TechSpot

Zonedg.com Virus

By Lashire
Jul 9, 2011
  1. While still working on a problem with my first computer, certain individuals in my household have now given me another virus on the second.

    I ran Malwarebytes and I am no longer receiving the Avast warning, but I just want to check to make sure everything is alright. Also, any advice on how I can better secure my computers would be appreciated and prevent such things from reoccurring.

    Malwarebytes' Anti-Malware 1.51.0.1200
    www.malwarebytes.org

    Database version: 7012

    Windows 6.1.7601 Service Pack 1
    Internet Explorer 8.0.7601.17514

    7/9/2011 11:02:31 AM
    mbam-log-2011-07-09 (11-02-31).txt

    Scan type: Quick scan
    Objects scanned: 160833
    Time elapsed: 2 minute(s), 16 second(s)

    Memory Processes Infected: 1
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    c:\Users\Rebecca\AppData\Local\Temp\0.6945501268379678.exe (Spyware.Passwords.XGen) -> 2228 -> Unloaded process successfully.

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\Users\Rebecca\AppData\Local\Temp\0.6945501268379678.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

    GMER 1.0.15.15640 - http://www.gmer.net
    Rootkit quick scan 2011-07-09 11:49:08
    Windows 6.1.7601 Service Pack 1
    Running: ws5if5hi.exe


    ---- Services - GMER 1.0.15 ----

    Service C:\Windows\System32\svchost.exe (*** hidden *** ) [MANUAL] BITS <-- ROOTKIT !!!

    ---- EOF - GMER 1.0.15 ----

    .
    DDS (Ver_2011-06-23.01) - NTFSAMD64
    Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_22
    Run by Rebecca at 11:50:06 on 2011-07-09
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4095.2776 [GMT -7:00]
    .
    AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    E:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
    E:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    E:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
    E:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    E:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
    C:\Program Files\AVAST Software\Avast\AvastUI.exe
    C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Windows\system32\SearchIndexer.exe
    E:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\SysWOW64\ctfmon.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.yahoo.com/
    uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
    mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
    mWinlogon: Userinit=userinit.exe,
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll
    BHO: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
    BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
    BHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
    BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    BHO: VMN Toolbar: {a057a204-bacc-4d26-8287-79a187e26987} - C:\PROGRA~2\VMNTOO~1\VMNTOO~1.DLL
    BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll
    TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
    TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll
    TB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
    TB: VMN Toolbar: {a057a204-bacc-4d26-8287-79a187e26987} - C:\PROGRA~2\VMNTOO~1\VMNTOO~1.DLL
    EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
    uRun: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    uRun: [SpybotSD TeaTimer] E:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
    mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    TCP: DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{F4088DCB-FBA4-443F-8D55-953F3EBF44FD} : DhcpNameServer = 192.168.0.1
    mASetup: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
    BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll
    BHO-X64: 0x1 - No File
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: Conduit Engine : {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll
    BHO-X64: Conduit Engine - No File
    BHO-X64: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
    BHO-X64: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
    BHO-X64: Increase performance and video formats for your HTML5 <video> - No File
    BHO-X64: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
    BHO-X64: Canon Easy-WebPrint EX BHO - No File
    BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
    BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    BHO-X64: VMN Toolbar: {A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~2\VMNTOO~1\VMNTOO~1.DLL
    BHO-X64: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
    BHO-X64: uTorrentBar - No File
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
    TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll
    TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    TB-X64: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
    TB-X64: Conduit Engine : {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll
    TB-X64: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
    TB-X64: VMN Toolbar: {A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~2\VMNTOO~1\VMNTOO~1.DLL
    EB-X64: {21347690-EC41-4F9A-8887-1F4AEE672439} - No File
    mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\rneyt111.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
    FF - plugin: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
    FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
    FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
    FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll
    FF - plugin: C:\Users\Rebecca\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
    FF - plugin: E:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    ============= SERVICES / DRIVERS ===============
    .
    R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
    R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
    R1 SASDIFSV;SASDIFSV;E:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920]
    R1 SASKUTIL;SASKUTIL;E:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360]
    R2 !SASCORE;SAS Core Service;E:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-5-4 128384]
    R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
    R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
    R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
    R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-7-5 42184]
    R2 SBSDWSCService;SBSD Security Center Service;E:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-7-3 1153368]
    R3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?]
    R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    S2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService --> C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-3 136176]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    .
    =============== Created Last 30 ================
    .
    2011-07-09 18:45:01 -------- d-----w- C:\Windows\pss
    2011-07-09 18:19:53 -------- d-----w- C:\Users\Rebecca\AppData\Roaming\SUPERAntiSpyware.com
    2011-07-09 18:19:53 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
    2011-07-09 18:19:50 -------- d-----w- C:\ProgramData\!SASCORE
    2011-07-08 22:06:10 -------- d-----w- E:\Program Files (x86)\[text] - A Summer Story
    2011-07-08 22:02:50 -------- d-----w- E:\Program Files (x86)\Ripples
    2011-07-08 18:28:40 8873296 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0E322BE9-A341-404D-8EEE-49AC46B78639}\mpengine.dll
    2011-07-08 01:54:44 7680 ----a-w- E:\Program Files (x86)\Internet Explorer\iecompat.dll
    2011-07-08 01:54:44 50688 ----a-w- E:\Program Files (x86)\Internet Explorer\hmmapi.dll
    2011-07-06 23:54:37 -------- d-----w- C:\Users\Rebecca\AppData\Roaming\RenPy
    2011-07-06 18:47:18 -------- d-----w- C:\Users\Rebecca\AppData\Roaming\OpenOffice.org
    2011-07-06 18:46:24 -------- d-----w- E:\Program Files (x86)\OpenOffice.org 3
    2011-07-06 18:44:20 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
    2011-07-05 18:20:09 122880 ----a-w- E:\Program Files (x86)\Internet Explorer\jsdebuggeride.dll
    2011-07-05 18:20:09 119808 ----a-w- E:\Program Files (x86)\Internet Explorer\JSProfilerCore.dll
    2011-07-05 18:20:09 115712 ----a-w- E:\Program Files (x86)\Internet Explorer\ielowutil.exe
    2011-07-05 17:47:26 -------- d-----w- C:\Windows\System32\SPReview
    2011-07-05 17:46:37 -------- d-----w- C:\Windows\System32\EventProviders
    2011-07-05 08:41:07 8873296 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
    2011-07-05 06:33:14 -------- d-----w- C:\Users\Rebecca\AppData\Local\DDMSettings
    2011-07-05 05:48:59 -------- d-----w- C:\Program Files (x86)\Common Files\PX Storage Engine
    2011-07-05 05:48:34 -------- d-----w- C:\Program Files (x86)\Common Files\DivX Shared
    2011-07-05 05:47:30 -------- d-----w- C:\ProgramData\DivX
    2011-07-04 23:02:11 -------- d-----w- E:\Program Files (x86)\Visicom Media
    2011-07-04 23:01:03 -------- d-----w- C:\Users\Rebecca\AppData\Roaming\Sites
    2011-07-04 23:01:03 -------- d-----w- C:\Users\Rebecca\AppData\Roaming\SiteClasses
    2011-07-04 23:01:03 -------- d-----w- C:\Users\Rebecca\AppData\Roaming\Dynamic
    2011-07-04 23:00:58 -------- d-----w- C:\ProgramData\EmailNotifier
    2011-07-04 23:00:57 -------- d-----w- C:\Users\Rebecca\AppData\Roaming\vmntoolbar
    2011-07-03 20:12:59 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll
    2011-07-03 20:11:59 78848 ----a-w- C:\Windows\System32\hbaapi.dll
    2011-07-03 20:10:49 3072 ----a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui
    2011-07-03 20:10:49 2560 ----a-w- C:\Windows\System32\drivers\en-US\rdpwd.sys.mui
    2011-07-03 20:10:47 6144 ----a-w- C:\Windows\System32\drivers\en-US\IPMIDrv.sys.mui
    2011-07-03 20:10:47 4608 ----a-w- C:\Windows\System32\drivers\en-US\kbdclass.sys.mui
    2011-07-03 20:10:46 399872 ----a-w- C:\Windows\System32\dpx.dll
    2011-07-03 20:10:46 189952 ----a-w- C:\Windows\SysWow64\wdscore.dll
    2011-07-03 20:10:26 606208 ----a-w- C:\Windows\SysWow64\wbem\fastprox.dll
    2011-07-03 20:10:26 363008 ----a-w- C:\Windows\SysWow64\wbemcomn.dll
    2011-07-03 20:09:01 529408 ----a-w- C:\Windows\System32\wbemcomn.dll
    2011-07-03 19:41:42 -------- d-----w- C:\Program Files\Common Files\CANON
    2011-07-03 19:40:06 83968 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\CNMPP9W.DLL
    2011-07-03 19:40:06 28672 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\CNMPD9W.DLL
    2011-07-03 19:39:52 336896 ----a-w- C:\Windows\System32\CNMLM9W.DLL
    2011-07-03 19:39:45 244736 ----a-w- C:\Windows\System32\CNMIU9W.DLL
    2011-07-03 19:31:22 -------- d-----w- C:\Users\Rebecca\AppData\Local\Adobe
    2011-07-03 18:55:08 0 ----a-w- C:\Windows\SysWow64\ConduitEngine.tmp
    2011-07-03 18:55:08 -------- d-----w- C:\Users\Rebecca\AppData\Local\Conduit
    2011-07-03 18:55:05 -------- d-----w- E:\Program Files (x86)\uTorrent
    2011-07-03 18:54:24 -------- d-----w- C:\Users\Rebecca\AppData\Roaming\uTorrent
    2011-07-03 18:54:24 -------- d-----w- C:\Users\Rebecca\AppData\Local\uTorrent
    2011-07-03 18:49:34 -------- d-----w- C:\Users\Rebecca\AppData\Roaming\Malwarebytes
    2011-07-03 18:48:54 39984 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    2011-07-03 18:48:53 -------- d-----w- C:\ProgramData\Malwarebytes
    2011-07-03 18:48:51 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2011-07-03 18:48:51 -------- d-----w- E:\Program Files (x86)\Malwarebytes' Anti-Malware
    2011-07-03 18:47:26 -------- d-----w- E:\Program Files (x86)\Spybot - Search & Destroy
    2011-07-03 18:47:26 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
    2011-07-03 18:43:16 -------- d-----w- C:\Users\Rebecca\AppData\Local\Google
    2011-07-03 18:43:12 600920 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
    2011-07-03 18:43:10 64856 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
    2011-07-03 18:42:34 40112 ----a-w- C:\Windows\avastSS.scr
    2011-07-03 18:42:29 -------- d-----w- C:\ProgramData\AVAST Software
    2011-07-03 18:42:29 -------- d-----w- C:\Program Files\AVAST Software
    2011-07-03 01:04:32 715776 ----a-w- C:\Windows\System32\kerberos.dll
    2011-07-03 01:04:31 542208 ----a-w- C:\Windows\SysWow64\kerberos.dll
    2011-07-03 01:04:05 64512 ----a-w- C:\Windows\SysWow64\devobj.dll
    2011-07-03 01:04:05 44544 ----a-w- C:\Windows\SysWow64\devrtl.dll
    2011-07-03 01:04:05 404480 ----a-w- C:\Windows\System32\umpnpmgr.dll
    2011-07-03 01:04:05 252928 ----a-w- C:\Windows\SysWow64\drvinst.exe
    2011-07-03 01:04:05 207872 ----a-w- C:\Windows\System32\cfgmgr32.dll
    2011-07-03 01:04:05 145920 ----a-w- C:\Windows\SysWow64\cfgmgr32.dll
    2011-07-03 01:03:38 142336 ----a-w- C:\Windows\System32\poqexec.exe
    2011-07-03 01:03:38 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe
    2011-07-03 01:03:28 2871808 ----a-w- C:\Windows\explorer.exe
    2011-07-03 01:03:28 2616320 ----a-w- C:\Windows\SysWow64\explorer.exe
    2011-07-03 01:03:20 961024 ----a-w- C:\Windows\System32\CPFilters.dll
    2011-07-03 01:03:19 850944 ----a-w- C:\Windows\SysWow64\sbe.dll
    2011-07-03 01:03:19 723968 ----a-w- C:\Windows\System32\EncDec.dll
    2011-07-03 01:03:19 642048 ----a-w- C:\Windows\SysWow64\CPFilters.dll
    2011-07-03 01:03:19 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
    2011-07-03 01:03:19 259072 ----a-w- C:\Windows\System32\mpg2splt.ax
    2011-07-03 01:03:19 199680 ----a-w- C:\Windows\SysWow64\mpg2splt.ax
    2011-07-03 01:03:19 1118720 ----a-w- C:\Windows\System32\sbe.dll
    2011-07-03 01:01:33 759296 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
    2011-07-03 01:01:33 1110528 ----a-w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
    2011-07-03 01:00:07 289280 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
    2011-07-03 01:00:07 158208 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
    2011-07-03 01:00:07 128000 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
    2011-07-03 00:58:11 613376 ----a-w- C:\Windows\System32\vbscript.dll
    2011-07-03 00:58:11 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll
    2011-07-03 00:57:46 870912 ----a-w- C:\Windows\SysWow64\XpsPrint.dll
    2011-07-03 00:57:46 1465344 ----a-w- C:\Windows\System32\XpsPrint.dll
    2011-07-03 00:57:28 1395712 ----a-w- C:\Windows\System32\mfc42.dll
    2011-07-03 00:57:28 1359872 ----a-w- C:\Windows\System32\mfc42u.dll
    2011-07-03 00:57:27 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll
    2011-07-03 00:57:27 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll
    2011-07-03 00:56:29 70656 ----a-w- C:\Windows\SysWow64\fontsub.dll
    2011-07-03 00:56:29 46080 ----a-w- C:\Windows\System32\atmlib.dll
    2011-07-03 00:56:29 367616 ----a-w- C:\Windows\System32\atmfd.dll
    2011-07-03 00:56:29 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
    2011-07-03 00:56:29 294912 ----a-w- C:\Windows\SysWow64\atmfd.dll
    2011-07-03 00:56:29 100864 ----a-w- C:\Windows\System32\fontsub.dll
    2011-07-03 00:56:19 214016 ----a-w- C:\Windows\System32\winsrv.dll
    2011-07-03 00:55:42 27520 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
    2011-07-03 00:55:17 30208 ----a-w- C:\Windows\System32\dnscacheugc.exe
    2011-07-03 00:55:17 28672 ----a-w- C:\Windows\SysWow64\dnscacheugc.exe
    2011-07-03 00:55:17 183296 ----a-w- C:\Windows\System32\dnsrslvr.dll
    2011-07-03 00:54:28 321024 ----a-w- C:\Windows\System32\d3d10_1core.dll
    2011-07-03 00:54:28 219136 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll
    2011-07-03 00:54:28 197120 ----a-w- C:\Windows\System32\d3d10_1.dll
    2011-07-03 00:54:28 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll
    2011-07-03 00:54:20 467456 ----a-w- C:\Windows\System32\drivers\srv.sys
    2011-07-03 00:54:20 410112 ----a-w- C:\Windows\System32\drivers\srv2.sys
    2011-07-03 00:54:20 168448 ----a-w- C:\Windows\System32\drivers\srvnet.sys
    2011-07-03 00:53:56 -------- d-----w- C:\Windows\Show Desktop
    2011-07-03 00:53:01 642944 ----a-w- C:\Windows\System32\winload.efi
    2011-07-03 00:53:01 63488 ----a-w- C:\Windows\System32\setbcdlocale.dll
    2011-07-03 00:53:01 605552 ----a-w- C:\Windows\System32\winload.exe
    2011-07-03 00:53:01 566208 ----a-w- C:\Windows\System32\winresume.efi
    2011-07-03 00:53:01 518672 ----a-w- C:\Windows\System32\winresume.exe
    2011-07-03 00:53:01 20352 ----a-w- C:\Windows\System32\kdusb.dll
    2011-07-03 00:53:01 19328 ----a-w- C:\Windows\System32\kd1394.dll
    2011-07-03 00:53:01 17792 ----a-w- C:\Windows\System32\kdcom.dll
    2011-07-03 00:52:50 861696 ----a-w- C:\Windows\System32\oleaut32.dll
    2011-07-03 00:52:49 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
    2011-07-03 00:51:41 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe
    2011-07-03 00:51:41 31232 ----a-w- C:\Windows\System32\prevhost.exe
    2011-07-03 00:51:32 974336 ----a-w- C:\Windows\System32\WFS.exe
    2011-07-03 00:51:32 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
    2011-07-03 00:51:24 976896 ----a-w- C:\Windows\System32\inetcomm.dll
    2011-07-03 00:51:24 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll
    2011-07-03 00:51:06 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys
    2011-07-02 20:28:14 -------- d-----w- C:\Program Files\ATI Technologies
    2011-07-02 20:28:12 -------- d-----w- C:\Program Files\ATI
    2011-07-02 20:27:45 -------- d-----w- C:\ATI
    2011-07-02 20:22:16 -------- d-----w- E:\Program Files (x86)\Phyxion.net
    2011-07-02 19:59:45 -------- d-sh--w- C:\Boot
    2011-07-02 19:57:08 -------- d-----w- C:\ProgramData\AMD
    2011-07-02 19:57:07 46136 ----a-w- C:\Windows\System32\drivers\amdiox64.sys
    2011-07-02 19:46:18 -------- d-----w- C:\Users\Rebecca\AppData\Local\Yahoo!
    2011-07-02 19:46:07 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2011-07-02 19:45:39 -------- d-sh--w- C:\Windows\Installer
    2011-07-02 19:43:09 -------- d-----w- C:\Users\Rebecca\AppData\Local\Mozilla
    2011-07-02 19:34:48 270720 ------w- C:\Windows\System32\MpSigStub.exe
    2011-07-02 19:28:59 80488 ----a-w- C:\Windows\System32\RCoInst64.dll
    2011-07-02 19:26:54 74272 ----a-w- C:\Windows\System32\RtNicProp64.dll
    2011-07-02 19:26:54 344680 ----a-w- C:\Windows\System32\drivers\Rt64win7.sys
    2011-07-02 19:26:54 107552 ----a-w- C:\Windows\System32\RTNUninst64.dll
    2011-07-02 19:10:19 -------- d-----w- C:\Users\Rebecca\AppData\Local\Diagnostics
    .
    ==================== Find3M ====================
    .
    2011-07-05 17:53:22 175616 ----a-w- C:\Windows\System32\msclmd.dll
    2011-07-05 17:53:22 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
    2011-06-02 17:53:02 94208 ----a-w- C:\Windows\SysWow64\dpl100.dll
    2011-05-28 03:30:09 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
    2011-05-28 03:06:58 3135488 ----a-w- C:\Windows\System32\win32k.sys
    2011-05-28 02:53:58 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2011-05-25 06:44:30 61952 ----a-w- C:\Windows\System32\OVDecode64.dll
    2011-05-25 06:44:26 59904 ----a-w- C:\Windows\SysWow64\OVDecode.dll
    2011-05-25 06:44:14 53760 ----a-w- C:\Windows\System32\OpenCL.dll
    2011-05-25 06:44:10 51712 ----a-w- C:\Windows\SysWow64\OpenCL.dll
    2011-05-25 06:44:04 16672768 ----a-w- C:\Windows\System32\amdocl64.dll
    2011-05-25 06:43:50 12798976 ----a-w- C:\Windows\SysWow64\amdocl.dll
    2011-05-25 03:02:00 278528 ----a-w- C:\Windows\SysWow64\Oemdspif.dll
    2011-05-25 02:19:00 58880 ----a-w- C:\Windows\System32\coinst.dll
    2011-05-04 05:25:03 2315776 ----a-w- C:\Windows\System32\tquery.dll
    2011-05-04 05:22:25 778752 ----a-w- C:\Windows\System32\mssvp.dll
    2011-05-04 05:22:25 2223616 ----a-w- C:\Windows\System32\mssrch.dll
    2011-05-04 05:22:24 75264 ----a-w- C:\Windows\System32\msscntrs.dll
    2011-05-04 05:22:24 491520 ----a-w- C:\Windows\System32\mssph.dll
    2011-05-04 05:22:24 288256 ----a-w- C:\Windows\System32\mssphtb.dll
    2011-05-04 05:19:28 591872 ----a-w- C:\Windows\System32\SearchIndexer.exe
    2011-05-04 05:19:28 249856 ----a-w- C:\Windows\System32\SearchProtocolHost.exe
    2011-05-04 05:19:28 113664 ----a-w- C:\Windows\System32\SearchFilterHost.exe
    2011-05-04 04:34:43 1549312 ----a-w- C:\Windows\SysWow64\tquery.dll
    2011-05-04 04:32:02 666624 ----a-w- C:\Windows\SysWow64\mssvp.dll
    2011-05-04 04:32:01 337408 ----a-w- C:\Windows\SysWow64\mssph.dll
    2011-05-04 04:32:01 197120 ----a-w- C:\Windows\SysWow64\mssphtb.dll
    2011-05-04 04:32:01 1401344 ----a-w- C:\Windows\SysWow64\mssrch.dll
    2011-05-04 04:32:00 59392 ----a-w- C:\Windows\SysWow64\msscntrs.dll
    2011-05-04 04:28:31 86528 ----a-w- C:\Windows\SysWow64\SearchFilterHost.exe
    2011-05-04 04:28:31 427520 ----a-w- C:\Windows\SysWow64\SearchIndexer.exe
    2011-05-04 04:28:31 164352 ----a-w- C:\Windows\SysWow64\SearchProtocolHost.exe
    2011-04-25 05:33:51 1923968 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2011-04-25 02:34:03 499200 ----a-w- C:\Windows\System32\drivers\afd.sys
    2011-04-22 22:08:29 1188864 ----a-w- C:\Windows\System32\wininet.dll
    2011-04-22 19:10:01 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
    .
    ============= FINISH: 11:52:43.53 ===============
     
