Inactive Can't get rid of this trojan/hijacker

[Iowabucks]

Hey everyone, i had a trojan hit my computer a couple days ago so i ran Malware Bytes right away and it did find a trojan. Got rid of it and most everything seems better but i still have small problems. I have been over at another malware removal forum and have run many scans and programs for the last few days and it all looks clean to them.

But i still have redirect issues the first couple times i click on links in a Google search. I have random audio coming over my speakers from time to time that is music/ads/commercials. But show no applications running in task manager.
I also recently noticed my email links no longer take me anywhere. It worked earlier today and i haven't changed a thing.

I always run malware/virus scans at least once a month. Probably about 8 different ones. Malware Bytes seems to be about the only one that ever picks up more than cookies. I pride myself on keeping my computer clean.

Can you guys help me out? These little problems are driving me crazy.
Thanks, Jerry.

Windows Vista Ulitmate.

 

[Broni]

Welcome aboard

Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

 

[Iowabucks]

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8244

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

11/25/2011 10:38:02 PM
mbam-log-2011-11-25 (22-38-02).txt

Scan type: Quick scan
Objects scanned: 190463
Time elapsed: 2 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


The gmer log was completely blank. It said it found nothing.


.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Jerry at 23:07:12 on 2011-11-25
Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.1.1033.18.4094.1510 [GMT -6:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Secunia\PSI\sua.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\splwow64.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\System32\mobsync.exe
C:\Users\Jerry\Downloads\8yqrgjxg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\REGSVR32.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.archerytalk.com/vb/forumdisplay.php?f=1
BHO: IEPlugin Class: {11222041-111b-46e3-bd29-efb2449479b1} - C:\PROGRA~2\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
dRun: [CtxfiReg] CTXFIREG.exe /FAIL2
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {38AB0814-B09B-4378-9940-14A19638C3C2} - hxxp://www.auctiva.com/Aurigma/ImageUploader57.cab
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} - hxxp://www.facebook.com/controls/contactx.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} - hxxp://service.futuremark.com/virtualmark/tc/FMSI.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15108/CTPID.cab
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
TCP: DhcpNameServer = 66.207.0.3 66.207.0.2
TCP: Interfaces\{98E5A55E-A998-4205-9578-EB9E15529319} : DhcpNameServer = 66.207.0.3 66.207.0.2
LSA: Authentication Packages = msv1_0 relog_ap
BHO-X64: IEPlugin Class: {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~2\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-6-29 128752]
R2 cpuz133;cpuz133;\??\C:\Windows\system32\drivers\cpuz133_x64.sys --> C:\Windows\system32\drivers\cpuz133_x64.sys [?]
R2 FontCache;Windows Font Cache Service;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe [2011-11-23 123320]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-11-23 2253120]
R2 PCCUJobMgr;Common Client Job Manager Service;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe [2011-11-23 126392]
R2 Secunia Update Agent;Secunia Update Agent;C:\Program Files (x86)\Secunia\PSI\sua.exe [2011-1-10 399416]
R2 SgtSch2Svc;Seagate Scheduler2 Service;C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe [2009-10-16 606048]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-15 381248]
R3 CT20XUT.SYS;CT20XUT.SYS;C:\Windows\system32\drivers\CT20XUT.SYS --> C:\Windows\system32\drivers\CT20XUT.SYS [?]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;C:\Windows\system32\drivers\CTEXFIFX.SYS --> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]
R3 CTHWIUT.SYS;CTHWIUT.SYS;C:\Windows\system32\drivers\CTHWIUT.SYS --> C:\Windows\system32\drivers\CTHWIUT.SYS [?]
R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]
R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]
S2 AODService;AODService;C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe [2010-4-23 136616]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-25 135664]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-5-27 79360]
S3 CT20XUT;CT20XUT;C:\Windows\system32\drivers\CT20XUT.SYS --> C:\Windows\system32\drivers\CT20XUT.SYS [?]
S3 CTEXFIFX;CTEXFIFX;C:\Windows\system32\drivers\CTEXFIFX.SYS --> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]
S3 CTHWIUT;CTHWIUT;C:\Windows\system32\drivers\CTHWIUT.SYS --> C:\Windows\system32\drivers\CTHWIUT.SYS [?]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-25 135664]
S3 GVTDrv64;GVTDrv64;C:\Windows\GVTDrv64.sys [2009-5-27 30528]
S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968]
S3 PSI;PSI;C:\Windows\system32\DRIVERS\psi_mf.sys --> C:\Windows\system32\DRIVERS\psi_mf.sys [?]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;D:\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe --> D:\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe [?]
S3 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\psia.exe [2011-1-10 993848]
S3 U6000ALL;U6000 TV Box(ALL);C:\Windows\system32\DRIVERS\U6000ALL.sys --> C:\Windows\system32\DRIVERS\U6000ALL.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-6-1 89920]
.
=============== File Associations ===============
.
JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*
.
=============== Created Last 30 ================
.
2011-11-25 23:36:18 -------- d-----w- C:\Users\Jerry\AppData\Local\SvchostViewer
2011-11-25 22:53:04 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{516D128D-0084-42B4-A722-359CDA1CB2D3}\offreg.dll
2011-11-25 17:21:14 8570192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{516D128D-0084-42B4-A722-359CDA1CB2D3}\mpengine.dll
2011-11-25 02:32:27 -------- d-----w- C:\Program Files (x86)\ESET
2011-11-24 16:37:53 -------- d-sh--w- C:\found.000
2011-11-24 01:34:05 -------- d-----w- C:\Users\Jerry\AppData\Roaming\Tific
2011-11-24 01:34:05 -------- d-----w- C:\Users\Jerry\AppData\Local\Tific
2011-11-24 01:33:54 -------- d-----w- C:\Windows\System32\drivers\NortonPCCheckupx64\02000C0.01B
2011-11-24 01:33:54 -------- d-----w- C:\Windows\System32\drivers\NortonPCCheckupx64
2011-11-24 01:33:54 -------- d-----w- C:\Program Files (x86)\Norton PC Checkup
2011-11-24 01:33:53 -------- d-----w- C:\ProgramData\Norton
2011-11-24 01:33:51 -------- d-----w- C:\ProgramData\NortonInstaller
2011-11-24 01:33:51 -------- d-----w- C:\Program Files (x86)\NortonInstaller
2011-11-24 01:01:59 837952 ----a-w- C:\Windows\System32\easyupdatusapiu64.dll
2011-11-23 22:58:28 -------- d-----w- C:\ProgramData\UAB
2011-11-23 22:58:21 -------- d-----w- C:\Users\Jerry\AppData\Local\PC_Drivers_Headquarters
2011-11-23 22:58:09 -------- d-----w- C:\ProgramData\PC Drivers HeadQuarters
2011-11-23 22:57:27 -------- d-----w- C:\Program Files (x86)\PC Drivers HeadQuarters
2011-11-23 16:03:11 8570192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-22 22:02:26 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-22 14:10:06 -------- d-----w- C:\_OTL
2011-11-22 01:08:11 917840 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0BE717C9-CEFB-4AAF-9BAA-960F5D56BA9E}\gapaengine.dll
2011-11-22 00:58:36 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client
2011-11-22 00:58:22 -------- d-----w- C:\Program Files\Microsoft Security Client
2011-11-22 00:57:52 345984 ----a-w- C:\Windows\System32\drivers\netio.sys
2011-11-21 19:12:06 -------- d-----w- C:\$RECYCLE.BIN
2011-11-21 14:29:12 98816 ----a-w- C:\Windows\sed.exe
2011-11-21 14:29:12 518144 ----a-w- C:\Windows\SWREG.exe
2011-11-21 14:29:12 256000 ----a-w- C:\Windows\PEV.exe
2011-11-21 14:29:12 208896 ----a-w- C:\Windows\MBR.exe
2011-11-21 14:28:04 -------- d-----w- C:\zzz
2011-11-20 14:19:40 1423744 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2011-11-20 14:19:39 40448 ----a-w- C:\Windows\System32\drivers\tcpipreg.sys
2011-11-20 14:19:36 2409784 ----a-w- C:\Program Files\Windows Mail\OESpamFilter.dat
2011-11-20 14:19:36 2409784 ----a-w- C:\Program Files (x86)\Windows Mail\OESpamFilter.dat
2011-11-20 14:19:23 893440 ----a-w- C:\Program Files\Common Files\System\wab32.dll
2011-11-20 14:19:23 707584 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll
2011-11-20 14:19:23 50688 ----a-w- C:\Program Files\Windows Mail\wabimp.dll
2011-11-18 14:10:16 8570192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{734AD158-5C0D-495C-B042-0D049512EF89}\mpengine.dll
2011-11-01 20:53:24 -------- d-----w- C:\Windows\$regcmp$
.
==================== Find3M ====================
.
2011-11-26 01:42:37 270776 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr
2011-11-26 01:42:37 270776 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe
2011-11-26 01:42:02 111928 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0
2011-10-15 06:54:52 321856 ----a-w- C:\Windows\SysWow64\nvStreaming.exe
2011-10-13 20:29:40 42392 ----a-w- C:\Windows\SysWow64\xfcodec.dll
2011-10-13 20:29:40 28056 ----a-w- C:\Windows\System32\xfcodec64.dll
2011-09-06 13:56:50 2764288 ----a-w- C:\Windows\System32\win32k.sys
2011-09-01 05:24:07 2309120 ----a-w- C:\Windows\System32\jscript9.dll
2011-09-01 05:17:57 1389056 ----a-w- C:\Windows\System32\wininet.dll
2011-09-01 05:12:04 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2011-09-01 02:35:59 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll
2011-09-01 02:28:15 1126912 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-09-01 02:22:54 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-08-31 22:00:50 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys
.
============= FINISH: 23:14:06.65 ===============



