Inactive Google Redirect Virus Removal Win 7 64 Bit

MarkFromNJ · Jan 21, 2011

I tried all the usual suspects and nothing finds anything. When I click on a search result I get redirected to another site with a list of siimilar items. This machine is behind a NAT firewall which has been reset to factory defaults and is OK. It has never been used for any kind of file sharing/music/movie/porn downloads etc. Not sure that makes any difference...
Mark

(DDS Attach is in next post)

MALWAREBYTES

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5566

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

1/21/2011 8:06:10 PM
mbam-log-2011-01-21 (20-06-10).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 618052
Time elapsed: 38 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\wnxmal (Rogue.SecuritySuite) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

*****************************************************************************************************

GMER LOG

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-21 20:28:06
Windows 6.1.7600
Running: GMERfil.exe

---- Registry - GMER 1.0.15 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{566BFFEA-B4B2-E9BD-EF6B-0A2A90EA1AD3}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{566BFFEA-B4B2-E9BD-EF6B-0A2A90EA1AD3}@haakpcdccmjjgaif 0x6B 0x61 0x6A 0x67 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{566BFFEA-B4B2-E9BD-EF6B-0A2A90EA1AD3}@haakpcdcemlhnmjd 0x64 0x62 0x70 0x68 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{566BFFEA-B4B2-E9BD-EF6B-0A2A90EA1AD3}@iaehmconjilnoceelo 0x69 0x61 0x63 0x6F ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{566BFFEA-B4B2-E9BD-EF6B-0A2A90EA1AD3}@hakgocfnjokngebb 0x6A 0x61 0x6E 0x6E ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BAC5F9B8-B87D-FEB8-EBAE-39291BC201A3}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BAC5F9B8-B87D-FEB8-EBAE-39291BC201A3}@iaefgblgdbmagjlale 0x6A 0x61 0x67 0x70 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BAC5F9B8-B87D-FEB8-EBAE-39291BC201A3}@hakeeijgdocllegb 0x6B 0x61 0x61 0x61 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BAC5F9B8-B87D-FEB8-EBAE-39291BC201A3}@haaeniljaafjionj 0x6B 0x61 0x6A 0x65 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BAC5F9B8-B87D-FEB8-EBAE-39291BC201A3}@haaeniljgnpielfe 0x64 0x62 0x70 0x66 ...

---- EOF - GMER 1.0.15 ----

*****************************************************************************************************

DDS LOG

DDS (Ver_10-12-12.02) - NTFS_AMD64
Run by mark at 20:31:04.31 on Fri 01/21/2011
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_21
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8180.6119 [GMT -5:00]

AV: Spyware Doctor with AntiVirus *Disabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}
AV: Microsoft Security Essentials *Disabled/Updated* {BF5CEBDC-F2D3-7540-343C-F0CE11FD6E66}
SP: Microsoft Security Essentials *Disabled/Updated* {043D0A38-D4E9-7ACE-0E8C-CBBC6A7A24DB}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Spyware Doctor *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}

