
    "{C53D16CC-E56F-47B8-906E-70AAF8EABB4F}" = Toshiba Registration
    "{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
    "{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
    "{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
    "{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
    "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
    "{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI
    "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
    "{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
    "{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
    "{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
    "{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
    "{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
    "{EFE3D683-903C-4B58-AB8F-C68C69F33758}" = System Requirements Lab for Intel
    "{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
    "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    "{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA
    "{F5D7FAB5-A1FD-4DD3-983E-4155B09D7102}" = mCore
    "{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
    "{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
    "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
    "Adobe Acrobat 4.0" = Adobe Acrobat 4.0
    "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player
    "Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.14 (Unicode)
    "Avira AntiVir Desktop" = Avira Free Antivirus
    "BCM70010" = Broadcom High Definition Video Decoder 2.6.40.1
    "CCleaner" = CCleaner
    "Desktop Dialer" = Desktop Dialer
    "Diablo II" = Diablo II
    "HDMI" = Intel(R) Graphics Media Accelerator Driver
    "HOMESTUDENTR" = Microsoft Office Home and Student 2007
    "InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
    "InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12 drivers.
    "InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
    "LADSPA_plugins-win_is1" = LADSPA_plugins-win-0.4.15
    "LAME for Audacity_is1" = LAME v3.98.2 for Audacity
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "MiniBible Post!_is1" = MiniBible Post! 5.1c
    "Mozilla Firefox 14.0.1 (x86 en-US)" = Mozilla Firefox 14.0.1 (x86 en-US)
    "MozillaMaintenanceService" = Mozilla Maintenance Service
    "Paltalk Messenger" = Paltalk Messenger 10.2
    "Paltalk Messenger Interop" = Paltalk Messenger Interop
    "ProInst" = Intel(R) PROSet/Wireless Software
    "SimCity 3000" = SimCity 3000
    "StudyPost!_is1" = StudyPost! 3.1c
    "SynTPDeinstKey" = Synaptics Pointing Device Driver
    "TOSHIBA Software Modem" = TOSHIBA Software Modem
    "VLC media player" = VLC media player 2.0.1
    "Windows Media Encoder 9" = Windows Media Encoder 9 Series
    "WinLiveSuite" = Windows Live Essentials
    "Yahoo! Messenger" = Yahoo! Messenger
    "ZoneAlarm Free Firewall" = ZoneAlarm Free Firewall
    "ZoneAlarm LTD Toolbar" = ZoneAlarm LTD Toolbar

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-758404498-191888814-2096916372-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "UnityWebPlayer" = Unity Web Player

    ========== Last 20 Event Log Errors ==========

    [ Application Events ]
    Error - 2/27/2011 1:42:28 PM | Computer Name = OWNER-PC | Source = Microsoft-Windows-CertificateServicesClient | ID = 1003
    Description =

    Error - 2/28/2011 5:06:42 PM | Computer Name = OWNER-PC | Source = Application Error | ID = 1000
    Description = Faulting application cdas1238.exe, version 6.11.8.4, time stamp 0x4cd89703,
    faulting module ntdll.dll, version 6.0.6002.18327, time stamp 0x4cb73436, exception
    code 0xc0000005, fault offset 0x00067249, process id 0xè™ è™ , application start time
    0xè™ è™ .

    Error - 3/7/2011 4:15:19 PM | Computer Name = OWNER-PC | Source = Microsoft-Windows-CertificateServicesClient | ID = 1001
    Description =

    Error - 3/7/2011 4:15:19 PM | Computer Name = OWNER-PC | Source = Microsoft-Windows-CertificateServicesClient | ID = 1003
    Description =

    Error - 3/7/2011 4:50:43 PM | Computer Name = OWNER-PC | Source = VSS | ID = 8194
    Description =

    Error - 3/7/2011 8:04:08 PM | Computer Name = OWNER-PC | Source = Microsoft-Windows-CertificateServicesClient | ID = 1001
    Description =

    Error - 3/7/2011 8:04:08 PM | Computer Name = OWNER-PC | Source = Microsoft-Windows-CertificateServicesClient | ID = 1003
    Description =

    Error - 3/15/2011 7:41:13 PM | Computer Name = OWNER-PC | Source = Application Error | ID = 1000
    Description = Faulting application chrome.exe, version 0.0.0.0, time stamp 0x4d799d84,
    faulting module chrome.dll, version 10.0.648.133, time stamp 0x4d799d2a, exception
    code 0x80000003, fault offset 0x000ea5a3, process id 0x9b0, application start time
    0x01cbe36a5d3de0f0.