.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 5/27/2009 6:49:52 PM
System Uptime: 11/25/2011 4:52:41 PM (7 hours ago)
.
Motherboard: Gigabyte Technology Co., Ltd. | | GA-MA790GP-DS4H
Processor: AMD Phenom(tm) 9950 Quad-Core Processor | Socket M2 | 3013/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 762 GiB total, 631.704 GiB free.
D: is CDROM (UDF)
F: is FIXED (NTFS) - 170 GiB total, 128.375 GiB free.
H: is Removable
I: is Removable
J: is Removable
K: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft 6to4 Adapter
Device ID: ROOT\*6TO4MP\0039
Manufacturer: Microsoft
Name: Microsoft 6to4 Adapter
PNP Device ID: ROOT\*6TO4MP\0039
Service: tunnel
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
3DMark Vantage
3DMark05
3DVIA Shape for Maps
Acrobat.com
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Shockwave Player 11.5
Advanced System Protector
AMD OverDrive
Auslogics Disk Defrag
AV Grabber
Browser Configuration Utility
Call of Duty(R) - World at War(TM)
Call of Duty(R) - World at War(TM) 1.2 Patch
Call of Duty(R) - World at War(TM) 1.4 Patch
Call of Duty(R) - World at War(TM) 1.5 Patch
Call of Duty(R) - World at War(TM) 1.6 Patch
Call of Duty(R) - World at War(TM) 1.7 Patch
Call of Duty(R) 4 - Modern Warfare(TM)
Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch
Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Patch
Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
Call of Duty: Modern Warfare 2
Call of Duty: Modern Warfare 2 - Multiplayer
CCleaner
CDDRV_Installer
Creative Audio Control Panel
Creative Console Launcher
Creative Sound Blaster Properties x64 Edition
Creative System Information
Creative ZEN
Disk Space Fan 2.2.7.820
DMIView B7.0108.01
Download Manager 2.3.10
Driver Detective
Drv
EasyTune5Pro
ERUNT 1.1j
ESET Online Scanner v3
EVEREST Ultimate Edition v5.50
EZ Grabber
Futuremark SystemInfo
GIMP 2.6.8
GoGear VIBE Device Manager
Google Earth
Google Update Helper
HD Tune 2.55
i-Cool
Indeo® software
Malwarebytes' Anti-Malware version 1.51.2.1300
Media Converter for Philips
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2572067)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft Office Excel Viewer 2003
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Word Viewer 2003
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mp3tag v2.44
MSI Afterburner 1.6.0
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Norton PC Checkup
NVIDIA PhysX
NVIDIA Stereoscopic 3D Driver
OpenAL
PandoraRecovery (Remove Only)
PCMark Vantage
Photo-grapher 1
PIXresizer 2.0.4
PunkBuster Services
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek 8169 8168 8101E 8102E Ethernet Driver
RealUpgrade 1.1
Rhapsody
Seagate*DiscWizard
Secunia PSI (2.0.0.3001)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
SmartSound Quicktracks Plugin
Software For Archers
Sony DVD Architect Studio 4.5d
SpeedFan (remove only)
Spybot - Search & Destroy
SpywareBlaster 4.4
Steam
System Requirements Lab
Ulead DVD DiskRecorder 2.1.1
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Vegas Movie Studio Platinum 9.0b
Vista Codec Package
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Visual C++ 8.0 Runtime Setup Package (x64)
WinISD Pro [alpha]
WinRAR archiver
Xfire (remove only)
Z Engine
.
==== Event Viewer Messages From Past Week ========
.
11/25/2011 5:13:59 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume .
11/25/2011 4:54:41 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Beep Lbd SABKUTIL
11/25/2011 4:54:41 PM, Error: Service Control Manager [7000] - The MCSTRM service failed to start due to the following error: The system cannot find the file specified.
11/25/2011 2:24:33 PM, Error: Service Control Manager [7034] - The NVIDIA Stereoscopic 3D Driver Service service terminated unexpectedly. It has done this 1 time(s).
11/25/2011 2:24:33 PM, Error: Service Control Manager [7031] - The Common Client Job Manager Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
11/24/2011 4:19:21 AM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume Vista.
11/24/2011 3:30:11 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
11/22/2011 8:11:36 AM, Error: Service Control Manager [7034] - The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).
11/22/2011 8:02:13 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
11/22/2011 8:02:13 AM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/22/2011 8:02:13 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
11/22/2011 3:09:50 PM, Error: Service Control Manager [7034] - The Creative Audio Service service terminated unexpectedly. It has done this 1 time(s).
11/21/2011 9:08:46 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
11/21/2011 9:05:56 AM, Error: Application Popup [1060] - \??\C:\zzz\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
11/21/2011 7:48:44 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SABKUTIL
11/21/2011 7:02:19 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x8024001e Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/21/2011 7:02:19 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x8024001e Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
11/20/2011 8:08:13 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
11/20/2011 8:03:19 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the NVIDIA Stereoscopic 3D Driver Service service to connect.
11/20/2011 8:03:19 AM, Error: Service Control Manager [7000] - The NVIDIA Stereoscopic 3D Driver Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/20/2011 8:02:40 AM, Error: Microsoft-Windows-Dhcp-Client [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001FD0A14581. The following error occurred: The wait operation timed out.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
11/19/2011 9:42:36 PM, Error: Microsoft-Windows-BitLocker-Driver [24620] - Encrypted volume check: Volume information on K: cannot be read.
11/19/2011 9:42:36 PM, Error: Microsoft-Windows-BitLocker-Driver [24620] - Encrypted volume check: Volume information on J: cannot be read.
11/19/2011 9:42:36 PM, Error: Microsoft-Windows-BitLocker-Driver [24620] - Encrypted volume check: Volume information on I: cannot be read.
11/19/2011 9:42:20 PM, Error: Microsoft-Windows-BitLocker-Driver [24620] - Encrypted volume check: Volume information on H: cannot be read.
11/19/2011 6:35:47 PM, Error: Service Control Manager [7034] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 1 time(s).
11/19/2011 5:56:38 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
11/19/2011 5:56:38 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
11/19/2011 5:56:38 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
11/19/2011 5:56:04 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
11/19/2011 5:56:04 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
11/19/2011 5:56:04 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
11/19/2011 5:56:02 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/19/2011 5:55:53 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AvgLdx64 AvgMfx64 CSC DfsC NetBIOS netbt nsiproxy PSched RasAcd rdbss SABKUTIL SASDIFSV SASKUTIL Smb spldr tdx Wanarpv6
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The Creative Audio Service service depends on the Windows Audio service which failed to start because of the following error: The dependency service or group failed to start.
11/19/2011 5:55:53 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
11/19/2011 5:55:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
.
==== End Of File ===========================

 

[Broni]

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan:


On completion of the scan click "Save log", save it to your desktop and post in your next reply:


NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

=========================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   NOTE1. If Combofix asks you to install Recovery Console, please allow it.
   NOTE 2. If Combofix asks you to update the program, always do so.
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode (How to...)

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

 

[Iowabucks]

The aswMBR crashes my computer every time i run it. When i click scan, i get a BSOD error a couple seconds after that. I tried downloading it again and running it after a reboot, but it does the same thing. I will give the other ones a try.

When Combofix restarted my computer, it came up with this error.
Registry Editor
Cannot export C:/Qoobox/Quarantine/Registry_backups/MSConfigStartup_Reg CleanExportSchedular^Registry:HKCU:Run,Regdad:Error openingthe file. There may be a disk or file system error."