============== Running Processes ===============

C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\nvvsvc.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\Program Files\WTouch\WTouchService.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\windows\system32\nvvsvc.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
C:\windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe
C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
C:\Program Files (x86)\LogMeIn\x64\LMIGuardian.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe
C:\Program Files (x86)\Motorola\Moto Helper Service\MotoHelper.exe
c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
C:\windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
C:\windows\System32\svchost.exe -k HPZ12
C:\windows\System32\rpcnetp.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\ThpSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\windows\system32\taskhost.exe
C:\Program Files\WTouch\WTouchUser.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\spool\DRIVERS\x64\3\HP1006MC.EXE
C:\windows\system32\svchost.exe -k HPService
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnect.exe
C:\windows\system32\Dwm.exe
C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Windows\System32\ThpSrv.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe
C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\UCS\Virtual Account Numbers\CitiUCS.exe
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\DivX\DivX Plus Web Player\DDMService.exe
C:\Windows\SysWOW64\OBroker.exe
C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\TOSHIBA\FlashCards\Hotkey\TcrdKBB.exe
C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\TOSHIBA\HDMICtrlMan\HCMSoundChanger.exe
C:\windows\system32\taskeng.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\windows\explorer.exe
C:\windows\system32\wuauclt.exe
C:\windows\system32\svchost.exe -k SDRSVC
C:\windows\explorer.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\system32\DllHost.exe
C:\Users\mark\Downloads\___MALWARE\dds.exe
C:\windows\system32\conhost.exe
C:\windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.optonline.net/
uDefault_Page_URL = hxxp://www.google.com/ig?brand=TSNA&bmod=TSNA
mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
uInternet Settings,ProxyOverride = <local>;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:6092
uURLSearchHooks: H - No File
mWinlogon: Userinit=userinit.exe,
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: OToolbarHelper Class: {7aed0dc9-374e-440d-b966-be292971225b} - C:\Program Files (x86)\UCS\Virtual Account Numbers\CitiUCSHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Virtual Account Numbers: {a1bdf46b-9de6-4090-8791-84f26e00934c} - C:\Program Files (x86)\UCS\Virtual Account Numbers\CitiUCSToolbar.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [OpenDNS Updater] "C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe" /autostart
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
mRun: [UCS Virtual Account Numbers] C:\PROGRA~2\UCS\VIRTUA~1\CitiUCS.exe /lang=en_RG /dontopenmycards
mRun: [<NO NAME>]
mRun: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
mRun: [Google Quick Search Box] "C:\Program Files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
Trusted Zone: intuit.com\ttlc
DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-US/wlscctrl2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: jpip - {B92DD248-E3D5-4A92-B311-C9B841681455} - C:\Program Files (x86)\LizardTech\Express View\expressview.dll
Handler: sidlet - {B92DD248-E3D5-4A92-B311-C9B841681455} - C:\Program Files (x86)\LizardTech\Express View\expressview.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
AppInit_DLLs: C:\PROGRA~2\Google\GOOGLE~4\GO36F4~1.DLL
IFEO: taskmgr.exe - "K"
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg64.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
TB-X64: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [(Default)]
mRun-x64: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t
mRun-x64: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
mRun-x64: [HDMICtrlMan] %ProgramFiles%\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe
mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun-x64: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun-x64: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun-x64: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
mRun-x64: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
mRun-x64: [TosWaitSrv] %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
mRun-x64: [ThpSrv] C:\windows\system32\thpsrv /logon
mRun-x64: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
mRun-x64: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
mRun-x64: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
mRun-x64: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
IFEO-X64: taskmgr.exe - "K"

================= FIREFOX ===================

FF - ProfilePath - C:\Users\mark\AppData\Roaming\Mozilla\Firefox\Profiles\rxtkzg0n.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - prefs.js: network.proxy.type - 0
FF - component: C:\Users\mark\AppData\Roaming\Mozilla\Firefox\Profiles\rxtkzg0n.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: C:\Users\mark\AppData\Roaming\Mozilla\Firefox\Profiles\rxtkzg0n.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Google Updater\2.4.2166.3772\npCIDetect14.dll
FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: C:\Program Files (x86)\TabletPlugins\npwacom.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\mark\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Users\mark\AppData\Roaming\Mozilla\Firefox\Profiles\rxtkzg0n.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF - Ext: XULRunner: {B1EBAD7E-4D02-4A41-86A7-A8573DE581EB} - C:\Users\mark\AppData\Local\{B1EBAD7E-4D02-4A41-86A7-A8573DE581EB}
FF - Ext: DownThemAll!: {DDC359D1-844A-42a7-9AA1-88A850A938A8} - %profile%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: LogMeIn, Inc. Remote Access Plugin: LogMeInClient@logmein.com - %profile%\extensions\LogMeInClient@logmein.com