    Error - 3/15/2011 8:16:51 PM | Computer Name = OWNER-PC | Source = Application Error | ID = 1000
    Error - 4/3/2011 10:42:21 PM | Computer Name = OWNER-PC | Source = Application Error
    | ID = 1000

    Error - 4/7/2011 5:50:48 AM | Computer Name = OWNER-PC | Source = Application Error | ID = 1000
    Description = Faulting application cdas1238.exe, version 6.11.8.4, time stamp 0x4cd89703,
    faulting module ntdll.dll, version 6.0.6002.18327, time stamp 0x4cb73436, exception
    code 0xc0000005, fault offset 0x00067249, process id 0xìÿ& ìÿ& , application start
    time 0xìÿ& ìÿ& .

    Error - 4/10/2011 8:19:16 AM | Computer Name = OWNER-PC | Source = Application Error | ID = 1000
    Description = Faulting application cdas1238.exe, version 6.11.8.4, time stamp 0x4cd89703,
    faulting module ntdll.dll, version 6.0.6002.18327, time stamp 0x4cb73436, exception
    code 0xc0000005, fault offset 0x00067249, process id 0xP½ P½ , application start time
    0xP½ P½ .

    [ System Events ]
    Error - 7/26/2012 1:00:40 PM | Computer Name = GIFTFROMGOD | Source = Service Control Manager | ID = 7001
    Description =

    Error - 7/26/2012 6:04:48 PM | Computer Name = GIFTFROMGOD | Source = DCOM | ID = 10010
    Description =

    Error - 7/26/2012 6:07:51 PM | Computer Name = GIFTFROMGOD | Source = Service Control Manager | ID = 7000
    Description =

    Error - 7/26/2012 6:07:55 PM | Computer Name = GIFTFROMGOD | Source = Service Control Manager | ID = 7001
    Description =

    Error - 7/26/2012 6:09:01 PM | Computer Name = GIFTFROMGOD | Source = Service Control Manager | ID = 7034
    Description =

    Error - 7/26/2012 9:12:42 PM | Computer Name = GIFTFROMGOD | Source = Service Control Manager | ID = 7034
    Description =

    Error - 7/26/2012 9:15:42 PM | Computer Name = GIFTFROMGOD | Source = Service Control Manager | ID = 7030
    Description =

    Error - 7/26/2012 9:20:04 PM | Computer Name = GIFTFROMGOD | Source = Service Control Manager | ID = 7030
    Description =

    Error - 7/26/2012 9:30:15 PM | Computer Name = GIFTFROMGOD | Source = Service Control Manager | ID = 7030
    Description =

    Error - 7/26/2012 9:46:04 PM | Computer Name = GIFTFROMGOD | Source = Dhcp | ID = 1002
    Description = The IP address lease 10.0.0.16 for the Network Card with network address
    0013E81B5FB9 has been denied by the DHCP server 10.0.0.1 (The DHCP Server sent
    a DHCPNACK message).


    < End of report >
  9. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    Still can't access google calendar. Still can't log off.

    Is Avast better than Avira? Should I purchase one of them or use the free stuff (if I had the money)? Consumer reports recommends Avira free version. Is there any merit to that? How come you guys use all these other tools? How did you determine they weren't malware or housed some sort of malware themselves?

    Do owners of security software makers also pay hackers to create viruses and malware? What is the best way to prevent these things from happening in the future?

    Could it be that installing and using Mumble created this problem I have?

    Sorry, I've had these questions burning in my head recently.
  10. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    That would be a subject to a different forum.

    More details please.

    There is no perfect security program. It's always mostly about your computing habits.

    I don't work for FBI :)

    I have no idea what Mumble is.

    =====================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\SearchScopes\{A8669243-DEFC-4C30-820F-2C2D8D9AC149}: "URL" = http://websearch.ask.com/redirect?c...pn_sauid=A92791F2-8C29-4461-B432-950296D07240
      IE - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?q={SEARCHTERMS}&o=15527&l=dis&prt=360&chn=retail&geo=US&ver=4
      FF - prefs.js..browser.search.defaultengine: "Ask.com"
      FF - prefs.js..browser.search.defaultenginename: "Ask.com"
      FF - prefs.js..browser.search.order.1: "Ask.com"
      [2012/07/19 19:07:42 | 000,002,585 | ---- | M] () -- C:\Users\OWNER\AppData\Roaming\Mozilla\Firefox\Profiles\71jlrk59.default\searchplugins\askcom.xml
      [2012/02/29 11:59:21 | 000,072,222 | ---- | M] () (No name found) -- C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\71JLRK59.DEFAULT\EXTENSIONS\SKIPSCREEN@SKIPSCREEN.XPI
      File not found (No name found) -- C:\USERS\OWNER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\71JLRK59.DEFAULT\EXTENSIONS\TOOLBAR@ASK.COM
      O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - No CLSID value found.
      O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {DD662A0C-12FE-4B38-BA53-247F7EC82F46} - No CLSID value found.
      O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - No CLSID value found.
      O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {DD662A0C-12FE-4B38-BA53-247F7EC82F46} - No CLSID value found.
      O3 - HKU\S-1-5-21-758404498-191888814-2096916372-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
      O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
      @Alternate Data Stream - 192 bytes -> C:\ProgramData\TEMP:0B4227B4
      