  2. Lashire

    Lashire TS Rookie Topic Starter Posts: 26

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-23.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 7/2/2011 12:06:34 PM
    System Uptime: 7/9/2011 11:42:03 AM (0 hours ago)
    .
    Motherboard: MICRO-STAR INTERNATIONAL CO.,LTD | | GF615M-P33 (MS-7597)
    Processor: AMD Phenom(tm) II X4 925 Processor | CPU1 | 2800/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 100 GiB total, 72.308 GiB free.
    D: is CDROM (CDFS)
    E: is FIXED (NTFS) - 832 GiB total, 828.316 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4d36e968-e325-11ce-bfc1-08002be10318}
    Description: ATI Radeon HD 5670
    Device ID: PCI\VEN_1002&DEV_68D8&SUBSYS_21FF1458&REV_00\4&210A641E&0&0048
    Manufacturer: ATI Technologies Inc.
    Name: ATI Radeon HD 5670
    PNP Device ID: PCI\VEN_1002&DEV_68D8&SUBSYS_21FF1458&REV_00\4&210A641E&0&0048
    Service: amdkmdap
    .
    Class GUID:
    Description: Coprocessor
    Device ID: PCI\VEN_10DE&DEV_03F4&SUBSYS_75971462&REV_A2\3&267A616A&0&0B
    Manufacturer:
    Name: Coprocessor
    PNP Device ID: PCI\VEN_10DE&DEV_03F4&SUBSYS_75971462&REV_A2\3&267A616A&0&0B
    Service:
    .
    ==== System Restore Points ===================
    .
    RP39: 7/7/2011 1:46:48 AM - Windows Update
    RP41: 7/7/2011 5:27:17 AM - Windows Update
    RP43: 7/7/2011 7:19:25 AM - Windows Update
    RP45: 7/7/2011 6:53:56 PM - Windows Modules Installer
    RP47: 7/8/2011 2:21:57 AM - Windows Update
    RP49: 7/8/2011 5:48:47 AM - Windows Update
    RP51: 7/8/2011 7:38:42 AM - Windows Update
    RP53: 7/9/2011 2:38:59 AM - Windows Update
    RP55: 7/9/2011 5:27:41 AM - Windows Update
    .
    ==== Installed Programs ======================
    .
    .
    [text] - A Summer Story 1.01
    ĀµTorrent
    AceFTP 3 Freeware
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader X (10.1.0)
    AMD VISION Engine Control Center
    avast! Free Antivirus
    CA VMN Anti-Spyware (remove only)
    Canon Easy-WebPrint EX
    Canon MP Navigator EX 3.0
    Canon MP250 series User Registration
    Canon Utilities Easy-PhotoPrint EX
    Canon Utilities My Printer
    Canon Utilities Solution Menu
    Catalyst Control Center - Branding
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center InstallProxy
    CCC Help English
    Conduit Engine
    DivX Setup
    Google Chrome
    Google Update Helper
    Java Auto Updater
    Java(TM) 6 Update 22
    Malwarebytes' Anti-Malware version 1.51.0.1200
    Microsoft Visual C++ 2005 Redistributable - KB2467175
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Mozilla Firefox 5.0 (x86 en-US)
    OpenOffice.org 3.3
    Realtek Ethernet Controller Driver For Windows 7
    Realtek High Definition Audio Driver
    Ripples 1
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Spybot - Search & Destroy
    System Requirements Lab
    uTorrentBar Toolbar
    VC80CRTRedist - 8.0.50727.4053
    VMN Toolbar
    Yahoo! BrowserPlus 2.9.8
    Yahoo! Messenger
    Yahoo! Software Update
    Yahoo! Toolbar
    .
    ==== Event Viewer Messages From Past Week ========
    .
    7/9/2011 5:27:58 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070103: ATI Technologies Inc. - Display - ATI Radeon HD 5670.
    7/9/2011 11:42:24 AM, Error: Service Control Manager [7000] - The AMD FUEL Service service failed to start due to the following error: The system cannot find the file specified.
    7/6/2011 12:41:41 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070308: Update for Windows 7 for x64-based Systems (KB2547666).
    7/3/2011 10:35:12 AM, Error: Service Control Manager [7023] -
    7/3/2011 1:03:27 PM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.
    7/2/2011 1:28:00 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    7/2/2011 1:27:27 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    7/2/2011 1:26:08 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    7/2/2011 1:26:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    7/2/2011 1:26:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    7/2/2011 1:26:01 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    7/2/2011 1:25:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    7/2/2011 1:25:44 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr Wanarpv6
    .
    ==== End Of File ===========================
     
  3. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ======================================================================

    Download TDSSKiller and save it to your desktop.
    • Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Broni, in case you need additional information, member left link embedded in first computer to the other thread we are working on. I don't know if there is a router between them, but I did advise member not to use a flash drive between the infected systems.
     