Combofix text :

ComboFix 11-11-26.02 - Jerry 11/26/2011 9:26:02.2.4 - x64
Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.1.1033.18.4094.2606 [GMT -6:00]
Running from: C:\Users\Jerry\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


((((((((((((((((((((((((( Files Created from 2011-10-26 to 2011-11-26 )))))))))))))))))))))))))))))))


2011-11-26 15:57:50 . 2011-11-26 15:57:50 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{315BA19F-5697-4795-82F6-6FC543892207}\offreg.dll
2011-11-26 15:54:57 . 2011-11-26 15:54:57 -------- d-----w- C:\Users\Default\AppData\Local\temp
2011-11-26 06:37:23 . 2011-10-07 03:16:04 8570192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{315BA19F-5697-4795-82F6-6FC543892207}\mpengine.dll
2011-11-25 23:36:18 . 2011-11-25 23:36:18 -------- d-----w- C:\Users\Jerry\AppData\Local\SvchostViewer
2011-11-25 02:32:27 . 2011-11-25 02:32:27 -------- d-----w- C:\Program Files (x86)\ESET
2011-11-24 16:37:53 . 2011-11-24 16:37:53 -------- d-----w- C:\found.000
2011-11-24 01:34:05 . 2011-11-24 01:34:05 -------- d-----w- C:\Users\Jerry\AppData\Roaming\Tific
2011-11-24 01:34:05 . 2011-11-24 01:34:05 -------- d-----w- C:\Users\Jerry\AppData\Local\Tific
2011-11-24 01:33:54 . 2011-11-24 01:33:56 -------- d-----w- C:\Program Files (x86)\Norton PC Checkup
2011-11-24 01:33:54 . 2011-11-24 01:33:54 -------- d-----w- C:\Windows\system32\drivers\NortonPCCheckupx64
2011-11-24 01:33:53 . 2011-11-24 01:33:54 -------- d-----w- C:\ProgramData\Norton
2011-11-24 01:33:51 . 2011-11-24 01:33:51 -------- d-----w- C:\Program Files (x86)\NortonInstaller
2011-11-24 01:02:15 . 2011-11-24 01:02:16 -------- d-----w- C:\Users\UpdatusUser
2011-11-24 01:01:59 . 2011-10-15 08:53:00 837952 ----a-w- C:\Windows\system32\easyupdatusapiu64.dll
2011-11-23 22:58:09 . 2011-11-23 22:58:09 -------- d-----w- C:\ProgramData\PC Drivers HeadQuarters
2011-11-23 16:03:11 . 2011-10-07 03:16:04 8570192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-22 22:02:26 . 2011-11-22 22:02:26 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-22 21:56:23 . 2011-11-22 21:56:23 -------- d-----w- C:\Windows\system32\Macromed
2011-11-22 14:10:06 . 2011-11-22 14:10:06 -------- d-----w- C:\_OTL
2011-11-22 01:08:11 . 2011-11-22 01:07:54 917840 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0BE717C9-CEFB-4AAF-9BAA-960F5D56BA9E}\gapaengine.dll
2011-11-22 00:58:36 . 2011-11-22 00:58:36 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client
2011-11-22 00:58:22 . 2011-11-22 00:58:52 -------- d-----w- C:\Program Files\Microsoft Security Client
2011-11-22 00:57:52 . 2010-04-06 08:34:57 345984 ----a-w- C:\Windows\system32\drivers\netio.sys
2011-11-21 14:28:04 . 2011-11-21 19:47:13 -------- d-----w- C:\zzz
2011-11-20 14:19:40 . 2011-09-20 21:06:18 1423744 ----a-w- C:\Windows\system32\drivers\tcpip.sys
2011-11-20 14:19:39 . 2011-09-20 14:04:40 40448 ----a-w- C:\Windows\system32\drivers\tcpipreg.sys
2011-11-20 14:19:36 . 2011-10-17 11:41:35 2409784 ----a-w- C:\Program Files\Windows Mail\OESpamFilter.dat
2011-11-20 14:19:36 . 2011-10-17 11:41:10 2409784 ----a-w- C:\Program Files (x86)\Windows Mail\OESpamFilter.dat
2011-11-20 14:19:23 . 2011-09-30 16:16:23 893440 ----a-w- C:\Program Files\Common Files\System\wab32.dll
2011-11-20 14:19:23 . 2011-09-30 16:16:23 50688 ----a-w- C:\Program Files\Windows Mail\wabimp.dll
2011-11-20 14:19:23 . 2011-09-30 15:57:08 707584 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll
2011-11-18 14:10:16 . 2011-10-07 04:16:03 8570192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{734AD158-5C0D-495C-B042-0D049512EF89}\mpengine.dll
2011-11-01 20:53:24 . 2011-11-01 22:38:41 -------- d-----w- C:\Windows\$regcmp$
.


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2011-11-26 01:42:37 . 2009-05-29 15:44:56 270776 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr
2011-11-26 01:42:37 . 2009-05-28 19:01:42 270776 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe
2011-11-26 01:42:02 . 2009-05-28 19:01:42 111928 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0
2011-10-15 08:53:00 . 2010-11-25 16:57:48 7041856 ----a-w- C:\Windows\SysWow64\nvwgf2um.dll
2011-10-15 08:53:00 . 2010-11-25 16:57:48 2458432 ----a-w- C:\Windows\SysWow64\nvapi.dll
2011-10-15 08:53:00 . 2010-10-16 19:13:54 10406208 ----a-w- C:\Windows\system32\nvcpl.dll
2011-10-15 08:53:00 . 2010-10-16 19:13:34 5067584 ----a-w- C:\Windows\system32\nvsvc64.dll
2011-10-15 08:53:00 . 2010-10-16 19:13:34 222528 ----a-w- C:\Windows\system32\nvmctray.dll
2011-10-15 08:53:00 . 2010-10-16 19:13:34 1640768 ----a-w- C:\Windows\system32\nvvsvc.exe
2011-10-15 08:53:00 . 2010-06-09 00:51:26 13205312 ----a-w- C:\Windows\SysWow64\nvd3dum.dll
2011-10-15 08:53:00 . 2009-07-07 22:24:58 137536 ----a-w- C:\Windows\system32\nvshext.dll
2011-10-15 08:53:00 . 2009-05-01 03:02:00 2808128 ----a-w- C:\Windows\system32\nvapi64.dll
2011-10-15 06:54:52 . 2011-10-15 06:54:52 321856 ----a-w- C:\Windows\SysWow64\nvStreaming.exe
2011-10-13 20:29:40 . 2011-10-13 20:29:40 42392 ----a-w- C:\Windows\SysWow64\xfcodec.dll
2011-10-13 20:29:40 . 2011-10-13 20:29:40 28056 ----a-w- C:\Windows\system32\xfcodec64.dll
2011-09-06 13:56:50 . 2011-10-12 23:31:59 2764288 ----a-w- C:\Windows\system32\win32k.sys
2011-09-01 05:24:07 . 2011-10-12 23:33:23 2309120 ----a-w- C:\Windows\system32\jscript9.dll
2011-09-01 05:17:57 . 2011-10-12 23:33:22 1389056 ----a-w- C:\Windows\system32\wininet.dll
2011-09-01 05:12:04 . 2011-10-12 23:33:25 2382848 ----a-w- C:\Windows\system32\mshtml.tlb
2011-09-01 02:35:59 . 2011-10-12 23:33:22 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll
2011-09-01 02:28:15 . 2011-10-12 23:33:23 1126912 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-09-01 02:22:54 . 2011-10-12 23:33:25 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-08-31 22:00:50 . 2009-05-28 18:17:30 25416 ----a-w- C:\Windows\system32\drivers\mbam.sys


((((((((((((((((((((((((((((( SnapShot@2011-11-21_19.12.57 )))))))))))))))))))))))))))))))))))))))))