      
      :Services
      
      :Reg
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
      "EnableFirewall" = dword:00000001
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
      "EnableFirewall" =dword:00000001
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
      "EnableFirewall" =dword:00000001
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyjava]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ==============================================

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

    2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.


    3. Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    4. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click on List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
  11. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    Results of screen317's Security Check version 0.99.43
    Windows Vista Service Pack 2 x86 (UAC is disabled!)
    Internet Explorer 9
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Disabled!
    Avira Desktop
    Antivirus up to date!
    `````````Anti-malware/Other Utilities Check:`````````
    McAfee SiteAdvisor
    Malwarebytes Anti-Malware version 1.62.0.1300
    CCleaner
    Java(TM) 6 Update 33
    Java(TM) SE Runtime Environment 6
    Java version out of Date!
    Adobe Flash Player 11.2.202.235
    Adobe Reader X (10.1.3)
    Mozilla Firefox (14.0.1)
    ````````Process Check: objlist.exe by Laurent````````
    Avira Antivir avgnt.exe
    Avira Antivir avguard.exe
    CheckPoint ZoneAlarm vsmon.exe
    CheckPoint ZoneAlarm zatray.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: 8 % Defragment your hard drive soon!
    ````````````````````End of Log``````````````````````

    Farbar Service Scanner Version: 26-07-2012
    Ran by OWNER (administrator) on 31-07-2012 at 09:24:16
    Running from "C:\Users\OWNER\Desktop"
    Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo IP is accessible.
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall"=DWORD:0
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall"=DWORD:0
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "EnableFirewall"=DWORD:0


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Security Center:
    ============

    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend service is OK.
    The ServiceDll of WinDefend service is OK.


    Other Services:
    ==============

    sharedaccess Service is not running. Checking service configuration:
    The start type of sharedaccess service is set to Auto
    The ImagePath of sharedaccess service is OK.
    The ServiceDll of sharedaccess service is OK.


    File Check:
    ========
    C:\Windows\system32\nsisvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\afd.sys => MD5 is legit
    C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
    C:\Windows\system32\Drivers\tcpip.sys
    [2012-05-10 09:20] - [2012-03-30 08:39] - 0905600 ____A (Microsoft Corporation) 27D470DABC77BC60D0A3B0E4DEB6CB91

    C:\Windows\system32\dnsrslvr.dll => MD5 is legit
    C:\Windows\system32\mpssvc.dll => MD5 is legit
    C:\Windows\system32\bfe.dll => MD5 is legit
    C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\system32\SDRSVC.dll => MD5 is legit
    C:\Windows\system32\vssvc.exe => MD5 is legit
    C:\Windows\system32\wscsvc.dll => MD5 is legit
    C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\system32\wuaueng.dll => MD5 is legit
    C:\Windows\system32\qmgr.dll => MD5 is legit
    C:\Windows\system32\es.dll => MD5 is legit
    C:\Windows\system32\cryptsvc.dll => MD5 is legit
    C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
    C:\Windows\system32\svchost.exe => MD5 is legit
    C:\Windows\system32\rpcss.dll => MD5 is legit


    **** End of log ****

    C:\Qoobox\Quarantine\C\Users\OWNER\AppData\Local\Apps\Adobe\zncvlw.dll.vir a variant of Win32/Kryptik.AIGL trojan cleaned by deleting - quarantined
    C:\Users\OWNER\AppData\Local\Google\Chrome\User Data\Default\Default\aadigegfdcggdgdbdjdgdadadededdge\background.html Win32/BHO.OEI trojan cleaned by deleting - quarantined
    C:\Users\OWNER\AppData\Roaming\Mozilla\Firefox\Profiles\71jlrk59.default\extensions\veklhhbclq@veklhhbclq.org.xpi JS/Redirector.NCA trojan deleted - quarantined
    C:\Users\OWNER\Desktop\RK_Quarantine\zncvlw.dll.vir a variant of Win32/Kryptik.AIGL trojan cleaned by deleting - quarantined
     
  12. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    Uninstall Java(TM) SE Runtime Environment 6.

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [emptyjava]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. (Windows XP only) Run defrag at your convenience.