  5. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Cool. Thanks :)
     
  6. Lashire

    Lashire TS Rookie Topic Starter Posts: 26

    There is a router, and no flash drive was used. I believe this has to do with household individuals going to sites that they shouldn't be going to since the other computer is infected, I have asked them not to use it until it's clean so they use my personal computer.

    TDDSKiller came back clean.

    2011/07/09 15:06:41.0443 0824 TDSS rootkit removing tool 2.5.9.0 Jul 1 2011 18:45:21
    2011/07/09 15:06:42.0063 0824 ================================================================================
    2011/07/09 15:06:42.0063 0824 SystemInfo:
    2011/07/09 15:06:42.0063 0824
    2011/07/09 15:06:42.0063 0824 OS Version: 6.1.7601 ServicePack: 1.0
    2011/07/09 15:06:42.0063 0824 Product type: Workstation
    2011/07/09 15:06:42.0064 0824 ComputerName: REBECCA-PC
    2011/07/09 15:06:42.0064 0824 UserName: Rebecca
    2011/07/09 15:06:42.0064 0824 Windows directory: C:\Windows
    2011/07/09 15:06:42.0064 0824 System windows directory: C:\Windows
    2011/07/09 15:06:42.0064 0824 Running under WOW64
    2011/07/09 15:06:42.0064 0824 Processor architecture: Intel x64
    2011/07/09 15:06:42.0064 0824 Number of processors: 4
    2011/07/09 15:06:42.0064 0824 Page size: 0x1000
    2011/07/09 15:06:42.0064 0824 Boot type: Normal boot
    2011/07/09 15:06:42.0064 0824 ================================================================================
    2011/07/09 15:06:47.0331 0824 Initialize success
    2011/07/09 15:06:55.0921 0192 ================================================================================
    2011/07/09 15:06:55.0921 0192 Scan started
    2011/07/09 15:06:55.0921 0192 Mode: Manual;
    2011/07/09 15:06:55.0921 0192 ================================================================================
    2011/07/09 15:07:00.0366 0192 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
    2011/07/09 15:07:00.0747 0192 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
    2011/07/09 15:07:01.0074 0192 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
    2011/07/09 15:07:01.0202 0192 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
    2011/07/09 15:07:01.0342 0192 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
    2011/07/09 15:07:01.0704 0192 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
    2011/07/09 15:07:02.0065 0192 AFD (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
    2011/07/09 15:07:02.0113 0192 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
    2011/07/09 15:07:02.0150 0192 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
    2011/07/09 15:07:02.0186 0192 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
    2011/07/09 15:07:02.0218 0192 amdiox64 (6a2eeb0c4133b20773bb3dd0b7b377b4) C:\Windows\system32\DRIVERS\amdiox64.sys
    2011/07/09 15:07:02.0246 0192 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
    2011/07/09 15:07:02.0272 0192 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
    2011/07/09 15:07:02.0321 0192 amdsata (6ec6d772eae38dc17c14aed9b178d24b) C:\Windows\system32\drivers\amdsata.sys
    2011/07/09 15:07:02.0352 0192 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
    2011/07/09 15:07:02.0371 0192 amdxata (1142a21db581a84ea5597b03a26ebaa0) C:\Windows\system32\drivers\amdxata.sys
    2011/07/09 15:07:02.0515 0192 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
    2011/07/09 15:07:02.0591 0192 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
    2011/07/09 15:07:02.0662 0192 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
    2011/07/09 15:07:02.0718 0192 aswFsBlk (55353cd0da287b2c3782485740965b54) C:\Windows\system32\drivers\aswFsBlk.sys
    2011/07/09 15:07:02.0777 0192 aswMonFlt (b38061cdefb71361e0c7547ac60527e8) C:\Windows\system32\drivers\aswMonFlt.sys
    2011/07/09 15:07:02.0834 0192 aswRdr (91e7aca95933633b2557f47cdfdb74c3) C:\Windows\system32\drivers\aswRdr.sys
    2011/07/09 15:07:02.0877 0192 aswSnx (2b15499f68fad60ce69264a327e9b0f0) C:\Windows\system32\drivers\aswSnx.sys
    2011/07/09 15:07:02.0906 0192 aswSP (4d939ecb19dc930056593390d1c87c43) C:\Windows\system32\drivers\aswSP.sys
    2011/07/09 15:07:02.0927 0192 aswTdi (d633426c5a207ce21767569aa4946891) C:\Windows\system32\drivers\aswTdi.sys
    2011/07/09 15:07:02.0949 0192 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
    2011/07/09 15:07:02.0997 0192 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
    2011/07/09 15:07:03.0119 0192 AtiHDAudioService (cbd14f698def12ee3557604b726cb8eb) C:\Windows\system32\drivers\AtihdW76.sys
    2011/07/09 15:07:03.0193 0192 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
    2011/07/09 15:07:03.0215 0192 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
    2011/07/09 15:07:03.0245 0192 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
    2011/07/09 15:07:03.0283 0192 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
    2011/07/09 15:07:03.0315 0192 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
    2011/07/09 15:07:03.0327 0192 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
    2011/07/09 15:07:03.0340 0192 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
    2011/07/09 15:07:03.0374 0192 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
    2011/07/09 15:07:03.0387 0192 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
    2011/07/09 15:07:03.0399 0192 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
    2011/07/09 15:07:03.0412 0192 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
    2011/07/09 15:07:03.0428 0192 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
    2011/07/09 15:07:03.0456 0192 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
    2011/07/09 15:07:03.0518 0192 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
    2011/07/09 15:07:03.0534 0192 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
    2011/07/09 15:07:03.0594 0192 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
    2011/07/09 15:07:03.0680 0192 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
    2011/07/09 15:07:03.0714 0192 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
    2011/07/09 15:07:03.0754 0192 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
    2011/07/09 15:07:03.0775 0192 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
    2011/07/09 15:07:03.0792 0192 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
    2011/07/09 15:07:03.0816 0192 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
    2011/07/09 15:07:03.0876 0192 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
    2011/07/09 15:07:03.0947 0192 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
    2011/07/09 15:07:03.0971 0192 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
    2011/07/09 15:07:04.0020 0192 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
    2011/07/09 15:07:04.0064 0192 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
    2011/07/09 15:07:04.0234 0192 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
    2011/07/09 15:07:04.0373 0192 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
    2011/07/09 15:07:04.0426 0192 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
    2011/07/09 15:07:04.0478 0192 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
    2011/07/09 15:07:04.0507 0192 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
    2011/07/09 15:07:04.0554 0192 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
    2011/07/09 15:07:04.0591 0192 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
    2011/07/09 15:07:04.0617 0192 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
    2011/07/09 15:07:04.0637 0192 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
    2011/07/09 15:07:04.0667 0192 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
    2011/07/09 15:07:04.0696 0192 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
    2011/07/09 15:07:04.0710 0192 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
    2011/07/09 15:07:04.0746 0192 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
    2011/07/09 15:07:04.0762 0192 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
    2011/07/09 15:07:04.0789 0192 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
    2011/07/09 15:07:04.0821 0192 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
    2011/07/09 15:07:04.0854 0192 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
    2011/07/09 15:07:04.0888 0192 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
    2011/07/09 15:07:04.0906 0192 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
    2011/07/09 15:07:04.0926 0192 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
    2011/07/09 15:07:04.0952 0192 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys
    2011/07/09 15:07:04.0987 0192 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
    2011/07/09 15:07:05.0048 0192 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
    2011/07/09 15:07:05.0104 0192 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
    2011/07/09 15:07:05.0130 0192 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
    2011/07/09 15:07:05.0155 0192 iaStorV (3df4395a7cf8b7a72a5f4606366b8c2d) C:\Windows\system32\drivers\iaStorV.sys
    2011/07/09 15:07:05.0186 0192 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
    2011/07/09 15:07:05.0299 0192 IntcAzAudAddService (4bb88d40b6222cd541c2749cf5115a4b) C:\Windows\system32\drivers\RTKVHD64.sys
    2011/07/09 15:07:05.0367 0192 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
    2011/07/09 15:07:05.0392 0192 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
    2011/07/09 15:07:05.0428 0192 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
    2011/07/09 15:07:05.0447 0192 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
    2011/07/09 15:07:05.0459 0192 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
    2011/07/09 15:07:05.0471 0192 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
    2011/07/09 15:07:05.0501 0192 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
    2011/07/09 15:07:05.0526 0192 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
    2011/07/09 15:07:05.0548 0192 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
    2011/07/09 15:07:05.0591 0192 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
    2011/07/09 15:07:05.0631 0192 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
    2011/07/09 15:07:05.0659 0192 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
    2011/07/09 15:07:05.0681 0192 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
    2011/07/09 15:07:05.0721 0192 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
    2011/07/09 15:07:05.0762 0192 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
    2011/07/09 15:07:05.0780 0192 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
    2011/07/09 15:07:05.0798 0192 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
    2011/07/09 15:07:05.0821 0192 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
    2011/07/09 15:07:05.0839 0192 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
    2011/07/09 15:07:05.0862 0192 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
    2011/07/09 15:07:05.0883 0192 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
    2011/07/09 15:07:05.0903 0192 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
    2011/07/09 15:07:05.0918 0192 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
    2011/07/09 15:07:05.0947 0192 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
    2011/07/09 15:07:05.0962 0192 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
    2011/07/09 15:07:05.0994 0192 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
    2011/07/09 15:07:06.0010 0192 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
    2011/07/09 15:07:06.0024 0192 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
    2011/07/09 15:07:06.0057 0192 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
    2011/07/09 15:07:06.0080 0192 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
    2011/07/09 15:07:06.0107 0192 mrxsmb10 (2086d463bd371d8a37d153897430916d) C:\Windows\system32\DRIVERS\mrxsmb10.sys
    2011/07/09 15:07:06.0127 0192 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
    2011/07/09 15:07:06.0153 0192 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
    2011/07/09 15:07:06.0194 0192 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
    2011/07/09 15:07:06.0223 0192 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
    2011/07/09 15:07:06.0245 0192 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
    2011/07/09 15:07:06.0288 0192 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
    2011/07/09 15:07:06.0308 0192 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
    2011/07/09 15:07:06.0321 0192 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
    2011/07/09 15:07:06.0335 0192 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
    2011/07/09 15:07:06.0374 0192 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
    2011/07/09 15:07:06.0396 0192 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
    2011/07/09 15:07:06.0430 0192 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
    2011/07/09 15:07:06.0441 0192 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
    2011/07/09 15:07:06.0487 0192 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
    2011/07/09 15:07:06.0553 0192 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
    2011/07/09 15:07:06.0623 0192 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
    2011/07/09 15:07:06.0669 0192 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
    2011/07/09 15:07:06.0697 0192 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
    2011/07/09 15:07:06.0727 0192 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
    2011/07/09 15:07:06.0764 0192 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
    2011/07/09 15:07:06.0810 0192 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
    2011/07/09 15:07:06.0854 0192 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
    2011/07/09 15:07:06.0877 0192 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
    2011/07/09 15:07:06.0910 0192 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
    2011/07/09 15:07:06.0936 0192 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
    2011/07/09 15:07:06.0958 0192 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
    2011/07/09 15:07:07.0008 0192 Ntfs (05d78aa5cb5f3f5c31160bdb955d0b7c) C:\Windows\system32\drivers\Ntfs.sys
    2011/07/09 15:07:07.0076 0192 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
    2011/07/09 15:07:07.0101 0192 NVENETFD (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
    2011/07/09 15:07:07.0352 0192 nvlddmkm (dd81fbc57ab9134cddc5ce90880bfd80) C:\Windows\system32\DRIVERS\nvlddmkm.sys
    2011/07/09 15:07:07.0526 0192 nvraid (5d9fd91f3d38dc9da01e3cb5fa89cd48) C:\Windows\system32\drivers\nvraid.sys
    2011/07/09 15:07:07.0539 0192 nvstor (f7cd50fe7139f07e77da8ac8033d1832) C:\Windows\system32\drivers\nvstor.sys
    2011/07/09 15:07:07.0574 0192 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
    2011/07/09 15:07:07.0595 0192 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
    2011/07/09 15:07:07.0632 0192 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
    2011/07/09 15:07:07.0659 0192 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
    2011/07/09 15:07:07.0682 0192 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
    2011/07/09 15:07:07.0712 0192 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
    2011/07/09 15:07:07.0730 0192 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
    2011/07/09 15:07:07.0752 0192 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
    2011/07/09 15:07:07.0776 0192 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
    2011/07/09 15:07:07.0871 0192 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
    2011/07/09 15:07:07.0889 0192 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
    2011/07/09 15:07:07.0939 0192 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
    2011/07/09 15:07:07.0970 0192 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
    2011/07/09 15:07:08.0014 0192 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
    2011/07/09 15:07:08.0038 0192 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
    2011/07/09 15:07:08.0049 0192 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
    2011/07/09 15:07:08.0087 0192 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
    2011/07/09 15:07:08.0111 0192 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
    2011/07/09 15:07:08.0135 0192 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
    2011/07/09 15:07:08.0150 0192 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
    2011/07/09 15:07:08.0190 0192 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
    2011/07/09 15:07:08.0207 0192 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
    2011/07/09 15:07:08.0225 0192 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
    2011/07/09 15:07:08.0243 0192 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
    2011/07/09 15:07:08.0263 0192 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
    2011/07/09 15:07:08.0291 0192 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
    2011/07/09 15:07:08.0324 0192 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
    2011/07/09 15:07:08.0364 0192 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
    2011/07/09 15:07:08.0402 0192 RTL8167 (4b42bc58294e83a6a92ec8b88c14c4a3) C:\Windows\system32\DRIVERS\Rt64win7.sys
    2011/07/09 15:07:08.0454 0192 SASDIFSV (99df79c258b3342b6c8a5f802998de56) E:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
    2011/07/09 15:07:08.0470 0192 SASKUTIL (2859c35c0651e8eb0d86d48e740388f2) E:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
    2011/07/09 15:07:08.0503 0192 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
    2011/07/09 15:07:08.0555 0192 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
    2011/07/09 15:07:08.0585 0192 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
    2011/07/09 15:07:08.0619 0192 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
    2011/07/09 15:07:08.0635 0192 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
    2011/07/09 15:07:08.0680 0192 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
    2011/07/09 15:07:08.0731 0192 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
    2011/07/09 15:07:08.0751 0192 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
    2011/07/09 15:07:08.0767 0192 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
    2011/07/09 15:07:08.0797 0192 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
    2011/07/09 15:07:08.0820 0192 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
    2011/07/09 15:07:08.0840 0192 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
    2011/07/09 15:07:08.0866 0192 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
    2011/07/09 15:07:08.0894 0192 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
    2011/07/09 15:07:08.0938 0192 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
    2011/07/09 15:07:08.0961 0192 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
    2011/07/09 15:07:08.0986 0192 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
    2011/07/09 15:07:09.0033 0192 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
    2011/07/09 15:07:09.0057 0192 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
    2011/07/09 15:07:09.0132 0192 Tcpip (92ce29d95ac9dd2d0ee9061d551ba250) C:\Windows\system32\drivers\tcpip.sys
    2011/07/09 15:07:09.0198 0192 TCPIP6 (92ce29d95ac9dd2d0ee9061d551ba250) C:\Windows\system32\DRIVERS\tcpip.sys
    2011/07/09 15:07:09.0246 0192 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
    2011/07/09 15:07:09.0265 0192 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
    2011/07/09 15:07:09.0284 0192 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
    2011/07/09 15:07:09.0322 0192 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
    2011/07/09 15:07:09.0358 0192 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
    2011/07/09 15:07:09.0409 0192 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
    2011/07/09 15:07:09.0439 0192 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
    2011/07/09 15:07:09.0494 0192 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
    2011/07/09 15:07:09.0514 0192 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
    2011/07/09 15:07:09.0539 0192 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
    2011/07/09 15:07:09.0568 0192 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
    2011/07/09 15:07:09.0579 0192 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
    2011/07/09 15:07:09.0605 0192 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
    2011/07/09 15:07:09.0633 0192 usbccgp (481dff26b4dca8f4cbac1f7dce1d6829) C:\Windows\system32\drivers\usbccgp.sys
    2011/07/09 15:07:09.0664 0192 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
    2011/07/09 15:07:09.0687 0192 usbehci (74ee782b1d9c241efe425565854c661c) C:\Windows\system32\drivers\usbehci.sys
    2011/07/09 15:07:09.0712 0192 usbhub (dc96bd9ccb8403251bcf25047573558e) C:\Windows\system32\drivers\usbhub.sys
    2011/07/09 15:07:09.0731 0192 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\drivers\usbohci.sys
    2011/07/09 15:07:09.0753 0192 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
    2011/07/09 15:07:09.0777 0192 USBSTOR (d76510cfa0fc09023077f22c2f979d86) C:\Windows\system32\drivers\USBSTOR.SYS
    2011/07/09 15:07:09.0801 0192 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\drivers\usbuhci.sys
    2011/07/09 15:07:09.0859 0192 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
    2011/07/09 15:07:09.0883 0192 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
    2011/07/09 15:07:09.0912 0192 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
    2011/07/09 15:07:09.0933 0192 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
    2011/07/09 15:07:09.0971 0192 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
    2011/07/09 15:07:09.0989 0192 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
    2011/07/09 15:07:10.0026 0192 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
    2011/07/09 15:07:10.0044 0192 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
    2011/07/09 15:07:10.0064 0192 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
    2011/07/09 15:07:10.0086 0192 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
    2011/07/09 15:07:10.0112 0192 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
    2011/07/09 15:07:10.0169 0192 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
    2011/07/09 15:07:10.0196 0192 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
    2011/07/09 15:07:10.0270 0192 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
    2011/07/09 15:07:10.0296 0192 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
    2011/07/09 15:07:10.0342 0192 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
    2011/07/09 15:07:10.0362 0192 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
    2011/07/09 15:07:10.0404 0192 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
    2011/07/09 15:07:10.0446 0192 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
    2011/07/09 15:07:10.0493 0192 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
    2011/07/09 15:07:10.0528 0192 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
    2011/07/09 15:07:10.0570 0192 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
    2011/07/09 15:07:10.0585 0192 Boot (0x1200) (80bd6968b769bb299658cfd027186400) \Device\Harddisk0\DR0\Partition0
    2011/07/09 15:07:10.0607 0192 Boot (0x1200) (daf87a3677a7a9c7a4df0fe01ce81553) \Device\Harddisk0\DR0\Partition1
    2011/07/09 15:07:10.0610 0192 ================================================================================
    2011/07/09 15:07:10.0610 0192 Scan finished
    2011/07/09 15:07:10.0610 0192 ================================================================================
    2011/07/09 15:07:10.0618 3360 Detected object count: 0
    2011/07/09 15:07:10.0618 3360 Actual detected object count: 0
     