+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 61248 C:\Windows\SysWOW64\OpenCL.dll
+ 2008-01-21 02:09:41 . 2011-11-26 15:59:42 69632 C:\Windows\system32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 15:44:04 . 2011-11-26 15:59:44 90188 C:\Windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-05-27 22:09:53 . 2011-11-26 14:59:58 18618 C:\Windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1669760302-2667445884-3644838314-1000_UserData.bin
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 68928 C:\Windows\system32\OpenCL.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 68928 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\OpenCL64.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 61248 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\OpenCL.dll
+ 2011-04-27 21:25:24 . 2011-04-27 21:25:24 84864 C:\Windows\system32\drivers\NisDrvWFP.sys
+ 2011-04-18 19:18:50 . 2011-04-18 19:18:50 40832 C:\Windows\system32\drivers\MpNWMon.sys
+ 2009-05-27 23:57:03 . 2011-11-26 14:53:26 16384 C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-05-27 23:57:03 . 2011-11-21 14:15:24 16384 C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-05-27 23:57:03 . 2011-11-21 14:15:24 32768 C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-11-26 08:44:38 . 2011-11-26 14:53:26 32768 C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-05-27 23:57:03 . 2011-11-26 14:53:26 16384 C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-05-27 23:57:03 . 2011-11-21 14:15:24 16384 C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-11-22 10:55:16 . 2011-11-22 10:55:16 65536 C:\Windows\Installer\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74_1.exe
+ 2011-11-22 10:55:16 . 2011-11-22 10:55:16 65536 C:\Windows\Installer\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2011-11-22 10:55:16 . 2011-11-22 10:55:16 65536 C:\Windows\Installer\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2011-11-22 10:55:16 . 2011-11-22 10:55:16 65536 C:\Windows\Installer\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2011-11-22 10:55:16 . 2011-11-22 10:55:16 65536 C:\Windows\Installer\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}\googleearth.exe1_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2011-11-22 10:55:16 . 2011-11-22 10:55:16 65536 C:\Windows\Installer\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}\googleearth.exe_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2011-11-22 10:55:16 . 2011-11-22 10:55:16 65536 C:\Windows\Installer\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}\ARPPRODUCTICON.exe
+ 2011-11-23 22:57:44 . 2011-11-23 22:57:44 75656 C:\Windows\Installer\{4640FDE1-B83A-4376-84ED-86F86BEE2D41}\ProductName.chm.de_D066A77819B7480BA99CC79FB02C9357.exe
+ 2011-11-23 22:57:43 . 2011-11-23 22:57:43 75656 C:\Windows\Installer\{4640FDE1-B83A-4376-84ED-86F86BEE2D41}\DriverDetective.pt_6CF114D33913468CBA2AA6967939B819.exe
+ 2011-11-23 22:57:43 . 2011-11-23 22:57:43 75656 C:\Windows\Installer\{4640FDE1-B83A-4376-84ED-86F86BEE2D41}\DriverDetective.it_251B66F1CA924E82A1EE29E85D5EC5A1.exe
+ 2011-11-23 22:57:43 . 2011-11-23 22:57:43 75656 C:\Windows\Installer\{4640FDE1-B83A-4376-84ED-86F86BEE2D41}\DriverDetective.fr_E1678746353A46E3A9150D3E8B3832B1.exe
+ 2011-11-23 22:57:43 . 2011-11-23 22:57:44 75656 C:\Windows\Installer\{4640FDE1-B83A-4376-84ED-86F86BEE2D41}\DriverDetective.es_654C8EA5162D4D4084239A5EDD67F462.exe
- 2006-11-02 12:40:24 . 2011-07-13 10:05:02 86016 C:\Windows\inf\infstor.dat
+ 2006-11-02 12:40:24 . 2011-11-24 01:03:44 86016 C:\Windows\inf\infstor.dat
+ 2006-11-02 12:40:24 . 2011-11-24 01:03:52 51200 C:\Windows\inf\infpub.dat
- 2006-11-02 12:40:24 . 2011-11-20 14:10:41 51200 C:\Windows\inf\infpub.dat
+ 2011-11-23 22:57:56 . 2011-11-23 22:57:56 59392 C:\Windows\assembly\NativeImages_v2.0.50727_32\ExceptionLogging\09436ee69c887b718a7308715a87c757\ExceptionLogging.ni.dll
- 2011-11-21 19:11:14 . 2011-11-21 19:11:14 2048 C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-11-26 15:57:50 . 2011-11-26 15:57:50 2048 C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-11-26 15:57:50 . 2011-11-26 15:57:50 2048 C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-11-21 19:11:14 . 2011-11-21 19:11:14 2048 C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-11-22 22:02:25 . 2011-11-22 22:02:26 247968 C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe
+ 2011-11-22 22:02:26 . 2011-11-22 22:02:26 335520 C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.dll
+ 2006-11-02 12:46:18 . 2011-11-26 15:04:00 579836 C:\Windows\system32\perfh009.dat
+ 2006-11-02 12:46:18 . 2011-11-26 15:04:00 101210 C:\Windows\system32\perfc009.dat
+ 2009-10-03 22:52:45 . 2010-10-19 20:51:33 270720 C:\Windows\system32\MpSigStub.exe
- 2009-10-03 22:52:45 . 2011-05-25 00:14:10 270720 C:\Windows\system32\MpSigStub.exe
- 2006-11-02 15:21:00 . 2011-10-13 00:35:48 253776 C:\Windows\system32\FNTCACHE.DAT
+ 2006-11-02 15:21:00 . 2011-11-25 17:09:51 253776 C:\Windows\system32\FNTCACHE.DAT
+ 2011-11-24 01:00:16 . 2011-10-15 10:48:07 291648 C:\Windows\system32\DriverStore\FileRepository\nvstusb.inf_15958d34\nvstusb64.sys
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 283456 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvml.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 200512 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvidia-smi.exe
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 316496 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvdrsdb.bin
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 224064 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\dbInstaller.exe
+ 2011-04-18 19:18:50 . 2011-04-18 19:18:50 189440 C:\Windows\system32\drivers\MpFilter.sys
+ 2010-05-02 06:00:16 . 2011-11-26 15:56:27 226448 C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2010-05-02 06:00:16 . 2011-11-21 19:09:47 226448 C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-11-22 00:58:51 . 2011-11-22 00:58:51 907776 C:\Windows\Installer\148764.msi
+ 2011-11-22 00:58:30 . 2011-11-22 00:58:30 585216 C:\Windows\Installer\14875d.msi
+ 2006-11-02 12:40:24 . 2011-11-24 01:03:52 143360 C:\Windows\inf\infstrng.dat
+ 2011-11-23 22:58:01 . 2011-11-23 22:58:01 119296 C:\Windows\assembly\NativeImages_v2.0.50727_32\XPBurnComponent\150ad6c742e90579c19998c2cc6ff0f8\XPBurnComponent.ni.dll
+ 2011-11-23 22:58:01 . 2011-11-23 22:58:01 148992 C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Practices#\ed1a536f2b8c98145bfbb9e86291a9fc\Microsoft.Practices.EnterpriseLibrary.Security.Cryptography.ni.dll
+ 2011-11-23 22:58:00 . 2011-11-23 22:58:00 304128 C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Practices#\33ac68b979e1c6c6f727118f87840476\Microsoft.Practices.ObjectBuilder.ni.dll
+ 2011-11-23 22:58:00 . 2011-11-23 22:58:00 309248 C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Practices#\29fe98e5b3fbb6b7753f2fc1a94340bb\Microsoft.Practices.EnterpriseLibrary.Common.ni.dll
+ 2011-11-23 22:58:00 . 2011-11-23 22:58:00 230912 C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\19abe29c2e4570d1195c65ad57bf8723\Microsoft.ApplicationBlocks.Updater.ni.dll
+ 2011-11-23 22:57:59 . 2011-11-23 22:57:59 202240 C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.WUApiLib\a0af06998c14b0b97bf05bf94dd61838\Interop.WUApiLib.ni.dll
+ 2011-11-23 22:57:57 . 2011-11-23 22:57:57 547840 C:\Windows\assembly\NativeImages_v2.0.50727_32\ICSharpCode.SharpZi#\abf0a91e79454c6c9dc6b4ef55976254\ICSharpCode.SharpZipLib.ni.dll
+ 2011-11-23 22:57:54 . 2011-11-23 22:57:54 410112 C:\Windows\assembly\NativeImages_v2.0.50727_32\Agent.Communication\234cb42d3a0fc1040480d4da854a37c3\Agent.Communication.ni.dll
+ 2011-11-23 22:57:55 . 2011-11-23 22:57:55 352768 C:\Windows\assembly\NativeImages_v2.0.50727_32\Agent.Common\78c6d29c4f207e5277337a76c35fe236\Agent.Common.ni.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 2401088 C:\Windows\SysWOW64\nvcuvid.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 2099520 C:\Windows\SysWOW64\nvcuvenc.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 5578560 C:\Windows\SysWOW64\nvcuda.dll
- 2006-11-02 12:33:39 . 2011-11-21 19:09:52 9961472 C:\Windows\system32\SMI\Store\Machine\schema.dat
+ 2006-11-02 12:33:39 . 2011-11-22 01:02:31 9961472 C:\Windows\system32\SMI\Store\Machine\schema.dat
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 8791360 C:\Windows\system32\nvwgf2umx.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 1454400 C:\Windows\system32\nvgenco64.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 1533248 C:\Windows\system32\nvdispco64.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 2542912 C:\Windows\system32\nvcuvid.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 2232128 C:\Windows\system32\nvcuvenc.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 7581504 C:\Windows\system32\nvcuda.dll
+ 2011-11-24 01:00:16 . 2011-10-15 10:48:07 1454400 C:\Windows\system32\DriverStore\FileRepository\nvstusb.inf_15958d34\nvgenco64.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 8791360 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvwgf2umx.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 7041856 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvwgf2um.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 1454400 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvgenco64.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 1533248 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvdispco64.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 2401088 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvcuvid32.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 2542912 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvcuvid.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 2232128 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvcuvenc64.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 2099520 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvcuvenc.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 5578560 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvcuda32.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 7581504 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvcuda.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 2808128 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvapi64.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 2458432 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvapi.dll
+ 2011-11-22 10:55:15 . 2011-11-22 10:55:15 1435136 C:\Windows\Installer\21d3b82.msi
+ 2011-11-24 01:02:37 . 2011-11-24 01:02:37 1550848 C:\Windows\Installer\1abf0d4.msi
+ 2011-11-23 22:57:56 . 2011-11-23 22:57:56 1150464 C:\Windows\assembly\NativeImages_v2.0.50727_32\Common\5c7e89f5b976e581c39fe9984e881b16\Common.ni.dll
+ 2011-11-23 22:57:53 . 2011-11-23 22:57:53 5004800 C:\Windows\assembly\NativeImages_v2.0.50727_32\Agent\6be0059d284a631d32964f5b5f860fd3\Agent.ni.exe
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 18871616 C:\Windows\SysWOW64\nvoglv32.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 17248576 C:\Windows\SysWOW64\nvcompiler.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 24742720 C:\Windows\system32\nvoglv64.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 15693120 C:\Windows\system32\nvd3dumx.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 24796992 C:\Windows\system32\nvcompiler.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 24742720 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvoglv64.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 18871616 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvoglv32.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 12971840 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvlddmkm.sys
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 15693120 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvd3dumx.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 13205312 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvd3dum.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 17248576 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvcompiler32.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 24796992 C:\Windows\system32\DriverStore\FileRepository\nv_disp.inf_69114149\nvcompiler.dll
+ 2011-11-24 01:00:13 . 2011-10-15 08:53:00 12971840 C:\Windows\system32\drivers\nvlddmkm.sys
+ 2011-11-22 20:55:46 . 2011-11-26 15:56:27 10605244 C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1669760302-2667445884-3644838314-1000-8192.dat
+ 2010-06-09 01:31:45 . 2011-11-24 01:16:41 53046700 C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1669760302-2667445884-3644838314-1000-12288.dat