    11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    13. Please, let me know, how your computer is doing.
  13. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    The issue seems to be resolved.
  14. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: OWNER
    ->Temp folder emptied: 3798171 bytes
    ->Temporary Internet Files folder emptied: 60217544 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 461618841 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 2082 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 9107211 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 510.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default

    User: Default User

    User: OWNER
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    [EMPTYJAVA]

    User: All Users

    User: Default

    User: Default User

    User: OWNER
    ->Java cache emptied: 0 bytes

    User: Public

    Total Java Files Cleaned = 0.00 mb

    System Restore Service not available.

    OTL by OldTimer - Version 3.2.55.0 log created on 08142012_195808

    Files\Folders moved on Reboot...
    C:\Users\OWNER\AppData\Local\Temp\~DF9968.tmp moved successfully.
    File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
    File\Folder C:\Windows\temp\ZLT01618.TMP not found!

    PendingFileRenameOperations files...
    File C:\Users\OWNER\AppData\Local\Temp\~DF9968.tmp not found!
    [2012/08/14 20:33:25 | 000,000,000 | ---- | M] () C:\Windows\temp\_avast_\Webshlock.txt : Unable to obtain MD5
    File C:\Windows\temp\ZLT01618.TMP not found!

    Registry entries deleted on Reboot...

    ---------------------------------------------------------------------------------------------

    STILL CANNOT ACCESS GOOGLE CALENDAR or any other Google site except gmail. I did try WinsockFix.exe tool and it fixes it sometimes for a short period and then the problem is back within the same day.
  15. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    What browser? Did you try different browser?
  16. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    Internet explorer and Firefox both exhibit the same behavior.

    When attempting to visit www.google.com, Explorer reports:

    Internet Explorer cannot display the webpage

    Firefox reports:

    The connection has timed out
    The server at www.google.com is taking too long to respond
  17. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    Please download MiniToolBox, save it to your desktop and run it.

    Checkmark following boxes:
    • List content of Hosts
    Click Go and post the result.
  18. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    MiniToolBox by Farbar Version: 23-07-2012
    Ran by OWNER (administrator) on 05-09-2012 at 23:19:30
    Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
    Boot Mode: Normal
    ***************************************************************************
    ========================= Hosts content: =================================



    **** End of log ****
  19. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    Download following "hosts"(zipped) file: http://www.bleepstatic.com/fhost/uploads/0/hosts_vista.zip
    Unzip it.
    Copy hosts file found inside.
    Open Windows Explorer and paste hosts file to C:\WINDOWS\SYSTEM32\DRIVERS\ETC folder.

    NOTE.
    If you receive You don't have permission to save in this location message take ownership of C:\windows\system32\drivers\etc folder: http://www.howtogeek.com/howto/wind...ership-to-explorer-right-click-menu-in-vista/
    If the above doesn't work save the file to some known location, like your desktop, copy it from there and paste it to "etc" folder.

    Post new MiniToolbox log.
  20. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    I finally got it to work, but an svchost.exe process was keeping me from updating the file. So I ended up using "Unlocker" to modify the file at reboot. I hope I didn't add more crap to my box in the process. I already uninstalled that program and I chose NOT to install anything other than the explorer extension to use "unlocker" on the file.



    MiniToolBox by Farbar Version: 23-07-2012
    Ran by OWNER (administrator) on 07-09-2012 at 00:31:23
    Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
    Boot Mode: Normal
    ***************************************************************************
    ========================= Hosts content: =================================

    ::1 localhost

    127.0.0.1 localhost


    **** End of log ****
  21. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    How is Google access?
  22. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    Worked once, then back to what it was. :oops: Hosts file still contains what it does when I downloaded the replacement.
  23. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    Go Start>Run (Start search in Vista), type in:
    cmd
    Click OK (Vista and Windows 7 users: while holding CTRL, and SHIFT, press Enter).

    In Command Prompt window, type in following commands, and hit Enter after each one:
    ipconfig /flushdns
    ipconfig /registerdns
    ipconfig /release
    ipconfig /renew
    net stop "dns client"
    net start "dns client"


    Turn the computer off.

    On your router, you'll find a pinhole marked "Reset".
    Keep pushing the hole, using a pencil, or a paperclip until all lights briefly come off and on.
    NOTE. Simple router disconnecting from a power source will NOT do.
    Restart computer and check for redirections.

    NOTE. You may need to re-check your router security settings, as described HERE
  24. David Templeton

    David Templeton TS Rookie Topic Starter Posts: 21

    What does this mean "check for redirections."? It didn't work. Still no access to google calendar.
  25. Broni

    Broni Malware Annihilator Posts: 46,728   +254

    In all browsers?


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.