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;C:\Windows\System32\drivers\PCTCore64.sys [2011-1-17 257232]
R0 pctDS;PC Tools Data Store;C:\Windows\System32\drivers\pctDS64.sys [2011-1-17 452872]
R0 pctEFA;PC Tools Extended File Attributes;C:\Windows\System32\drivers\pctEFA64.sys [2011-1-17 816016]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-2-5 55856]
R0 Thpdrv;TOSHIBA HDD Protection Driver;C:\Windows\System32\drivers\thpdrv.sys [2009-6-29 34880]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;C:\Windows\System32\drivers\Thpevm.sys [2009-6-29 14784]
R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\Windows\System32\drivers\tos_sps64.sys [2010-2-4 482384]
R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2009-6-18 173984]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-10-27 252784]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448]
R2 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-1-17 30192]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-2-4 13336]
R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files (x86)\LogMeIn\x64\rainfo.sys [2010-1-27 15928]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\Windows\System32\drivers\LMIRfsDriver.sys [2010-8-20 72216]
R2 MotoConnect Service;MotoConnect Service;C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-8-14 91456]
R2 MotoHelper.exe;Motorola Helper;C:\Program Files (x86)\Motorola\Moto Helper Service\MotoHelper.exe [2010-4-21 6656]
R2 regi;regi;C:\Windows\System32\drivers\regi.sys [2007-4-16 14112]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\Windows\System32\drivers\TVALZFL.sys [2009-6-19 14472]
R2 WTouchService;WTouch Service;C:\Program Files\WTouch\WTouchService.exe [2010-4-12 127784]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2009-11-13 67072]
R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\System32\drivers\MpNWMon.sys [2009-6-18 40832]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\System32\drivers\nvhda64v.sys [2009-8-21 84512]
R3 O2MDGRDR;O2MDGRDR;C:\Windows\System32\drivers\o2mdgx64.sys [2009-11-3 74016]
R3 O2SDGRDR;O2SDGRDR;C:\Windows\System32\drivers\o2sdgx64.sys [2009-8-18 49568]
R3 PGEffect;Pangu effect driver;C:\Windows\System32\drivers\PGEffect.sys [2010-2-4 35008]
R3 pnetmdm;PdaNet Modem;C:\Windows\System32\drivers\pnetmdm64.sys [2010-8-14 17920]
R3 QIOMem;Generic IO & Memory Access;C:\Windows\System32\drivers\QIOMem.sys [2009-6-15 12800]
R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;C:\Windows\System32\drivers\rtl8192se.sys [2010-4-26 1103904]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-11-5 137560]
R3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2009-11-10 824688]
RUnknown rpcnetp;rpcnetp; [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-1-17 136176]
S3 androidusb;ADB Interface Driver;C:\Windows\System32\drivers\motoandroid.sys [2009-7-10 31744]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-2-5 1038088]
S3 JMCR_CF;JMCR_CF;C:\Windows\System32\drivers\jmcr_cf.sys [2007-7-30 35840]
S3 mbedComposite;mbedComposite;C:\Windows\System32\drivers\mbedComposite_x64.sys [2011-1-5 49200]
S3 mbedSerial_x64;mbedSerial_x64;C:\Windows\System32\drivers\mbedSerial_x64.sys [2011-1-5 61488]
S3 MotDev;Motorola Inc. USB Device;C:\Windows\System32\drivers\motodrv.sys [2009-5-8 53632]
S3 sdAuxService;PC Tools Auxiliary Service;C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe [2011-1-17 366840]
S3 sdCoreService;PC Tools Security Service;C:\Program Files (x86)\PC Tools Security\pctsSvc.exe [2011-1-17 1150936]
S3 silabenm;NetBurner Development Kit USB to UART Bridge Serial Port Enumerator Driver;C:\Windows\System32\drivers\silabenm.sys [2010-12-13 23040]
S3 silabser;NetBurner Development Kit USB to UART Bridge Driver;C:\Windows\System32\drivers\silabser.sys [2010-12-13 71168]
S3 SMSIVZAM5X64;SMSIVZAM5X64 NDIS Protocol Driver;C:\PROGRA~2\VERIZO~1\VZACCE~1\SMSIVZAM5X64.SYS [2009-5-25 43032]
S3 SUSTUCAM;Susteen USB Cable Modem Driver;C:\Windows\System32\drivers\sustucam.sys [2009-1-7 56832]
S3 SUSTUCAP;Susteen USB Cable Port Driver;C:\Windows\System32\drivers\sustucap.sys [2009-1-7 56832]
S3 SUSTUCAU;Susteen USB Cable USB Driver;C:\Windows\System32\drivers\sustucau.sys [2009-1-7 33792]
S3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-2-4 51512]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-9-28 51712]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920]
S3 wacmoumonitor;Wacom Mode Helper;C:\Windows\System32\drivers\wacmoumonitor.sys [2010-4-12 18216]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-12 1255736]
S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\System32\drivers\WSDPrint.sys [2009-7-13 23040]
S4 Akamai;Akamai NetSession Interface;C:\windows\System32\svchost.exe -k Akamai [2009-7-13 27136]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqladhlp.exe [2008-7-10 47128]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-7-10 369688]
S4 SynoDrService;SynoDrService;C:\Program Files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe [2010-1-7 404480]
S4 TabletServicePen;TabletServicePen;C:\Windows\System32\Pen_Tablet.exe [2010-4-12 5556520]