-- Snapshot reset to current date --

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2009-04-11 07:10:53 1555968]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 02:50:36 138240]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CtxfiReg"="CTXFIREG.exe" [2008-10-08 04:37:46 47104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sasnative64

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys [x]
R1 SABKUTIL;SABKUTIL;C:\Program Files (x86)\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.sys [x]
R2 AODService;AODService;C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe [2010-04-23 10:39:00 136616]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 18:16:28 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 19:27:14 138576]
R2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-26 03:05:53 135664]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-05-28 02:18:32 79360]
R3 CT20XUT;CT20XUT;C:\Windows\system32\drivers\CT20XUT.SYS [x]
R3 CTEXFIFX;CTEXFIFX;C:\Windows\system32\drivers\CTEXFIFX.SYS [x]
R3 CTHWIUT;CTHWIUT;C:\Windows\system32\drivers\CTHWIUT.SYS [x]
R3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-26 03:05:53 135664]
R3 GVTDrv64;GVTDrv64;C:\Windows\GVTDrv64.sys [2010-07-06 21:15:40 30528]
R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 23:21:18 288272]
R3 PSI;PSI;C:\Windows\system32\DRIVERS\psi_mf.sys [x]
R3 SandraAgentSrv;SiSoftware Deployment Agent Service;D:\SiSoftware\SiSoftware Sandra Lite 2009.SP3c\RpcAgentSrv.exe [x]
R3 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\PSIA.exe [2011-01-10 14:24:20 993848]
R3 U6000ALL;U6000 TV Box(ALL);C:\Windows\system32\DRIVERS\U6000ALL.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 19:27:14 1020768]
S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 18:23:05 14920]
S1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 18:23:05 12360]
S2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 17:49:27 128752]
S2 cpuz133;cpuz133;C:\Windows\system32\drivers\cpuz133_x64.sys [x]
S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe [2011-05-03 21:50:59 123320]
S2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 08:53:00 2253120]
S2 PCCUJobMgr;Common Client Job Manager Service;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe [2011-05-03 21:56:02 126392]
S2 Secunia Update Agent;Secunia Update Agent;C:\Program Files (x86)\Secunia\PSI\sua.exe [2011-01-10 14:24:20 399416]
S2 SgtSch2Svc;Seagate Scheduler2 Service;C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe [2009-10-17 00:39:50 606048]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-15 06:54:40 381248]
S3 CT20XUT.SYS;CT20XUT.SYS;C:\Windows\System32\drivers\CT20XUT.SYS [x]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;C:\Windows\System32\drivers\CTEXFIFX.SYS [x]
S3 CTHWIUT.SYS;CTHWIUT.SYS;C:\Windows\System32\drivers\CTHWIUT.SYS [x]


Contents of the 'Scheduled Tasks' folder

2011-11-26 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-26 03:05:59 . 2010-02-26 03:05:53]

2011-11-26 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-26 03:05:59 . 2010-02-26 03:05:53]


--------- x86-64 -----------


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 20:34:50 134416]
"MSC"="c:\Program Files\Microsoft Security Client\msseces.exe" [2011-06-15 20:35:24 1436736]

 

[Broni]

Download Bootkit Remover to your Desktop.

• Unzip downloaded file to your Desktop.
• Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on boot_cleaner.exe and click Run As Administrator).
• It will show a Black screen with some data on it.
• Right click on the screen and click Select All.
• Press CTRL+C
• Open a Notepad and press CTRL+V
• Post the output back here.

 

[Iowabucks]

Bootkit Remover
(c) 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows Vista Ultimate Edition Service Pack 2 (build 6002)
, 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00

Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0 Controlled by rootkit!

Boot code on some of your physical disks is hidden by a rootkit.
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]


Done;
Press any key to quit...

 

[Broni]

Your MBR seems to be infected.

Please download NTBR by noahdfear and save it to your Desktop.
File size: 2.44 MB (2,565,432 bytes)

• Place a blank CD in your CD drive.
• Double click on NTBR_CD.exe file and a folder of the same name will appear.
• Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.
• Follow the prompts to burn the CD.

• Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)
• If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.

• Insert the newly created CD into your infected PC and reboot your computer.
• Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!
• Read the warning and then continue as prompted.
• You first need to select your keyboard layout - press Enter for English.
• Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK
• On the following screen enter 5 to select Install Standard MBR code.
• Enter 1 to overwrite the infected MBR Code with the Standard MBR code.
• When asked to confirm please do so.
• Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.
• Eject the disc and then press ctrl+alt+del to reboot the PC.

Once rebooted, run Bootkit Remover again and post its log.

 

[Iowabucks]

This log looks exactly the same as the first one. The whole process went well but when i press 1 to overwrite the MBR code, it instantly went to the next screen like nothing was done (that took any time to do).

Could i have not burned the needed files to the CD? When i ran NTBR there were 3 files, but none named NTBR_CD.exe.

There was:
NTBR_CD ---a WinRar Archive
BurnitCD---- a windows command script
BurnitCDCC---- an application

I picked BurnitCDCC because it was an application.
Did i pick the right file to burn? Should i have burned the archive to the CD instead?


Bootkit Remover
(c) 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows Vista Ultimate Edition Service Pack 2 (build 6002)
, 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00

Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0 Controlled by rootkit!

Boot code on some of your physical disks is hidden by a rootkit.
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]


Done;
Press any key to quit...

 

[Broni]

I'm not sure what exactly you did.

When i ran NTBR there were 3 files, but none named NTBR_CD.exe.

You download a file named NTBR_CD.exe, which you're supposed to double click.
It'll create NTBR_CD folder.
Inside that folder you'll find BurnItCD.cmd file.
Double click on that file to start creating bootable CD (you must have blank CD in your CD drive)

 

[Iowabucks]

The BurnItCD file in the folder (1 of 3) has no ".cmd" behind it. It is a 1 kb command script.

Is that the file i should be copying?

 

[Broni]

Yes.
To see file extensions...in Windows Explorer got Tools>Folder options>View tab and UN-check "Hide extensions for known file types".
OK the way out.
Press F5 to refresh Windows Explorer view.

 

[Iowabucks]

Same thing.


Bootkit Remover
(c) 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows Vista Ultimate Edition Service Pack 2 (build 6002)
, 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00

Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0 Controlled by rootkit!

Boot code on some of your physical disks is hidden by a rootkit.
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]


Done;
Press any key to quit...

 

[Broni]

It didn't work.
If you did it right.

If you have Vista/7 DVD...

start with step 2

If you don't have Vista/7 DVD...

1. Create Vista/7 Recovery Disc.

Option 1 :
Vista: http://www.vistax64.com/tutorials/141820-create-recovery-disc.html (Option Two)
Windows 7: http://www.guidingtech.com/3816/system-repair-recovery-disc-windows-7/

Option 2:
Download Vista Recovery Disc iso image: http://digiex.net/downloads/downloa...6-windows-vista-32-bit-x86-recovery-disc.html
Download Windows 7 Recovery Disc iso image: http://digiex.net/downloads/downloa.../2659-windows-7-32-bit-x86-recovery-disc.html
Burn it to DVD: http://neosmart.net/wiki/display/G/Burning+ISO+Images+to+a+CD+or+DVD

2. Boot from created disk. You may need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)

Vista users. At first screen click on Repair your computer:

Windows 7 users. At first screen click on Install now:

Select your language and click next:

Click the button for "Use recovery tools":

The following applies to both, Vista and Windows 7 users.