  7. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    Click the "Scan" button to start scan:
    [​IMG]

    On completion of the scan click "Save log", save it to your desktop and post in your next reply:
    [​IMG]

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    =============================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  8. Lashire

    Lashire TS Rookie Topic Starter Posts: 26

    aswMBR version 0.9.7.705 Copyright(c) 2011 AVAST Software
    Run date: 2011-07-10 12:41:05
    -----------------------------
    12:41:05.887 OS Version: Windows x64 6.1.7601 Service Pack 1
    12:41:05.887 Number of processors: 4 586 0x403
    12:41:05.888 ComputerName: REBECCA-PC UserName: Rebecca
    12:41:14.687 Initialize success
    12:41:24.553 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000056
    12:41:24.559 Disk 0 Vendor: ST310005 CC46 Size: 953869MB BusType: 3
    12:41:26.605 Disk 0 MBR read successfully
    12:41:26.614 Disk 0 MBR scan
    12:41:26.623 Disk 0 Windows 7 default MBR code
    12:41:26.633 Service scanning
    12:41:28.722 Disk 0 trace - called modules:
    12:41:28.761 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor.sys
    12:41:28.769 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d50060]
    12:41:28.776 3 CLASSPNP.SYS[fffff8800160143f] -> nt!IofCallDriver -> [0xfffffa8003e3c8b0]
    12:41:28.783 5 ACPI.sys[fffff88000e777a1] -> nt!IofCallDriver -> \Device\00000056[0xfffffa8003db0060]
    12:41:28.789 Scan finished successfully
    12:43:09.386 Disk 0 MBR has been saved successfully to "C:\Users\Rebecca\Desktop\MBR.dat"
    12:43:09.387 The log file has been saved successfully to "C:\Users\Rebecca\Desktop\aswMBR.txt"