=============== File Associations ===============

.scr=DWGTrueViewScriptFile

=============== Created Last 30 ================

2011-01-22 01:08:55 7844688 ----a-w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\{D70C3752-5482-4C05-B89B-6216AFF0A32E}\mpengine.dll
2011-01-22 01:08:23 17920 ----a-w- C:\windows\SysWow64\rpcnetp.dll
2011-01-22 01:08:10 17920 ----a-w- C:\windows\SysWow64\rpcnetp.exe
2011-01-21 19:19:32 -------- d-----w- C:\Users\mark\AppData\Roaming\Malwarebytes
2011-01-21 19:19:28 38224 ----a-w- C:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-01-21 19:19:27 -------- d-----w- C:\PROGRA~3\Malwarebytes
2011-01-21 19:19:25 24152 ----a-w- C:\windows\System32\drivers\mbam.sys
2011-01-21 19:19:25 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-01-18 08:55:55 -------- d-----w- C:\Users\mark\AppData\Roaming\Local
2011-01-18 08:44:54 -------- d-----w- C:\divx
2011-01-18 08:37:30 -------- d-----w- C:\Program Files\DivX
2011-01-18 08:37:09 -------- d-----w- C:\Program Files (x86)\Common Files\DivX Shared
2011-01-18 08:36:27 -------- d-----w- C:\Program Files (x86)\DivX
2011-01-18 08:36:03 -------- d-----w- C:\PROGRA~3\DivX
2011-01-18 08:21:44 -------- d-----w- C:\Users\mark\AppData\Roaming\NVIDIA
2011-01-17 07:11:42 816016 ----a-w- C:\windows\System32\drivers\pctEFA64.sys
2011-01-17 07:11:42 452872 ----a-w- C:\windows\System32\drivers\pctDS64.sys
2011-01-17 07:11:38 331368 ----a-w- C:\windows\System32\drivers\pctgntdi64.sys
2011-01-17 07:11:38 136168 ----a-w- C:\windows\System32\drivers\pctwfpfilter64.sys
2011-01-17 07:11:29 257232 ----a-w- C:\windows\System32\drivers\PCTCore64.sys
2011-01-17 07:11:08 92896 ----a-w- C:\windows\System32\drivers\pctplsg64.sys
2011-01-17 07:10:32 -------- d-----w- C:\Users\mark\AppData\Roaming\PC Tools
2011-01-17 07:10:32 -------- d-----w- C:\Program Files (x86)\PC Tools Security
2011-01-17 07:10:32 -------- d-----w- C:\Program Files (x86)\Common Files\PC Tools
2011-01-17 07:10:32 -------- d-----w- C:\PROGRA~3\PC Tools
2011-01-17 07:07:43 119808 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\GoogleDesktopMozilla.dll
2011-01-17 06:36:16 -------- d-----w- C:\Users\mark\AppData\Local\ElevatedDiagnostics
2011-01-17 05:44:00 24416 ----a-r- C:\windows\System32\AdobePDFUI.dll
2011-01-13 06:27:37 -------- d-----w- C:\Users\mark\AppData\Local\Quicken WillMaker Plus 2010
2011-01-12 11:33:11 -------- d-----w- C:\Program Files\iPod
2011-01-12 11:33:10 -------- d-----w- C:\Program Files\iTunes
2011-01-12 11:33:10 -------- d-----w- C:\Program Files (x86)\iTunes
2011-01-12 09:12:51 -------- d-----w- C:\Users\mark\AppData\Local\Apple
2011-01-12 08:24:02 -------- d-----w- C:\Users\mark\AppData\Local\Microsoft Help
2011-01-05 13:02:58 61488 ----a-w- C:\windows\System32\drivers\mbedSerial_x64.sys
2011-01-05 13:02:58 49200 ----a-w- C:\windows\System32\drivers\mbedComposite_x64.sys
2011-01-05 13:02:58 -------- d-----w- C:\Program Files\mbed
2011-01-05 13:02:57 197120 ----a-w- C:\windows\System32\mbedClassCoInst_x64.dll
2010-12-31 15:04:04 522224 ----a-w- C:\windows\SysWow64\Difxac74.rra
2010-12-29 01:27:51 -------- d-----w- C:\nburn
2010-12-27 10:05:06 -------- d-----w- C:\MinGW
2010-12-26 14:09:50 -------- d-----w- C:\Users\mark\.netbeans
2010-12-26 14:09:50 -------- d-----w- C:\Users\mark\.nbprofiler
2010-12-26 14:09:48 -------- d-----w- C:\Users\mark\AppData\Roaming\.visualvm
2010-12-24 16:33:42 -------- d-----w- C:\EclipseWorkspace
2010-12-24 07:49:00 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation
2010-12-24 07:48:50 -------- d-----w- C:\PROGRA~3\NVIDIA Corporation
2010-12-24 07:48:40 -------- d-----w- C:\Program Files\NVIDIA Corporation
2010-12-23 09:31:45 -------- d-----w- C:\Program Files\Lantronix