This will bring you to a new screen where the repair process will look for all Windows Vista/7 installations on your computer. When done you will be presented with the System Recovery Options dialog box:

After this, it will present you with a list of options including startup repair, system restore and command prompt:

Select Command Prompt

Type in:
bootrec /fixmbr (<--- there is a "space" after "bootrec")
and then press Enter

Once completed then type Exit, press Enter and restart computer.

Post fresh Bootkit Remover log.

 

[Iowabucks]

Same results again. Only thing i saw different in that process was i didn't see my operating system listed. I clicked next and it went to the choose recovery tool options anyway. Would i have needed to have an OP highlighted there for it to work?


Bootkit Remover
(c) 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows Vista Ultimate Edition Service Pack 2 (build 6002)
, 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00

Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0 Controlled by rootkit!

Boot code on some of your physical disks is hidden by a rootkit.
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]


Done;
Press any key to quit...

 

[Broni]

How is computer doing at the moment?

Download OTL to your Desktop.

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click the Scan All Users checkbox.
• Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

 

[Iowabucks]

It seems to be doing the same as when we started. Big stuff has already been fixed but a number of small problems still exist.

I have run this a number of times and never get the extras.txt file. Just the OTL.txt file.



OTL logfile created on: 11/26/2011 10:04:45 PM - Run 4
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Jerry\Desktop\computer cleaning
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.61 Gb Available Physical Memory | 65.35% Memory free
8.19 Gb Paging File | 6.74 Gb Available in Paging File | 82.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 761.72 Gb Total Space | 632.06 Gb Free Space | 82.98% Space Free | Partition Type: NTFS
Drive F: | 169.79 Gb Total Space | 128.37 Gb Free Space | 75.61% Space Free | Partition Type: NTFS