    ComboFix 11-07-10.03 - Rebecca 07/10/2011 12:45:35.1.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4095.3086 [GMT -7:00]
    Running from: c:\users\Rebecca\Desktop\ComboFix.exe
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-06-10 to 2011-07-10 )))))))))))))))))))))))))))))))
    .
    .
    2011-07-10 19:48 . 2011-07-10 19:48 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-07-09 18:19 . 2011-07-09 18:19 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
    2011-07-09 18:19 . 2011-07-09 18:19 -------- d-----w- c:\programdata\!SASCORE
    2011-07-08 22:06 . 2011-07-08 22:06 -------- d-----w- e:\program files (x86)\[text] - A Summer Story
    2011-07-08 22:02 . 2011-07-08 22:02 -------- d-----w- e:\program files (x86)\Ripples
    2011-07-08 18:28 . 2011-06-20 15:57 8873296 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0E322BE9-A341-404D-8EEE-49AC46B78639}\mpengine.dll
    2011-07-06 18:46 . 2011-07-06 18:46 -------- d-----w- e:\program files (x86)\OpenOffice.org 3
    2011-07-06 18:44 . 2011-07-06 18:44 -------- d-----w- c:\program files (x86)\Common Files\Java
    2011-07-06 18:44 . 2011-07-06 18:44 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2011-07-05 18:09 . 2011-07-05 18:09 -------- d-----w- e:\program files (x86)\Windows Sidebar
    2011-07-05 18:09 . 2011-07-05 18:09 -------- d-----w- e:\program files (x86)\Windows Portable Devices
    2011-07-05 18:09 . 2011-07-05 18:09 -------- d-----w- e:\program files (x86)\Windows Photo Viewer
    2011-07-05 17:47 . 2011-07-05 17:47 -------- d-----w- c:\windows\system32\SPReview
    2011-07-05 17:46 . 2011-07-05 17:46 -------- d-----w- c:\windows\system32\EventProviders
    2011-07-05 05:48 . 2011-07-05 05:48 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine
    2011-07-05 05:48 . 2011-07-05 06:32 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared
    2011-07-05 05:47 . 2011-07-05 06:32 -------- d-----w- c:\programdata\DivX
    2011-07-04 23:02 . 2011-07-04 23:02 -------- d-----w- e:\program files (x86)\Visicom Media
    2011-07-04 23:00 . 2011-07-05 17:30 -------- d-----w- c:\programdata\EmailNotifier
    2011-07-03 20:12 . 2010-11-20 13:27 2018304 ----a-w- c:\windows\system32\WsmSvc.dll
    2011-07-03 20:10 . 2010-11-20 13:01 2560 ----a-w- c:\windows\system32\drivers\en-US\rdpwd.sys.mui
    2011-07-03 20:10 . 2010-11-20 12:57 3072 ----a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui
    2011-07-03 20:10 . 2010-11-20 13:11 6144 ----a-w- c:\windows\system32\drivers\en-US\IPMIDrv.sys.mui
    2011-07-03 20:10 . 2010-11-20 13:10 4608 ----a-w- c:\windows\system32\drivers\en-US\kbdclass.sys.mui
    2011-07-03 20:10 . 2010-11-20 13:26 399872 ----a-w- c:\windows\system32\dpx.dll
    2011-07-03 20:10 . 2010-11-20 12:21 189952 ----a-w- c:\windows\SysWow64\wdscore.dll
    2011-07-03 20:10 . 2010-11-20 12:21 363008 ----a-w- c:\windows\SysWow64\wbemcomn.dll
    2011-07-03 20:10 . 2010-11-20 12:19 606208 ----a-w- c:\windows\SysWow64\wbem\fastprox.dll
    2011-07-03 20:09 . 2010-11-20 13:27 529408 ----a-w- c:\windows\system32\wbemcomn.dll
    2011-07-03 19:41 . 2011-07-03 19:41 -------- d-----w- c:\program files\Common Files\CANON
    2011-07-03 19:40 . 2011-07-03 19:40 -------- d--h--w- c:\programdata\CanonBJ
    2011-07-03 19:40 . 2010-02-04 12:00 83968 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPP9W.DLL
    2011-07-03 19:40 . 2010-02-04 12:00 28672 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPD9W.DLL
    2011-07-03 19:40 . 2011-07-03 19:40 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
    2011-07-03 19:39 . 2010-02-04 12:00 336896 ----a-w- c:\windows\system32\CNMLM9W.DLL
    2011-07-03 19:39 . 2009-03-18 09:10 244736 ----a-w- c:\windows\system32\CNMIU9W.DLL
    2011-07-03 19:30 . 2011-07-03 19:30 -------- d-----w- c:\program files (x86)\Common Files\Adobe
    2011-07-03 18:55 . 2011-07-03 18:55 0 ----a-w- c:\windows\SysWow64\ConduitEngine.tmp
    2011-07-03 18:55 . 2011-07-03 18:55 -------- d-----w- e:\program files (x86)\uTorrent
    2011-07-03 18:48 . 2011-05-29 16:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
    2011-07-03 18:48 . 2011-07-03 18:48 -------- d-----w- c:\programdata\Malwarebytes
    2011-07-03 18:48 . 2011-07-03 18:48 -------- d-----w- e:\program files (x86)\Malwarebytes' Anti-Malware
    2011-07-03 18:48 . 2011-05-29 16:11 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-07-03 18:47 . 2011-07-09 17:55 -------- d-----w- e:\program files (x86)\Spybot - Search & Destroy
    2011-07-03 18:47 . 2011-07-03 18:48 -------- d-----w- c:\programdata\Spybot - Search & Destroy
    2011-07-03 18:43 . 2011-07-04 11:43 253888 ----a-w- c:\windows\system32\aswBoot.exe
    2011-07-03 18:42 . 2011-07-10 19:32 -------- d-----w- c:\programdata\AVAST Software
    2011-07-03 18:42 . 2011-07-03 18:42 -------- d-----w- c:\program files\AVAST Software
    2011-07-03 17:33 . 2011-07-03 17:33 -------- d-----w- e:\program files (x86)\Reference Assemblies
    2011-07-03 17:33 . 2011-07-05 18:09 -------- d-----w- e:\program files (x86)\Windows Mail
    2011-07-03 17:33 . 2011-07-03 17:33 -------- d-----w- c:\windows\SysWow64\Wat
    2011-07-03 17:33 . 2011-07-03 17:33 -------- d-----w- c:\windows\system32\Wat
    2011-07-03 01:04 . 2010-12-17 11:40 715776 ----a-w- c:\windows\system32\kerberos.dll
    2011-07-03 01:04 . 2010-12-17 07:07 542208 ----a-w- c:\windows\SysWow64\kerberos.dll
    2011-07-03 01:04 . 2011-05-24 11:42 404480 ----a-w- c:\windows\system32\umpnpmgr.dll
    2011-07-03 01:04 . 2011-05-24 10:40 64512 ----a-w- c:\windows\SysWow64\devobj.dll
    2011-07-03 01:04 . 2011-05-24 10:40 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
    2011-07-03 01:04 . 2011-05-24 10:39 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
    2011-07-03 01:04 . 2011-05-24 10:37 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
    2011-07-03 01:04 . 2010-11-20 13:25 207872 ----a-w- c:\windows\system32\cfgmgr32.dll
    2011-07-03 01:03 . 2011-04-09 06:58 142336 ----a-w- c:\windows\system32\poqexec.exe
    2011-07-03 01:03 . 2011-04-09 05:56 123904 ----a-w- c:\windows\SysWow64\poqexec.exe
    2011-07-03 01:03 . 2011-02-25 06:19 2871808 ----a-w- c:\windows\explorer.exe
    2011-07-03 01:03 . 2011-02-25 05:30 2616320 ----a-w- c:\windows\SysWow64\explorer.exe
    2011-07-03 01:03 . 2010-12-23 10:42 961024 ----a-w- c:\windows\system32\CPFilters.dll
    2011-07-03 01:03 . 2010-12-23 10:42 1118720 ----a-w- c:\windows\system32\sbe.dll
    2011-07-03 01:03 . 2010-12-23 10:42 723968 ----a-w- c:\windows\system32\EncDec.dll
    2011-07-03 01:03 . 2010-12-23 10:36 259072 ----a-w- c:\windows\system32\mpg2splt.ax
    2011-07-03 01:03 . 2010-12-23 05:54 850944 ----a-w- c:\windows\SysWow64\sbe.dll
    2011-07-03 01:03 . 2010-12-23 05:54 642048 ----a-w- c:\windows\SysWow64\CPFilters.dll
    2011-07-03 01:03 . 2010-12-23 05:54 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
    2011-07-03 01:03 . 2010-12-23 05:50 199680 ----a-w- c:\windows\SysWow64\mpg2splt.ax
    2011-07-03 01:01 . 2011-04-29 05:55 1110528 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
    2011-07-03 01:01 . 2011-04-29 04:57 759296 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
    2011-07-03 01:00 . 2011-04-27 02:40 158208 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-07-03 01:00 . 2011-04-27 02:39 289280 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2011-07-03 01:00 . 2011-04-27 02:39 128000 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
    2011-07-03 00:58 . 2011-02-18 10:56 613376 ----a-w- c:\windows\system32\vbscript.dll
    2011-07-03 00:58 . 2011-02-18 05:43 428032 ----a-w- c:\windows\SysWow64\vbscript.dll
    2011-07-03 00:57 . 2011-03-12 12:08 1465344 ----a-w- c:\windows\system32\XpsPrint.dll
    2011-07-03 00:57 . 2011-03-12 11:23 870912 ----a-w- c:\windows\SysWow64\XpsPrint.dll
    2011-07-03 00:57 . 2011-03-11 06:34 1359872 ----a-w- c:\windows\system32\mfc42u.dll
    2011-07-03 00:57 . 2011-03-11 06:34 1395712 ----a-w- c:\windows\system32\mfc42.dll
    2011-07-03 00:57 . 2011-03-11 05:33 1164288 ----a-w- c:\windows\SysWow64\mfc42u.dll
    2011-07-03 00:57 . 2011-03-11 05:33 1137664 ----a-w- c:\windows\SysWow64\mfc42.dll
    2011-07-03 00:56 . 2011-02-19 12:03 46080 ----a-w- c:\windows\system32\atmlib.dll
    2011-07-03 00:56 . 2011-02-19 09:00 367616 ----a-w- c:\windows\system32\atmfd.dll
    2011-07-03 00:56 . 2011-02-19 06:30 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
    2011-07-03 00:56 . 2011-02-19 04:34 294912 ----a-w- c:\windows\SysWow64\atmfd.dll
    2011-07-03 00:56 . 2010-09-30 10:41 100864 ----a-w- c:\windows\system32\fontsub.dll
    2011-07-03 00:56 . 2010-09-30 06:47 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
    2011-07-03 00:56 . 2010-12-17 11:42 214016 ----a-w- c:\windows\system32\winsrv.dll
    2011-07-03 00:55 . 2011-04-22 22:15 27520 ----a-w- c:\windows\system32\drivers\Diskdump.sys
    2011-07-03 00:55 . 2011-03-03 06:24 183296 ----a-w- c:\windows\system32\dnsrslvr.dll
    2011-07-03 00:55 . 2011-03-03 06:21 30208 ----a-w- c:\windows\system32\dnscacheugc.exe
    2011-07-03 00:55 . 2011-03-03 05:36 28672 ----a-w- c:\windows\SysWow64\dnscacheugc.exe
    2011-07-03 00:54 . 2011-01-17 11:09 197120 ----a-w- c:\windows\system32\d3d10_1.dll
    2011-07-03 00:54 . 2011-01-17 05:47 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
    2011-07-03 00:54 . 2010-11-20 13:26 321024 ----a-w- c:\windows\system32\d3d10_1core.dll
    2011-07-03 00:54 . 2010-11-20 12:18 219136 ----a-w- c:\windows\SysWow64\d3d10_1core.dll
    2011-07-03 00:54 . 2011-04-29 03:06 467456 ----a-w- c:\windows\system32\drivers\srv.sys
    2011-07-03 00:54 . 2011-04-29 03:05 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
    2011-07-03 00:54 . 2011-04-29 03:05 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2011-07-03 00:53 . 2011-07-03 00:54 -------- d-----w- c:\windows\Show Desktop
    2011-07-03 00:53 . 2011-02-05 17:10 642944 ----a-w- c:\windows\system32\winload.efi
    2011-07-03 00:53 . 2011-02-05 17:10 20352 ----a-w- c:\windows\system32\kdusb.dll
    2011-07-03 00:53 . 2011-02-05 17:10 19328 ----a-w- c:\windows\system32\kd1394.dll
    2011-07-03 00:53 . 2011-02-05 17:10 17792 ----a-w- c:\windows\system32\kdcom.dll
    2011-07-03 00:53 . 2011-02-05 17:06 605552 ----a-w- c:\windows\system32\winload.exe
    2011-07-03 00:53 . 2011-02-05 17:06 566208 ----a-w- c:\windows\system32\winresume.efi
    2011-07-03 00:53 . 2011-02-05 17:06 518672 ----a-w- c:\windows\system32\winresume.exe
    2011-07-03 00:53 . 2010-11-20 13:27 63488 ----a-w- c:\windows\system32\setbcdlocale.dll
    2011-07-03 00:52 . 2011-02-25 06:22 861696 ----a-w- c:\windows\system32\oleaut32.dll
    2011-07-03 00:52 . 2011-02-25 05:34 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
    2011-07-03 00:51 . 2011-02-18 10:51 31232 ----a-w- c:\windows\system32\prevhost.exe
    2011-07-03 00:51 . 2011-02-18 05:39 31232 ----a-w- c:\windows\SysWow64\prevhost.exe
    2011-07-03 00:51 . 2011-02-12 11:34 267776 ----a-w- c:\windows\system32\FXSCOVER.exe
    2011-07-03 00:51 . 2010-11-20 13:25 974336 ----a-w- c:\windows\system32\WFS.exe
    2011-07-03 00:51 . 2011-05-03 05:29 976896 ----a-w- c:\windows\system32\inetcomm.dll
    2011-07-03 00:51 . 2011-05-03 04:30 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
    2011-07-03 00:51 . 2011-02-23 04:55 90624 ----a-w- c:\windows\system32\drivers\bowser.sys
    2011-07-02 20:28 . 2011-07-02 20:28 -------- d-----w- c:\program files\ATI Technologies
    2011-07-02 20:28 . 2011-07-02 20:28 -------- d-----w- c:\program files\ATI
    2011-07-02 20:27 . 2011-07-02 20:27 -------- d-----w- C:\ATI
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-07-05 17:53 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
    2011-07-05 17:53 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
    2011-06-02 17:53 . 2011-06-02 17:53 94208 ----a-w- c:\windows\SysWow64\dpl100.dll
    2011-05-25 06:44 . 2011-05-25 06:44 61952 ----a-w- c:\windows\system32\OVDecode64.dll
    2011-05-25 06:44 . 2011-05-25 06:44 59904 ----a-w- c:\windows\SysWow64\OVDecode.dll
    2011-05-25 06:44 . 2011-05-25 06:44 53760 ----a-w- c:\windows\system32\OpenCL.dll
    2011-05-25 06:44 . 2011-05-25 06:44 51712 ----a-w- c:\windows\SysWow64\OpenCL.dll
    2011-05-25 06:44 . 2011-05-25 06:44 16672768 ----a-w- c:\windows\system32\amdocl64.dll
    2011-05-25 06:43 . 2011-05-25 06:43 12798976 ----a-w- c:\windows\SysWow64\amdocl.dll
    2011-05-25 03:02 . 2011-05-25 03:02 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll
    2011-05-25 02:19 . 2011-05-25 02:19 58880 ----a-w- c:\windows\system32\coinst.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\prxtbuTor.dll" [2011-03-28 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2011-03-28 16:22 176936 ----a-w- c:\program files (x86)\ConduitEngine\prxConduitEngin.dll
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{A057A204-BACC-4D26-8287-79A187E26987}]
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
    2011-03-28 16:22 176936 ----a-w- c:\program files (x86)\uTorrentBar\prxtbuTor.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
    "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\prxtbuTor.dll" [2011-03-28 176936]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\prxConduitEngin.dll" [2011-03-28 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
    .
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Messenger (Yahoo!)"="c:\progra~2\Yahoo!\Messenger\YahooMessenger.exe" [2011-06-16 6276408]
    "SpybotSD TeaTimer"="e:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux1"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R3 AtiDCM;AtiDCM;c:\users\Rebecca\AppData\Local\Temp\atdcm64a.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    S1 SASDIFSV;SASDIFSV;e:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
    S1 SASKUTIL;SASKUTIL;e:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
    S2 !SASCORE;SAS Core Service;e:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-05-04 128384]
    S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
    S2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-03 136176]
    S2 SBSDWSCService;SBSD Security Center Service;e:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
    S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
    2010-11-20 12:17 302592 ----a-w- c:\windows\System32\cmd.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-03 18:43]
    .
    2011-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-03 18:43]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-14 11465832]
    "CanonMyPrinter"="e:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-10-19 2185032]
    "CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://www.yahoo.com/
    mLocal Page = c:\windows\SysWOW64\blank.htm
    TCP: DhcpNameServer = 192.168.0.1
    FF - ProfilePath - c:\users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\rneyt111.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Wow6432Node-HKLM-Run-StartCCC - c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
    WebBrowser-{A057A204-BACC-4D26-8287-79A187E26987} - (no file)
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
    .
    **************************************************************************
    .
    Completion time: 2011-07-10 12:53:11 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-07-10 19:53
    .
    Pre-Run: 76,282,519,552 bytes free
    Post-Run: 76,871,770,112 bytes free
    .
    - - End Of File - - C30938A6D3C88A61B05408EAC4FD32BC
     
  9. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Looks good :)

    Any current issues?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  10. Lashire

    Lashire TS Rookie Topic Starter Posts: 26

    I haven't seen any problems thus far. Seems to be working well. Thank you very much for your help so far. I really appreciate you taking the time to assist me.

    OTL logfile created on: 7/10/2011 1:34:18 PM - Run 1
    OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\Rebecca\Desktop
    64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.7601.17514)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 74.94% Memory free
    8.00 Gb Paging File | 6.97 Gb Available in Paging File | 87.19% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = E:\Program Files (x86)
    Drive C: | 100.00 Gb Total Space | 71.52 Gb Free Space | 71.52% Space Free | Partition Type: NTFS
    Drive D: | 179.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
    Drive E: | 831.51 Gb Total Space | 828.31 Gb Free Space | 99.61% Space Free | Partition Type: NTFS

    Computer Name: REBECCA-PC | User Name: Rebecca | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/07/10 13:33:01 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Rebecca\Desktop\OTL.exe
    PRC - [2011/06/15 21:17:34 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    PRC - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- E:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
    PRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- E:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
    PRC - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe


    ========== Modules (SafeList) ==========

    MOD - [2011/07/10 13:33:01 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Rebecca\Desktop\OTL.exe
    MOD - [2010/11/20 04:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV:64bit: - [2011/05/04 10:55:09 | 000,128,384 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- E:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
    SRV - [2011/06/06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
    SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
    SRV - [2009/07/13 18:39:56 | 001,525,248 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
    SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
    SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- E:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
    SRV - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)


    ========== Driver Services (SafeList) ==========

    DRV:64bit: - [2011/03/30 11:46:44 | 000,114,704 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
    DRV:64bit: - [2010/11/20 06:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
    DRV:64bit: - [2010/11/20 06:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
    DRV:64bit: - [2010/11/20 06:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
    DRV:64bit: - [2010/11/20 04:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
    DRV:64bit: - [2010/06/23 02:10:56 | 000,344,680 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
    DRV:64bit: - [2010/02/18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
    DRV:64bit: - [2010/02/17 11:23:05 | 000,014,920 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- E:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
    DRV:64bit: - [2010/02/17 11:23:05 | 000,012,360 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- E:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
    DRV:64bit: - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
    DRV:64bit: - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
    DRV:64bit: - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
    DRV:64bit: - [2009/06/10 13:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
    DRV:64bit: - [2009/06/10 13:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
    DRV:64bit: - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
    DRV:64bit: - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
    DRV:64bit: - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
    DRV:64bit: - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    IE - HKLM\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)


    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    IE - HKU\S-1-5-21-849264207-2294895563-1624251219-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    IE - HKU\S-1-5-21-849264207-2294895563-1624251219-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
    IE - HKU\S-1-5-21-849264207-2294895563-1624251219-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 EC 59 41 EE 38 CC 01 [binary data]
    IE - HKU\S-1-5-21-849264207-2294895563-1624251219-1000\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
    IE - HKU\S-1-5-21-849264207-2294895563-1624251219-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com"


    FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: E:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: E:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Rebecca\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011/07/04 23:32:34 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/07/02 12:38:53 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/07/06 11:44:20 | 000,000,000 | ---D | M]

    [2011/07/02 12:43:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rebecca\AppData\Roaming\Mozilla\Extensions
    [2011/07/05 13:03:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\rneyt111.default\extensions
    [2011/07/02 12:54:33 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\rneyt111.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
    [2011/07/03 11:55:09 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\rneyt111.default\extensions\engine@conduit.com
    File not found (No name found) --
    [2011/07/06 11:44:22 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

    O1 HOSTS File: ([2011/07/10 12:50:40 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll (Conduit Ltd.)
    O2 - BHO: (no name) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No CLSID value found.
    O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
    O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O2 - BHO: (VMN Toolbar) - {A057A204-BACC-4D26-8287-79A187E26987} - C:\Program Files (x86)\vmntoolbar\vmntoolbar.dll (Visicom Media Inc. )
    O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
    O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
    O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll (Conduit Ltd.)
    O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
    O3 - HKLM\..\Toolbar: (VMN Toolbar) - {A057A204-BACC-4D26-8287-79A187E26987} - C:\Program Files (x86)\vmntoolbar\vmntoolbar.dll (Visicom Media Inc. )
    O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
    O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    O3 - HKU\S-1-5-21-849264207-2294895563-1624251219-1000\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
    O3 - HKU\S-1-5-21-849264207-2294895563-1624251219-1000\..\Toolbar\WebBrowser: (VMN Toolbar) - {A057A204-BACC-4D26-8287-79A187E26987} - C:\Program Files (x86)\vmntoolbar\vmntoolbar.dll (Visicom Media Inc. )
    O3 - HKU\S-1-5-21-849264207-2294895563-1624251219-1000\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
    O4:64bit: - HKLM..\Run: [CanonMyPrinter] E:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
    O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
    O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
    O4 - HKU\S-1-5-21-849264207-2294895563-1624251219-1000..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
    O4 - HKU\S-1-5-21-849264207-2294895563-1624251219-1000..\Run: [SpybotSD TeaTimer] E:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-849264207-2294895563-1624251219-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-849264207-2294895563-1624251219-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
    O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2008/11/13 09:20:10 | 000,000,170 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35:64bit: - HKLM\..comfile [open] -- "%1" %*
    O35:64bit: - HKLM\..exefile [open] -- "%1" %*
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*


    Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
    Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
    Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/07/10 13:33:12 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Users\Rebecca\Desktop\OTL.exe
    [2011/07/10 12:58:50 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2011/07/10 12:53:13 | 000,000,000 | ---D | C] -- C:\Windows\temp
    [2011/07/10 12:44:09 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2011/07/10 12:44:09 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2011/07/10 12:44:09 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2011/07/10 12:44:06 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2011/07/10 12:44:03 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/07/10 12:41:47 | 004,138,980 | R--- | C] (Swearware) -- C:\Users\Rebecca\Desktop\ComboFix.exe
    [2011/07/10 12:40:53 | 001,925,512 | ---- | C] (AVAST Software) -- C:\Users\Rebecca\Desktop\aswMBR.exe
    [2011/07/09 11:45:01 | 000,000,000 | ---D | C] -- C:\Windows\pss
    [2011/07/09 11:19:53 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\SUPERAntiSpyware.com
    [2011/07/09 11:19:53 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
    [2011/07/09 11:19:50 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
    [2011/07/09 11:19:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
    [2011/07/09 11:19:48 | 000,000,000 | ---D | C] -- E:\Program Files\SUPERAntiSpyware
    [2011/07/08 19:30:36 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\SystemRequirementsLab
    [2011/07/08 15:06:10 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\[text] - A Summer Story
    [2011/07/08 15:02:51 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\sakevisual
    [2011/07/08 15:02:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\sakevisual
    [2011/07/08 15:02:50 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Ripples
    [2011/07/08 12:30:07 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\WinRAR
    [2011/07/08 12:30:07 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
    [2011/07/08 12:30:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
    [2011/07/08 12:29:58 | 000,000,000 | ---D | C] -- E:\Program Files\WinRAR
    [2011/07/06 16:54:37 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\RenPy
    [2011/07/06 11:47:18 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\OpenOffice.org
    [2011/07/06 11:46:24 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\OpenOffice.org 3
    [2011/07/06 11:45:45 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
    [2011/07/06 11:44:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
    [2011/07/06 11:44:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
    [2011/07/05 11:09:24 | 000,000,000 | ---D | C] -- E:\Program Files\Windows Sidebar
    [2011/07/05 11:09:24 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Windows Sidebar
    [2011/07/05 11:09:24 | 000,000,000 | ---D | C] -- E:\Program Files\Windows Portable Devices
    [2011/07/05 11:09:24 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Windows Portable Devices
    [2011/07/05 11:09:24 | 000,000,000 | ---D | C] -- E:\Program Files\Windows Photo Viewer
    [2011/07/05 11:09:24 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Windows Photo Viewer
    [2011/07/05 11:09:24 | 000,000,000 | ---D | C] -- E:\Program Files\Windows Journal
    [2011/07/05 11:09:24 | 000,000,000 | ---D | C] -- E:\Program Files\Windows Defender
    [2011/07/05 11:09:24 | 000,000,000 | ---D | C] -- E:\Program Files\Microsoft Games
    [2011/07/05 11:09:24 | 000,000,000 | ---D | C] -- E:\Program Files\DVD Maker
    [2011/07/05 10:47:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
    [2011/07/05 10:46:37 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
    [2011/07/04 23:33:14 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Local\DDMSettings
    [2011/07/04 22:49:18 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\DivX
    [2011/07/04 22:48:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine
    [2011/07/04 22:48:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus
    [2011/07/04 22:48:42 | 000,000,000 | ---D | C] -- E:\Program Files\DivX
    [2011/07/04 22:48:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DivX Shared
    [2011/07/04 22:47:30 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX
    [2011/07/04 16:02:12 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AceFTP 3 Freeware
    [2011/07/04 16:02:11 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Visicom Media
    [2011/07/04 16:01:03 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Sites
    [2011/07/04 16:01:03 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\SiteClasses
    [2011/07/04 16:01:03 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Dynamic
    [2011/07/04 16:00:58 | 000,000,000 | ---D | C] -- C:\ProgramData\EmailNotifier
    [2011/07/04 16:00:57 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\vmntoolbar
    [2011/07/04 16:00:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AceFTP 3 Freeware
    [2011/07/03 13:30:15 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\Desktop\Beck's Stories
    [2011/07/03 13:12:06 | 000,116,224 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysNative\fms.dll
    [2011/07/03 13:11:42 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysWow64\fms.dll
    [2011/07/03 12:41:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP250 series User Registration
    [2011/07/03 12:41:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\CANON
    [2011/07/03 12:40:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
    [2011/07/03 12:40:41 | 000,000,000 | ---D | C] -- E:\Program Files\Canon
    [2011/07/03 12:40:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP250 series Manual
    [2011/07/03 12:40:07 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonBJ
    [2011/07/03 12:40:04 | 000,000,000 | -H-D | C] -- C:\Windows\SysNative\CanonIJ Uninstaller Information
    [2011/07/03 12:40:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP250 series
    [2011/07/03 12:39:39 | 000,000,000 | -H-D | C] -- E:\Program Files\CanonBJ
    [2011/07/03 12:31:22 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Local\Adobe
    [2011/07/03 12:30:40 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Adobe
    [2011/07/03 12:30:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
    [2011/07/03 12:30:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
    [2011/07/03 11:55:08 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Local\Conduit
    [2011/07/03 11:55:05 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\uTorrent
    [2011/07/03 11:54:24 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\uTorrent
    [2011/07/03 11:54:24 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Local\uTorrent
    [2011/07/03 11:49:34 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Malwarebytes
    [2011/07/03 11:48:54 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    [2011/07/03 11:48:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/07/03 11:48:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2011/07/03 11:48:51 | 000,025,912 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
    [2011/07/03 11:48:51 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Malwarebytes' Anti-Malware
    [2011/07/03 11:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
    [2011/07/03 11:47:26 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Spybot - Search & Destroy
    [2011/07/03 11:47:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
    [2011/07/03 11:43:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
    [2011/07/03 11:43:16 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Local\Google
    [2011/07/03 11:43:10 | 000,253,888 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
    [2011/07/03 11:42:29 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
    [2011/07/03 10:33:18 | 000,000,000 | ---D | C] -- E:\Program Files\Windows NT
    [2011/07/03 10:33:18 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Windows NT
    [2011/07/03 10:33:15 | 000,000,000 | ---D | C] -- E:\Program Files\Internet Explorer
    [2011/07/03 10:33:15 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Internet Explorer
    [2011/07/03 10:33:10 | 000,000,000 | ---D | C] -- E:\Program Files\Reference Assemblies
    [2011/07/03 10:33:10 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Reference Assemblies
    [2011/07/03 10:33:09 | 000,000,000 | ---D | C] -- E:\Program Files\Windows Mail
    [2011/07/03 10:33:09 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Windows Mail
    [2011/07/03 10:33:09 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
    [2011/07/03 10:33:09 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat
    [2011/07/03 10:33:07 | 000,000,000 | ---D | C] -- E:\Program Files\Windows Media Player
    [2011/07/03 10:33:07 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Windows Media Player
    [2011/07/02 17:53:56 | 000,000,000 | ---D | C] -- C:\Windows\Show Desktop
    [2011/07/02 15:30:24 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Desktop\Games
    [2011/07/02 15:30:16 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Desktop\Programs
    [2011/07/02 13:27:45 | 000,000,000 | ---D | C] -- C:\ATI
    [2011/07/02 13:22:16 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Phyxion.net
    [2011/07/02 12:59:45 | 000,000,000 | ---D | C] -- C:\Boot
    [2011/07/02 12:57:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
    [2011/07/02 12:57:08 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
    [2011/07/02 12:46:28 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Macromedia
    [2011/07/02 12:46:28 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Adobe
    [2011/07/02 12:46:18 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Local\Yahoo!
    [2011/07/02 12:46:18 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserPlus
    [2011/07/02 12:46:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo! Companion
    [2011/07/02 12:46:08 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Yahoo!
    [2011/07/02 12:46:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
    [2011/07/02 12:46:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger
    [2011/07/02 12:46:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo!
    [2011/07/02 12:45:39 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
    [2011/07/02 12:43:09 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Mozilla
    [2011/07/02 12:43:09 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Local\Mozilla
    [2011/07/02 12:29:15 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
    [2011/07/02 12:29:04 | 002,601,816 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll
    [2011/07/02 12:29:03 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
    [2011/07/02 12:29:03 | 000,220,496 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysNative\SFNHK64.dll
    [2011/07/02 12:29:03 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
    [2011/07/02 12:29:03 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
    [2011/07/02 12:29:03 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
    [2011/07/02 12:29:03 | 000,081,232 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysNative\SFCOM64.dll
    [2011/07/02 12:29:03 | 000,078,160 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysNative\SFAPO64.dll
    [2011/07/02 12:29:03 | 000,074,064 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysWow64\SFCOM.dll
    [2011/07/02 12:29:00 | 000,372,936 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
    [2011/07/02 12:29:00 | 000,307,920 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
    [2011/07/02 12:29:00 | 000,201,928 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
    [2011/07/02 12:29:00 | 000,099,016 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
    [2011/07/02 12:29:00 | 000,076,488 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
    [2011/07/02 12:28:59 | 000,307,920 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
    [2011/07/02 12:28:58 | 000,334,680 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVolumeSDAPO.dll
    [2011/07/02 12:28:57 | 002,197,264 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll
    [2011/07/02 12:28:57 | 001,756,160 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek.dll
    [2011/07/02 12:28:57 | 000,334,848 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO30.dll
    [2011/07/02 12:28:57 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
    [2011/07/02 12:28:55 | 000,338,336 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
    [2011/07/02 12:28:54 | 001,325,328 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2SpeakerDLL64.dll
    [2011/07/02 12:28:54 | 001,178,384 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2HeadphoneDLL64.dll
    [2011/07/02 12:28:54 | 000,489,744 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSSymmetryDLL64.dll
    [2011/07/02 12:28:54 | 000,474,896 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSVoiceClarityDLL64.dll
    [2011/07/02 12:28:54 | 000,315,152 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSNeoPCDLL64.dll
    [2011/07/02 12:28:54 | 000,268,560 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLimiterDLL64.dll
    [2011/07/02 12:28:54 | 000,124,128 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLFXAPO64.dll
    [2011/07/02 12:28:53 | 001,110,800 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBoostDLL64.dll
    [2011/07/02 12:28:53 | 000,504,592 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBassEnhancementDLL64.dll
    [2011/07/02 12:28:53 | 000,265,488 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGainCompensatorDLL64.dll
    [2011/07/02 12:28:53 | 000,124,128 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPO64.dll
    [2011/07/02 12:28:53 | 000,123,104 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPONS64.dll
    [2011/07/02 12:28:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
    [2011/07/02 12:26:54 | 000,344,680 | ---- | C] (Realtek ) -- C:\Windows\SysNative\drivers\Rt64win7.sys
    [2011/07/02 12:10:19 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Local\Diagnostics
    [2011/07/02 12:06:56 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    [2011/07/02 12:06:56 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    [2011/07/02 12:06:55 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Searches
    [2011/07/02 12:06:55 | 000,000,000 | -H-D | C] -- C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
    [2011/07/02 12:06:47 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Identities
    [2011/07/02 12:06:45 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Contacts
    [2011/07/02 12:06:44 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Local\VirtualStore
    [2011/07/02 12:06:37 | 000,000,000 | --SD | C] -- C:\Users\Rebecca\AppData\Roaming\Microsoft
    [2011/07/02 12:06:37 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Videos
    [2011/07/02 12:06:37 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Saved Games
    [2011/07/02 12:06:37 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Pictures
    [2011/07/02 12:06:37 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Music
    [2011/07/02 12:06:37 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
    [2011/07/02 12:06:37 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Links
    [2011/07/02 12:06:37 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Favorites
    [2011/07/02 12:06:37 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Downloads
    [2011/07/02 12:06:37 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Documents
    [2011/07/02 12:06:37 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\Desktop
    [2011/07/02 12:06:37 | 000,000,000 | R--D | C] -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\AppData\Local\Temporary Internet Files
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\Templates
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\Start Menu
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\SendTo
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\Recent
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\PrintHood
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\NetHood
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\Documents\My Videos
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\Documents\My Pictures
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\Documents\My Music
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\My Documents
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\Local Settings
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\AppData\Local\History
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\Cookies
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\Application Data
    [2011/07/02 12:06:37 | 000,000,000 | -HSD | C] -- C:\Users\Rebecca\AppData\Local\Application Data
    [2011/07/02 12:06:37 | 000,000,000 | -H-D | C] -- C:\Users\Rebecca\AppData
    [2011/07/02 12:06:37 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Local\Temp
    [2011/07/02 12:06:37 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Local\Microsoft
    [2011/07/02 12:06:37 | 000,000,000 | ---D | C] -- C:\Users\Rebecca\AppData\Roaming\Media Center Programs
    [2011/07/02 12:06:32 | 000,000,000 | ---D | C] -- C:\Recovery
    [2011/07/02 12:06:30 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
    [2011/07/02 12:00:37 | 000,000,000 | -HSD | C] -- C:\System Volume Information
    [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2011/07/10 13:33:01 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Rebecca\Desktop\OTL.exe
    [2011/07/10 13:05:46 | 000,015,344 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    [2011/07/10 13:05:46 | 000,015,344 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    [2011/07/10 13:02:47 | 000,726,316 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
    [2011/07/10 13:02:47 | 000,623,940 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
    [2011/07/10 13:02:47 | 000,106,316 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
    [2011/07/10 12:58:50 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2011/07/10 12:58:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2011/07/10 12:58:31 | 3220,627,456 | -HS- | M] () -- C:\hiberfil.sys
    [2011/07/10 12:50:40 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
    [2011/07/10 12:48:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2011/07/10 12:43:09 | 000,000,512 | ---- | M] () -- C:\Users\Rebecca\Desktop\MBR.dat
    [2011/07/10 12:40:41 | 004,138,980 | R--- | M] (Swearware) -- C:\Users\Rebecca\Desktop\ComboFix.exe
    [2011/07/10 12:40:37 | 001,925,512 | ---- | M] (AVAST Software) -- C:\Users\Rebecca\Desktop\aswMBR.exe
    [2011/07/09 11:29:52 | 000,002,052 | ---- | M] () -- C:\Windows\epplauncher.mif
    [2011/07/09 11:29:34 | 000,743,066 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
    [2011/07/07 18:35:25 | 000,010,675 | ---- | M] () -- C:\Users\Rebecca\Desktop\Grocery List.odt
    [2011/07/07 11:40:23 | 000,006,538 | ---- | M] () -- C:\Users\Rebecca\Desktop\ava.jpg
    [2011/07/07 11:36:33 | 000,015,114 | ---- | M] () -- C:\Users\Rebecca\Desktop\avatar_1.gif
    [2011/07/06 15:04:10 | 000,292,728 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
    [2011/07/05 15:23:53 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
    [2011/07/05 11:22:40 | 000,001,291 | ---- | M] () -- C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2011/07/04 16:04:43 | 000,011,776 | ---- | M] () -- C:\Users\Rebecca\AppData\Roaming\Settings.cfg
    [2011/07/04 04:43:42 | 000,253,888 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
    [2011/07/03 11:00:31 | 000,001,170 | ---- | M] () -- C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
    [2011/07/03 10:38:32 | 000,001,167 | ---- | M] () -- C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011/07/02 17:51:41 | 000,000,077 | ---- | M] () -- C:\Users\Rebecca\Documents\Show desktop.scf
    [2011/07/02 12:59:47 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
    [2011/07/02 12:52:26 | 000,000,994 | ---- | M] () -- C:\Users\Rebecca\Desktop\Downloads - Shortcut.lnk
    [2011/07/02 12:02:39 | 000,041,962 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
    [2011/07/02 12:02:39 | 000,041,962 | ---- | M] () -- C:\Windows\SysNative\license.rtf
    [2011/06/25 23:45:56 | 000,256,000 | ---- | M] () -- C:\Windows\PEV.exe
    [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011/07/10 12:44:09 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2011/07/10 12:44:09 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2011/07/10 12:44:09 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2011/07/10 12:44:09 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2011/07/10 12:44:09 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2011/07/10 12:43:09 | 000,000,512 | ---- | C] () -- C:\Users\Rebecca\Desktop\MBR.dat
    [2011/07/09 11:29:52 | 000,002,052 | ---- | C] () -- C:\Windows\epplauncher.mif
    [2011/07/09 11:29:34 | 000,743,066 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
    [2011/07/07 13:48:01 | 000,010,675 | ---- | C] () -- C:\Users\Rebecca\Desktop\Grocery List.odt
    [2011/07/07 11:39:46 | 000,006,538 | ---- | C] () -- C:\Users\Rebecca\Desktop\ava.jpg
    [2011/07/07 11:36:32 | 000,015,114 | ---- | C] () -- C:\Users\Rebecca\Desktop\avatar_1.gif
    [2011/07/04 16:01:03 | 000,011,776 | ---- | C] () -- C:\Users\Rebecca\AppData\Roaming\Settings.cfg
    [2011/07/03 13:12:59 | 000,347,904 | ---- | C] () -- C:\Windows\SysNative\systemsf.ebd
    [2011/07/03 13:11:20 | 000,010,429 | ---- | C] () -- C:\Windows\SysNative\ScavengeSpace.xml
    [2011/07/03 13:10:52 | 000,105,559 | ---- | C] () -- C:\Windows\SysWow64\RacRules.xml
    [2011/07/03 13:10:52 | 000,105,559 | ---- | C] () -- C:\Windows\SysNative\RacRules.xml
    [2011/07/03 13:10:41 | 000,001,041 | ---- | C] () -- C:\Windows\SysWow64\tcpbidi.xml
    [2011/07/03 12:30:45 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
    [2011/07/03 11:43:21 | 000,000,900 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2011/07/03 11:43:19 | 000,000,896 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2011/07/03 11:43:10 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
    [2011/07/02 18:08:00 | 000,001,167 | ---- | C] () -- C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
    [2011/07/02 17:51:41 | 000,000,077 | ---- | C] () -- C:\Users\Rebecca\Documents\Show desktop.scf
    [2011/07/02 12:59:47 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK
    [2011/07/02 12:59:45 | 000,383,786 | RHS- | C] () -- C:\bootmgr
    [2011/07/02 12:52:29 | 000,000,994 | ---- | C] () -- C:\Users\Rebecca\Desktop\Downloads - Shortcut.lnk
    [2011/07/02 12:46:02 | 000,001,170 | ---- | C] () -- C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
    [2011/07/02 12:38:53 | 000,001,155 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    [2011/07/02 12:26:54 | 000,074,272 | ---- | C] () -- C:\Windows\SysNative\RtNicProp64.dll
    [2011/07/02 12:09:39 | 000,001,291 | ---- | C] () -- C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2011/07/02 12:07:44 | 000,001,309 | ---- | C] () -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
    [2011/07/02 12:07:41 | 000,001,291 | ---- | C] () -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    [2011/07/02 12:06:37 | 000,000,290 | ---- | C] () -- C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
    [2011/07/02 12:00:37 | 3220,627,456 | -HS- | C] () -- C:\hiberfil.sys
    [2011/05/24 23:44:26 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
    [2009/07/13 22:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
    [2009/07/13 19:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
    [2009/07/13 19:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
    [2009/07/13 17:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
    [2009/07/13 16:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
    [2009/07/13 14:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
    [2009/06/10 14:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

    ========== LOP Check ==========

    [2011/07/04 16:01:03 | 000,000,000 | ---D | M] -- C:\Users\Rebecca\AppData\Roaming\Dynamic
    [2011/07/06 11:47:18 | 000,000,000 | ---D | M] -- C:\Users\Rebecca\AppData\Roaming\OpenOffice.org
    [2011/07/08 17:45:14 | 000,000,000 | ---D | M] -- C:\Users\Rebecca\AppData\Roaming\RenPy
    [2011/07/04 16:04:43 | 000,000,000 | ---D | M] -- C:\Users\Rebecca\AppData\Roaming\SiteClasses
    [2011/07/04 16:01:03 | 000,000,000 | ---D | M] -- C:\Users\Rebecca\AppData\Roaming\Sites
    [2011/07/08 19:30:36 | 000,000,000 | ---D | M] -- C:\Users\Rebecca\AppData\Roaming\SystemRequirementsLab
    [2011/07/08 15:02:32 | 000,000,000 | ---D | M] -- C:\Users\Rebecca\AppData\Roaming\uTorrent
    [2011/07/04 16:00:57 | 000,000,000 | ---D | M] -- C:\Users\Rebecca\AppData\Roaming\vmntoolbar
    [2009/07/13 22:08:49 | 000,009,592 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    Continued in next post.....
     