Computer Name: JERRY-PC | User Name: Jerry | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/11/21 18:45:10 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Jerry\Desktop\computer cleaning\OTL.exe
PRC - [2011/10/15 02:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011/10/15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011/05/03 15:56:02 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe
PRC - [2011/05/03 15:50:59 | 000,123,320 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe
PRC - [2011/01/10 08:24:20 | 000,399,416 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\sua.exe
PRC - [2010/12/02 20:06:45 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2008/12/29 17:27:38 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/04/27 17:21:18 | 000,288,272 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2011/04/27 17:21:18 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2010/06/29 11:49:27 | 000,128,752 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
SRV:64bit: - [2008/01/20 20:50:23 | 000,195,584 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2008/01/20 20:46:39 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2011/10/15 02:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/10/15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011/05/03 15:56:02 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\ccSvcHst.exe -- (PCCUJobMgr)
SRV - [2011/05/03 15:50:59 | 000,123,320 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.12.27\SymcPCCULaunchSvc.exe -- (Norton PC Checkup Application Launcher)
SRV - [2011/01/10 08:24:20 | 000,993,848 | ---- | M] (Secunia) [On_Demand | Stopped] -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2011/01/10 08:24:20 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2010/12/02 20:06:45 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2010/04/23 04:39:00 | 000,136,616 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe -- (AODService)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/10/16 18:39:50 | 000,606,048 | ---- | M] (Seagate) [Auto | Running] -- C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe -- (SgtSch2Svc)
SRV - [2009/09/28 08:42:50 | 000,109,056 | ---- | M] (ArcSoft Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/06/30 10:28:28 | 000,316,664 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2009/05/27 20:18:32 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2009/03/29 22:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/12/29 17:27:38 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/04/27 15:25:24 | 000,084,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2010/09/01 02:30:58 | 000,017,976 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\psi_mf.sys -- (PSI)
DRV:64bit: - [2010/03/30 22:35:04 | 000,020,968 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz133_x64.sys -- (cpuz133)
DRV:64bit: - [2010/02/22 14:31:20 | 000,711,712 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\timntr.sys -- (timounter)
DRV:64bit: - [2010/02/22 14:31:20 | 000,081,952 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\Windows\SysNative\DRIVERS\tifsfilt.sys -- (tifsfilter)
DRV:64bit: - [2010/02/22 14:31:05 | 000,235,040 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\snapman.sys -- (snapman)
DRV:64bit: - [2010/02/22 14:31:04 | 000,593,952 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\tdrpman.sys -- (tdrpman)
DRV:64bit: - [2010/02/17 12:23:05 | 000,014,920 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV:64bit: - [2010/02/17 12:23:05 | 000,012,360 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV:64bit: - [2009/09/30 18:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2008/10/08 00:22:36 | 001,561,112 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k)
DRV:64bit: - [2008/10/08 00:22:30 | 000,118,296 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia)
DRV:64bit: - [2008/10/08 00:22:28 | 000,213,016 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV:64bit: - [2008/10/08 00:22:26 | 000,015,896 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV:64bit: - [2008/10/08 00:22:24 | 000,179,224 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv)
DRV:64bit: - [2008/10/08 00:22:22 | 000,684,312 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k) Creative Audio Driver (WDM)
DRV:64bit: - [2008/10/08 00:22:18 | 000,580,632 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k)
DRV:64bit: - [2008/10/08 00:22:14 | 001,417,240 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.SYS -- (CTEXFIFX.SYS)
DRV:64bit: - [2008/10/08 00:22:14 | 001,417,240 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.SYS -- (CTEXFIFX)
DRV:64bit: - [2008/10/08 00:22:10 | 000,094,744 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTHWIUT.SYS -- (CTHWIUT.SYS)
DRV:64bit: - [2008/10/08 00:22:10 | 000,094,744 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.SYS -- (CTHWIUT)
DRV:64bit: - [2008/10/08 00:22:08 | 000,202,776 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.SYS -- (CT20XUT.SYS)
DRV:64bit: - [2008/10/08 00:22:08 | 000,202,776 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.SYS -- (CT20XUT)
DRV:64bit: - [2008/05/01 23:59:48 | 000,166,912 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2008/01/20 20:46:34 | 000,048,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\avc.sys -- (Avc)
DRV:64bit: - [2008/01/20 20:46:34 | 000,017,536 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\avcstrm.sys -- (AVCSTRM)
DRV:64bit: - [2008/01/20 20:46:08 | 000,056,448 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\mstape.sys -- (MSTAPE)
DRV:64bit: - [2008/01/20 20:46:05 | 000,058,496 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\61883.sys -- (61883)
DRV:64bit: - [2008/01/20 20:46:01 | 000,061,568 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\msdv.sys -- (MSDV)
DRV:64bit: - [2007/07/23 08:57:04 | 000,052,992 | ---- | M] (Ideazon Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Alpham164.sys -- (Alpham1)
DRV:64bit: - [2007/07/13 02:58:54 | 000,276,480 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\U6000ALL.sys -- (U6000ALL) U6000 TV Box(ALL)
DRV:64bit: - [2007/04/11 14:35:30 | 000,056,080 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2007/04/11 14:35:22 | 000,053,520 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2007/03/20 10:51:04 | 000,021,760 | ---- | M] (Ideazon Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Alpham264.sys -- (Alpham2)
DRV - [2010/07/06 23:11:01 | 000,022,336 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\gdrv.sys -- (gdrv)
DRV - [2010/07/06 15:15:40 | 000,030,528 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\GVTDrv64.sys -- (GVTDrv64)
DRV - [2007/10/16 15:15:26 | 000,036,416 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\ET5Drv.sys -- (ET5Drv)
DRV - [2007/02/07 12:27:46 | 000,014,104 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | Boot | Running] -- C:\Windows\SysWOW64\speedfan.sys -- (speedfan)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1669760302-2667445884-3644838314-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.archerytalk.com/vb/forumdisplay.php?f=1
IE - HKU\S-1-5-21-1669760302-2667445884-3644838314-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs =
IE - HKU\S-1-5-21-1669760302-2667445884-3644838314-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP =
IE - HKU\S-1-5-21-1669760302-2667445884-3644838314-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files (x86)\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2009/10/26 18:16:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/11/20 07:58:44 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2011/11/26 09:58:32 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Program Files (x86)\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found
O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\Run: [CtxfiReg] C:\Windows\SysWow64\CTxfiReg.exe (Creative Technology Ltd)
O4 - HKU\S-1-5-18..\Run: [CtxfiReg] C:\Windows\SysWow64\CTxfiReg.exe (Creative Technology Ltd)
O4 - HKU\S-1-5-21-1669760302-2667445884-3644838314-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1669760302-2667445884-3644838314-1003..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-1669760302-2667445884-3644838314-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1669760302-2667445884-3644838314-1000\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-1669760302-2667445884-3644838314-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1669760302-2667445884-3644838314-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1669760302-2667445884-3644838314-1003\Software\Policies\Microsoft\Internet Explorer\Recovery present
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {38AB0814-B09B-4378-9940-14A19638C3C2} http://www.auctiva.com/Aurigma/ImageUploader57.cab (Auctiva Image Uploader Control)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab (CDownloadCtrl Object)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} http://www.facebook.com/controls/contactx.dll (ContactExtractor Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} http://lads.myspace.com/upload/MySpaceUploader2.cab (MySpace Uploader Control)
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab (EPUImageControl Class)
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} http://service.futuremark.com/virtualmark/tc/FMSI.cab (Futuremark SystemInfo)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15108/CTPID.cab (Creative Software AutoUpdate Support Package)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (PCPitstop Exam)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 66.207.0.3 66.207.0.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{98E5A55E-A998-4205-9578-EB9E15529319}: DhcpNameServer = 66.207.0.3 66.207.0.2
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Jerry\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Jerry\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O30:64bit: - LSA: Authentication Packages - (relog_ap) - C:\Windows\SysNative\relog_ap.dll (Acronis)
O30 - LSA: Authentication Packages - (relog_ap) -C:\Windows\SysWow64\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (sasnative64)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.XFR1 - xfcodec64.dll ()
Drivers32: msacm.ac3filter - C:\Windows\SysWow64\ac3filter.acm ()
Drivers32: msacm.avis - C:\Windows\SysWow64\ff_acm.acm ()
Drivers32: msacm.iac2 - C:\Windows\SysWOW64\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\SysWow64\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.mpegacm - mpegacm.acm File not found
Drivers32: msacm.ulmp3acm - ulmp3acm.acm File not found
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\Windows\SysWow64\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.iv32 - C:\Windows\SysWow64\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.iv50 - C:\Windows\SysWow64\ir50_32.dll (Intel Corporation)
Drivers32: vidc.MP42 - C:\Windows\SysWow64\MPG4c32.dll (Microsoft Corporation)
Drivers32: vidc.MP43 - C:\Windows\SysWow64\MPG4c32.dll (Microsoft Corporation)
Drivers32: vidc.MPG4 - C:\Windows\SysWow64\MPG4c32.dll (Microsoft Corporation)
Drivers32: VIDC.XFR1 - C:\Windows\SysWow64\xfcodec.dll ()
Drivers32: vidc.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yvu9 - C:\Windows\SysWow64\Iyvu9_32.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/11/26 17:55:33 | 000,000,000 | ---D | C] -- C:\Users\Jerry\Desktop\NTBR_CD
[2011/11/26 10:00:40 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/11/26 09:54:57 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/11/26 09:18:33 | 000,000,000 | ---D | C] -- C:\ComboFix
[2011/11/26 00:29:00 | 004,307,814 | R--- | C] (Swearware) -- C:\Users\Jerry\Desktop\ComboFix.exe
[2011/11/26 00:16:09 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/11/25 17:36:18 | 000,000,000 | ---D | C] -- C:\Users\Jerry\AppData\Local\SvchostViewer
[2011/11/24 20:32:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011/11/24 10:37:53 | 000,000,000 | ---D | C] -- C:\found.000
[2011/11/23 19:34:05 | 000,000,000 | ---D | C] -- C:\Users\Jerry\AppData\Roaming\Tific
[2011/11/23 19:34:05 | 000,000,000 | ---D | C] -- C:\Users\Jerry\AppData\Local\Tific
[2011/11/23 19:33:54 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NortonPCCheckupx64
[2011/11/23 19:33:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton PC Checkup
[2011/11/23 19:33:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Norton PC Checkup
[2011/11/23 19:33:54 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NortonPCCheckupx64\02000C0.01B
[2011/11/23 19:33:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2011/11/23 19:33:51 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2011/11/23 19:33:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NortonInstaller
[2011/11/23 19:03:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2011/11/23 19:00:13 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2011/11/23 19:00:13 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2011/11/23 16:58:09 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Drivers HeadQuarters
[2011/11/22 15:56:23 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2011/11/22 08:10:06 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/11/22 04:55:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011/11/21 18:58:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client
[2011/11/21 18:58:22 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2011/11/21 08:29:12 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/11/21 08:29:12 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/11/21 08:29:12 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/11/21 08:28:04 | 000,000,000 | ---D | C] -- C:\zzz
[2011/11/20 19:42:06 | 000,000,000 | R--D | C] -- C:\Users\Jerry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011/11/01 14:53:24 | 000,000,000 | ---D | C] -- C:\Windows\$regcmp$
[2008/10/07 22:42:42 | 000,060,928 | ---- | C] ( ) -- C:\Windows\SysWow64\a3d.dll
[2008/10/07 22:23:46 | 000,012,800 | ---- | C] ( ) -- C:\Windows\SysWow64\killapps.exe
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/11/26 21:53:00 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/11/26 21:43:56 | 000,270,776 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2011/11/26 21:43:56 | 000,270,776 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011/11/26 21:43:20 | 000,111,928 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2011/11/26 21:38:20 | 000,044,607 | ---- | M] () -- C:\Users\Jerry\Desktop\bootkit_remover.zip
[2011/11/26 21:35:31 | 000,675,374 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/11/26 21:35:31 | 000,579,836 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/11/26 21:35:31 | 000,101,210 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/11/26 21:31:05 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/11/26 21:31:05 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/11/26 21:31:05 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/11/26 21:31:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/11/26 21:24:00 | 000,062,556 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000003-00000000-00000007-00001102-00000005-00221102}.rfx
[2011/11/26 21:24:00 | 000,062,556 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000003-00000000-00000007-00001102-00000005-00221102}.rfx
[2011/11/26 21:24:00 | 000,000,788 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000003-00000000-00000007-00001102-00000005-00221102}.rfx
[2011/11/26 18:02:16 | 000,002,726 | ---- | M] () -- C:\Users\Jerry\Desktop\Document.rtf
[2011/11/26 15:15:21 | 002,565,464 | ---- | M] () -- C:\Users\Jerry\Desktop\NTBR_CD.exe
[2011/11/26 09:58:32 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2011/11/26 09:16:40 | 004,307,814 | R--- | M] (Swearware) -- C:\Users\Jerry\Desktop\ComboFix.exe
[2011/11/26 08:57:44 | 585,902,665 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/11/25 20:35:12 | 000,004,405 | ---- | M] () -- C:\Users\Jerry\Desktop\New Rich Text Format.rtf
[2011/11/25 20:31:40 | 000,007,691 | ---- | M] () -- F:\Documents\Tims info.rtf
[2011/11/25 11:09:51 | 000,253,776 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011/11/23 09:45:54 | 000,001,356 | ---- | M] () -- C:\Users\Jerry\AppData\Local\d3d9caps.dat
[2011/11/22 04:55:11 | 000,002,120 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011/11/21 19:01:57 | 000,002,154 | ---- | M] () -- C:\Windows\epplauncher.mif
[2011/11/21 18:58:43 | 000,689,910 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/11/20 08:03:54 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2011/11/20 08:03:54 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2011/10/31 20:18:16 | 000,019,494 | ---- | M] () -- F:\Documents\cc_20111031_211810.reg
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/11/26 21:38:18 | 000,044,607 | ---- | C] () -- C:\Users\Jerry\Desktop\bootkit_remover.zip
[2011/11/26 18:02:16 | 000,002,726 | ---- | C] () -- C:\Users\Jerry\Desktop\Document.rtf
[2011/11/26 15:15:20 | 002,565,464 | ---- | C] () -- C:\Users\Jerry\Desktop\NTBR_CD.exe
[2011/11/26 00:13:03 | 585,902,665 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/11/23 19:33:54 | 000,000,172 | ---- | C] () -- C:\Windows\SysNative\drivers\NortonPCCheckupx64\02000C0.01B\isolate.ini
[2011/11/22 04:55:11 | 000,002,120 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011/11/21 19:01:57 | 000,002,154 | ---- | C] () -- C:\Windows\epplauncher.mif
[2011/11/21 18:58:30 | 000,001,813 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/11/21 08:29:12 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011/11/21 08:29:12 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/11/21 08:29:12 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/11/21 08:29:12 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/11/21 08:29:12 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/10/31 20:18:13 | 000,019,494 | ---- | C] () -- F:\Documents\cc_20111031_211810.reg
[2011/10/15 00:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011/10/13 14:29:40 | 000,042,392 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll
[2011/08/17 14:16:52 | 000,000,571 | -HS- | C] () -- C:\Windows\WSYS049.SYS
[2011/08/17 14:16:52 | 000,000,049 | ---- | C] () -- C:\Windows\Progs_.ini
[2011/04/25 23:03:14 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011/04/25 23:03:14 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011/01/31 23:36:35 | 000,000,620 | ---- | C] () -- C:\Users\Jerry\AppData\Local\mapc2mapc.ini
[2010/06/08 18:41:33 | 000,001,356 | ---- | C] () -- C:\Users\Jerry\AppData\Local\d3d9caps.dat
[2010/05/31 18:21:57 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2009/12/11 16:16:10 | 000,870,128 | ---- | C] () -- C:\Users\Jerry\AppData\Roaming\mcs.rma
[2009/12/11 16:16:10 | 000,000,004 | ---- | C] () -- C:\Users\Jerry\AppData\Roaming\20E5E8
[2009/09/24 00:46:04 | 000,085,504 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2009/09/07 22:01:48 | 000,017,043 | ---- | C] () -- C:\Users\Jerry\AppData\Roaming\UserTile.png
[2009/08/14 21:55:02 | 000,000,331 | ---- | C] () -- C:\Windows\game.ini
[2009/06/17 21:52:53 | 000,000,510 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2009/06/03 22:09:49 | 000,689,910 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009/06/03 10:15:39 | 010,444,800 | ---- | C] () -- C:\ProgramData\sandra.mda
[2009/06/01 15:25:21 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009/06/01 15:24:49 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2009/06/01 15:24:19 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/05/29 16:52:26 | 000,204,800 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2009/05/29 16:47:06 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2009/05/29 14:55:50 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\Iyvu9_32.dll
[2009/05/29 14:52:43 | 000,000,208 | ---- | C] () -- C:\Windows\ulead32.ini
[2009/05/28 21:36:48 | 000,065,536 | ---- | C] () -- C:\Users\Jerry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/05/28 21:00:03 | 000,144,896 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2009/05/28 21:00:03 | 000,071,168 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2009/05/28 13:01:42 | 000,270,776 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2009/05/28 13:01:41 | 000,682,280 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2009/05/27 19:42:21 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2009/05/27 18:32:10 | 000,030,528 | ---- | C] () -- C:\Windows\GVTDrv64.sys
[2009/05/27 18:16:30 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2009/05/27 16:01:09 | 000,001,460 | -H-- | C] () -- C:\Users\Jerry\AppData\Local\d3d9caps64.dat
[2008/10/07 23:08:38 | 000,020,936 | ---- | C] () -- C:\Windows\SysWow64\instwdm.ini
[2008/10/07 22:41:40 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIRES.DLL
[2008/10/07 22:31:14 | 000,321,512 | ---- | C] () -- C:\Windows\SysWow64\ctdlang.dat
[2008/10/07 22:31:14 | 000,056,509 | ---- | C] () -- C:\Windows\SysWow64\ctdnlstr.dat
[2008/10/07 22:23:50 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\enlocstr.exe
[2008/09/12 20:22:40 | 000,000,054 | ---- | C] () -- C:\Windows\SysWow64\ctzapxx.ini
[2008/08/19 17:39:18 | 000,000,321 | ---- | C] () -- C:\Windows\SysWow64\kill.ini
[2008/01/20 20:49:10 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2007/09/04 12:56:10 | 000,164,352 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2007/06/21 00:34:08 | 000,203,328 | R--- | C] () -- C:\Windows\GSetup.exe
[2007/06/08 19:12:12 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\GTTunerCard.dll
[2007/02/05 20:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2007/01/05 13:07:11 | 000,076,288 | ---- | C] () -- C:\Windows\SysWow64\1psiG60XV55.dll
[2006/11/02 09:35:48 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 06:37:14 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2006/11/02 06:24:17 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2006/11/02 06:18:17 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2006/11/02 03:47:54 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2005/08/24 22:19:25 | 000,087,552 | ---- | C] () -- C:\Windows\SysWow64\1psi60XV55.dll
[2004/07/29 02:19:46 | 000,175,104 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2004/01/18 19:11:47 | 000,076,800 | R--- | C] () -- C:\Windows\SysWow64\1psi60X.dll
[2003/06/28 14:34:20 | 000,069,707 | ---- | C] () -- C:\Windows\SysWow64\DISP_OPT1.dll