  11. Lashire

    Lashire TS Rookie Topic Starter Posts: 26

    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2010/11/20 05:40:07 | 000,383,786 | RHS- | M] () -- C:\bootmgr
    [2011/07/02 12:59:47 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
    [2011/07/10 12:53:12 | 000,022,272 | ---- | M] () -- C:\ComboFix.txt
    [2011/07/10 12:58:31 | 3220,627,456 | -HS- | M] () -- C:\hiberfil.sys
    [2011/07/10 12:58:32 | 4294,172,672 | -HS- | M] () -- C:\pagefile.sys
    [2011/07/09 15:13:22 | 000,062,650 | ---- | M] () -- C:\TDSSKiller.2.5.9.0_09.07.2011_15.06.41_log.txt

    < %systemroot%\Fonts\*.com >
    [2009/07/13 22:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
    [2009/07/13 22:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
    [2009/07/13 22:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
    [2009/07/13 22:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2009/06/10 13:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2011/07/05 11:22:40 | 000,000,221 | -HS- | M] () -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >
    [2011/07/10 12:40:37 | 001,925,512 | ---- | M] (AVAST Software) -- C:\Users\Rebecca\Desktop\aswMBR.exe
    [2011/07/10 12:40:41 | 004,138,980 | R--- | M] (Swearware) -- C:\Users\Rebecca\Desktop\ComboFix.exe
    [2011/07/10 13:33:01 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Rebecca\Desktop\OTL.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >
    [2009/06/10 14:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\ADDINS\FXSEXT.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >
    [2011/07/05 11:19:02 | 000,008,192 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.chk
    [2011/07/05 11:19:02 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.log
    [2011/07/02 12:29:17 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00001.jrs
    [2011/07/02 12:29:17 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00002.jrs
    [2011/07/05 11:19:02 | 001,056,768 | ---- | M] () -- C:\Windows\SECURITY\Database\tmp.edb

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2011/07/05 11:22:40 | 000,000,402 | -HS- | M] () -- C:\Users\Rebecca\Favorites\desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < End of report >

    OTL Extras logfile created on: 7/10/2011 1:34:18 PM - Run 1
    OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\Rebecca\Desktop
    64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.7601.17514)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 74.94% Memory free
    8.00 Gb Paging File | 6.97 Gb Available in Paging File | 87.19% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = E:\Program Files (x86)
    Drive C: | 100.00 Gb Total Space | 71.52 Gb Free Space | 71.52% Space Free | Partition Type: NTFS
    Drive D: | 179.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
    Drive E: | 831.51 Gb Total Space | 828.31 Gb Free Space | 99.61% Space Free | Partition Type: NTFS

    Computer Name: REBECCA-PC | User Name: Rebecca | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
    .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
    .html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

    [HKEY_USERS\S-1-5-21-849264207-2294895563-1624251219-1000\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %* File not found
    cmdfile [open] -- "%1" %* File not found
    comfile [open] -- "%1" %* File not found
    exefile [open] -- "%1" %* File not found
    helpfile [open] -- Reg Error: Key error.
    htmlfile [edit] -- Reg Error: Key error.
    htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
    https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
    inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
    InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
    InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %* File not found
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1" File not found
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
    scrfile [open] -- "%1" /S File not found
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Applications\iexplore.exe [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    htmlfile [edit] -- Reg Error: Key error.
    https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Applications\iexplore.exe [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Microsoft Corporation)

    ========== Security Center Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series" = Canon MP250 series MP Drivers
    "{495ADF2E-6DDD-7C45-E02A-F9B4AF6F2175}" = AMD Drag and Drop Transcoding
    "{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
    "{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
    "{51317AF5-D39F-49EC-A4B5-87451466B837}" = AMD Fuel
    "{54E192A6-AA33-1963-C96A-26AA7A3B41B4}" = ccc-utility64
    "{5857E7BE-2F6F-D41A-42B2-B668B19A5F30}" = AMD Media Foundation Decoders
    "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
    "{CFF9D801-1EC4-B8F5-2CAB-4A1790C95A18}" = ATI Catalyst Install Manager
    "{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
    "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "WinRAR archiver" = WinRAR 4.01 (64-bit)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "[text] - A Summer Story" = [text] - A Summer Story 1.01
    "{19A492A0-888F-44A0-9B21-D91700763F62}" = Catalyst Control Center - Branding
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
    "{30D659E4-4405-6925-CDCF-EB8CD0C80DAC}" = Catalyst Control Center Graphics Previews Common
    "{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
    "{60DE7978-4F13-5584-5E53-DCEE1CB115A5}" = AMD VISION Engine Control Center
    "{85268C72-C609-E50A-7AB3-9B3582DFEE66}" = CCC Help English
    "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
    "{92482FB3-C05B-41C6-89E7-75D985602A6E}" = System Requirements Lab
    "{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
    "{AFF8C8F4-E4BB-891F-8636-5E71F946C5B6}" = Catalyst Control Center InstallProxy
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "AceFTP 3 Freeware" = AceFTP 3 Freeware
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "CA_VMN_antispyware" = CA VMN Anti-Spyware (remove only)
    "Canon MP250 series User Registration" = Canon MP250 series User Registration
    "CanonMyPrinter" = Canon Utilities My Printer
    "CanonSolutionMenu" = Canon Utilities Solution Menu
    "conduitEngine" = Conduit Engine
    "DivX Setup.divx.com" = DivX Setup
    "Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
    "Easy-WebPrint EX" = Canon Easy-WebPrint EX
    "Google Chrome" = Google Chrome
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
    "Mozilla Firefox 5.0 (x86 en-US)" = Mozilla Firefox 5.0 (x86 en-US)
    "MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
    "Ripples" = Ripples 1
    "uTorrent" = ĀµTorrent
    "uTorrentBar Toolbar" = uTorrentBar Toolbar
    "vmntoolbar" = VMN Toolbar
    "Yahoo! Companion" = Yahoo! Toolbar
    "Yahoo! Messenger" = Yahoo! Messenger
    "Yahoo! Software Update" = Yahoo! Software Update

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-849264207-2294895563-1624251219-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 7/8/2011 10:38:42 AM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-CAPI2 | ID = 513
    Description = Cryptographic Services failed while processing the OnIdentity() call
    in the System Writer Object. Details: AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path()
    failed. System Error: 0xC0000039 (unresolvable).

    Error - 7/8/2011 10:38:42 AM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-CAPI2 | ID = 513
    Description = Cryptographic Services failed while processing the OnIdentity() call
    in the System Writer Object. Details: AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path()
    failed. System Error: 0xC0000039 (unresolvable).

    Error - 7/8/2011 10:03:22 PM | Computer Name = Rebecca-PC | Source = SideBySide | ID = 16842815
    Description = Activation context generation failed for "e:\program files (x86)\spybot
    - search & destroy\DelZip179.dll".Error in manifest or policy file "e:\program
    files (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" of
    attribute "language" in element "assemblyIdentity" is invalid.

    Error - 7/9/2011 5:38:59 AM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-CAPI2 | ID = 513
    Description = Cryptographic Services failed while processing the OnIdentity() call
    in the System Writer Object. Details: AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path()
    failed. System Error: 0xC0000039 (unresolvable).

    Error - 7/9/2011 5:38:59 AM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-CAPI2 | ID = 513
    Description = Cryptographic Services failed while processing the OnIdentity() call
    in the System Writer Object. Details: AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path()
    failed. System Error: 0xC0000039 (unresolvable).

    Error - 7/9/2011 8:27:41 AM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-CAPI2 | ID = 513
    Description = Cryptographic Services failed while processing the OnIdentity() call
    in the System Writer Object. Details: AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path()
    failed. System Error: 0xC0000039 (unresolvable).

    Error - 7/9/2011 8:27:41 AM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-CAPI2 | ID = 513
    Description = Cryptographic Services failed while processing the OnIdentity() call
    in the System Writer Object. Details: AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path()
    failed. System Error: 0xC0000039 (unresolvable).

    Error - 7/9/2011 2:29:52 PM | Computer Name = Rebecca-PC | Source = Microsoft Security Client Setup | ID = 100
    Description = HRESULT:0x8004FF0A Description:Microsoft Security Essentials installation
    was canceled. You canceled the Security Essentials installation on your computer.
    Error code:0x8004FF0A.

    Error - 7/9/2011 3:03:40 PM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-CAPI2 | ID = 513
    Description = Cryptographic Services failed while processing the OnIdentity() call
    in the System Writer Object. Details: AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path()
    failed. System Error: 0xC0000039 (unresolvable).

    Error - 7/9/2011 3:03:40 PM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-CAPI2 | ID = 513
    Description = Cryptographic Services failed while processing the OnIdentity() call
    in the System Writer Object. Details: AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path()
    failed. System Error: 0xC0000039 (unresolvable).

    [ System Events ]
    Error - 7/8/2011 2:17:49 PM | Computer Name = Rebecca-PC | Source = Service Control Manager | ID = 7000
    Description = The AMD FUEL Service service failed to start due to the following
    error: %%2

    Error - 7/9/2011 5:39:09 AM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
    Description = Installation Failure: Windows failed to install the following update
    with error 0x80070103: ATI Technologies Inc. - Display - ATI Radeon HD 5670.

    Error - 7/9/2011 8:24:17 AM | Computer Name = Rebecca-PC | Source = Service Control Manager | ID = 7000
    Description = The AMD FUEL Service service failed to start due to the following
    error: %%2

    Error - 7/9/2011 8:27:58 AM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
    Description = Installation Failure: Windows failed to install the following update
    with error 0x80070103: ATI Technologies Inc. - Display - ATI Radeon HD 5670.

    Error - 7/9/2011 2:42:24 PM | Computer Name = Rebecca-PC | Source = Service Control Manager | ID = 7000
    Description = The AMD FUEL Service service failed to start due to the following
    error: %%2

    Error - 7/9/2011 3:03:46 PM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
    Description = Installation Failure: Windows failed to install the following update
    with error 0x80070103: ATI Technologies Inc. - Display - ATI Radeon HD 5670.

    Error - 7/9/2011 3:32:39 PM | Computer Name = Rebecca-PC | Source = Service Control Manager | ID = 7000
    Description = The AMD FUEL Service service failed to start due to the following
    error: %%2

    Error - 7/9/2011 3:39:06 PM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
    Description = Installation Failure: Windows failed to install the following update
    with error 0x80070103: ATI Technologies Inc. - Display - ATI Radeon HD 5670.

    Error - 7/9/2011 6:03:49 PM | Computer Name = Rebecca-PC | Source = Service Control Manager | ID = 7000
    Description = The AMD FUEL Service service failed to start due to the following
    error: %%2

    Error - 7/10/2011 4:08:16 AM | Computer Name = Rebecca-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
    Description = Installation Failure: Windows failed to install the following update
    with error 0x80070103: ATI Technologies Inc. - Display - ATI Radeon HD 5670.


    < End of report >
     
  12. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    You're very welcome [​IMG]

    What happened to Avast?

    1. Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    2. Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    ====================================================================

    OTL log looks clean :)

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  13. Lashire

    Lashire TS Rookie Topic Starter Posts: 26

    ESET Online Scanner came back with nothing.

    Results of screen317's Security Check version 0.99.7
    Windows 7 (UAC is enabled)
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Enabled!
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    Java(TM) 6 Update 26
    Out of date Java installed!
    Adobe Flash Player 10.3.181.34
    Adobe Reader X (10.1.0)
    Mozilla Firefox (x86 en-US..) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    ``````````End of Log````````````
     
  14. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. (Windows XP only) Run defrag at your convenience.

    11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    13. Please, let me know, how your computer is doing.
     
  15. Lashire

    Lashire TS Rookie Topic Starter Posts: 26

    Everything is looking good. Thank you for all your help, and all the program recommendations. I really appreciate that you took your time to help me.

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    User: Rebecca
    ->Temp folder emptied: 1334 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 115205509 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 1529 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 110.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default

    User: Default User

    User: Public

    User: Rebecca
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb

    Restore point Set: OTL Restore Point

    OTL by OldTimer - Version 3.2.26.1 log created on 07102011_161000

    Files\Folders moved on Reboot...
    C:\Users\Rebecca\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

    Registry entries deleted on Reboot...
     
  16. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Way to go!! [​IMG]
    Good luck and stay safe :)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...