========== LOP Check ==========

[2011/11/01 20:08:17 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\Auslogics
[2009/06/09 19:15:55 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/11/30 11:07:21 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\DassaultSystemes
[2011/11/20 07:59:08 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\DiskSpaceFan
[2011/11/20 07:59:08 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\gtk-2.0
[2009/05/29 09:35:30 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\Ideazon
[2010/06/17 20:10:57 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\iExpert Software
[2011/01/31 23:38:45 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\Mobile Atlas Creator
[2010/06/27 09:30:17 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\MotionDSP
[2009/09/07 14:19:46 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\Mp3tag
[2009/10/30 22:08:35 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\PandoraRecovery
[2009/11/11 20:09:09 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\PeerNetworking
[2010/01/17 17:11:32 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\Publish Providers
[2010/01/14 16:34:39 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\Sony
[2010/03/25 13:02:28 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\SuperAdBlocker.com
[2010/05/31 15:01:39 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\Systweak
[2011/11/23 19:34:05 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\Tific
[2010/05/07 12:07:27 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\TS3Client
[2009/06/01 16:47:01 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\Ulead Systems
[2009/11/06 12:53:56 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\VistaCodecs
[2010/02/11 00:45:57 | 000,000,000 | ---D | M] -- C:\Users\Jerry\AppData\Roaming\WinBatch
[2011/11/26 21:23:56 | 000,032,642 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2011/11/21 07:48:22 | 000,148,931 | ---- | M] () -- C:\aaw7boot.log
[2009/04/11 00:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2009/05/27 18:43:38 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2009/05/27 18:18:09 | 000,000,010 | ---- | M] () -- C:\csb.log
[2009/08/12 11:07:07 | 000,000,648 | ---- | M] () -- C:\CTSUFile.txt
[2011/01/21 11:47:54 | 001,228,854 | ---- | M] () -- C:\fsqwr.bmp
[2011/01/22 14:49:16 | 000,007,212 | ---- | M] () -- C:\JavaRa.log
[2006/12/01 22:37:14 | 000,904,704 | ---- | M] (Microsoft Corporation) -- C:\msdia80.dll
[2011/11/26 21:30:59 | 312,020,991 | -HS- | M] () -- C:\pagefile.sys
[2008/05/27 10:38:56 | 000,005,552 | R--- | M] () -- C:\ReadMe.htm
[2011/11/22 15:07:19 | 000,000,400 | ---- | M] () -- C:\rkill.log

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 15:35:48 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 21:21:14 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/04/11 10:40:53 | 000,000,444 | -HS- | M] () -- C:\Users\Jerry\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/11/26 09:16:40 | 004,307,814 | R--- | M] (Swearware) -- C:\Users\Jerry\Desktop\ComboFix.exe
[2011/11/26 15:15:21 | 002,565,464 | ---- | M] () -- C:\Users\Jerry\Desktop\NTBR_CD.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/10/26 18:17:13 | 000,000,402 | -HS- | M] () -- C:\Users\Jerry\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2009/06/03 16:43:46 | 010,444,800 | ---- | M] () -- C:\ProgramData\sandra.mda

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:07BF512B
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:890CC2F3
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:0CE7F3C9

< End of report >

 

[Broni]

Which browser is affected?

 

[Iowabucks]

I only use Internet Explorer. I downloaded Firefox years ago but never use it. I deleted it recently.

 

[Broni]

I'm afraid that without successfully resetting your MBR we won't be able to fix this issue.

Let's go back to my reply #14...
What kind of DVD did you use to get to command prompt.
Is this straight Vista installation, no dual boot, or such?
When you run bootrec /fixmbr command what message are you getting after pressing Enter?
If you don't remember redo all steps.

 

[Iowabucks]

What kind of DVD did you use to get to command prompt.
Is this straight Vista installation, no dual boot, or such?
.

It was my original Windows Vista Installation disc that includes service pack 1, 64 bit. No dual boot.

I'll give the original boot disc a try again and report back. I just remember it didn't show my operating system for some reason. I do have a partition and the OS is on my C;/ drive. Then it asked to load drivers to find it? the folder it opened had files that are way over my head so i just clicked continue with no OS highlighted. It then took me to the screen i could pick "command prompt". I can't remember exactly what it said after that. I'll try it again and get back with you.

Thanks for keeping up with me tonight.

 

[Iowabucks]

It did not show an OS. It said "If you do not see your operating system, click load drivers to load drivers for your hard discs." I don't have any CD's that came with my hard drive. So i clicked continue even though it didn't shaow an OS.

I could then choose command prompt from the list of 5 or 6 items. I put in the command and it said "The operation completed successfully".

Did it really do anything if i did not have an operating system showing in the system recovery toolbox?

 

[Broni]

It did not show an OS

It think that's the reason why it's not working.
Possibly because you have SP2 installed and your Vista DVD has only SP1 on it.

Try to create the other DVD I mentioned in my instructions (case when you don't have Vista DVD).

 

[Iowabucks]

There is a command on the rootkit text that says "to disinfect the master boot sector, use the following command "*****"

Would this program fix the problem too? Just wondering. I definately wont do anything without a yes reply from you.

I think it may have gotten rid of the redirect problem. ( I take that back) . The occational random audio programs in the background with no applications showing, is still there. Email hyperlinks still don't work. Thats all i see at the moment.

 

[Iowabucks]

I took ownership of the System32 folder and created a boot DVD. Got the very same results. No OS system was showing.

Maybe tommorrow i will try to download a driver for the HD and see if i can get that to load.

Thanks for sticking with me tonight. Got alot done. I wont be on near as much tommorrow, maybe early and late in the day. Thanks Broni.


I do have some sort of registry copy i made that can be replaced if need be. Erunt i believe. Would that help me out? It saved my butt once before.