==================== Find3M ====================

2011-01-22 01:08:10 17920 ----a-w- C:\windows\System32\rpcnetp.exe
2011-01-21 19:06:30 44544 ----a-w- C:\windows\SysWow64\agremove.exe
2010-12-01 19:06:31 125512 ----a-w- C:\windows\System32\drivers\AnyDVD.sys
2010-11-30 20:43:40 41128 ----a-w- C:\windows\System32\drivers\ElbyCDIO.sys
2010-11-29 22:38:30 94208 ----a-w- C:\windows\SysWow64\QuickTimeVR.qtx
2010-11-29 22:38:30 69632 ----a-w- C:\windows\SysWow64\QuickTime.qts
2010-11-25 18:29:05 89256 ----a-w- C:\windows\SysWow64\ElbyCDIO.dll
2010-11-12 00:44:54 94208 ----a-w- C:\windows\SysWow64\dpl100.dll
2010-11-08 22:57:04 353592 ----a-w- C:\windows\SysWow64\DivXControlPanelApplet.cpl
2010-11-04 06:35:53 1194496 ----a-w- C:\windows\System32\wininet.dll
2010-11-04 06:31:34 57856 ----a-w- C:\windows\System32\licmgr10.dll
2010-11-04 05:52:17 978944 ----a-w- C:\windows\SysWow64\wininet.dll
2010-11-04 05:48:36 44544 ----a-w- C:\windows\SysWow64\licmgr10.dll
2010-11-04 05:16:14 482816 ----a-w- C:\windows\System32\html.iec
2010-11-04 04:41:26 386048 ----a-w- C:\windows\SysWow64\html.iec
2010-11-04 04:35:37 1638912 ----a-w- C:\windows\System32\mshtml.tlb
2010-11-04 04:08:54 1638912 ----a-w- C:\windows\SysWow64\mshtml.tlb
2010-11-02 05:21:51 982912 ----a-w- C:\windows\System32\drivers\dxgkrnl.sys
2010-11-02 05:18:59 662528 ----a-w- C:\windows\System32\XpsPrint.dll
2010-11-02 05:18:59 229888 ----a-w- C:\windows\System32\XpsRasterService.dll
2010-11-02 05:18:58 470016 ----a-w- C:\windows\System32\XpsGdiConverter.dll
2010-11-02 05:18:17 524288 ----a-w- C:\windows\System32\wmicmiplugin.dll
2010-11-02 05:17:38 473600 ----a-w- C:\windows\System32\taskcomp.dll
2010-11-02 05:17:38 1169408 ----a-w- C:\windows\System32\taskschd.dll
2010-11-02 05:16:53 1114624 ----a-w- C:\windows\System32\schedsvc.dll
2010-11-02 05:12:53 1133568 ----a-w- C:\windows\System32\FntCache.dll
2010-11-02 05:12:25 1540608 ----a-w- C:\windows\System32\DWrite.dll
2010-11-02 05:12:08 1837568 ----a-w- C:\windows\System32\d3d10warp.dll
2010-11-02 05:12:07 320512 ----a-w- C:\windows\System32\d3d10_1core.dll
2010-11-02 05:12:06 902656 ----a-w- C:\windows\System32\d2d1.dll
2010-11-02 05:12:06 197120 ----a-w- C:\windows\System32\d3d10_1.dll
2010-11-02 05:10:47 464384 ----a-w- C:\windows\System32\taskeng.exe
2010-11-02 05:10:32 285696 ----a-w- C:\windows\System32\schtasks.exe
2010-11-02 04:59:08 144384 ----a-w- C:\windows\System32\cdd.dll
2010-11-02 04:41:36 442880 ----a-w- C:\windows\SysWow64\XpsPrint.dll
2010-11-02 04:41:36 283648 ----a-w- C:\windows\SysWow64\XpsGdiConverter.dll
2010-11-02 04:41:36 135168 ----a-w- C:\windows\SysWow64\XpsRasterService.dll
2010-11-02 04:40:36 496128 ----a-w- C:\windows\SysWow64\taskschd.dll
2010-11-02 04:40:36 305152 ----a-w- C:\windows\SysWow64\taskcomp.dll
2010-11-02 04:35:51 1074176 ----a-w- C:\windows\SysWow64\DWrite.dll
2010-11-02 04:35:35 1170944 ----a-w- C:\windows\SysWow64\d3d10warp.dll
2010-11-02 04:35:34 739840 ----a-w- C:\windows\SysWow64\d2d1.dll
2010-11-02 04:35:34 218624 ----a-w- C:\windows\SysWow64\d3d10_1core.dll
2010-11-02 04:35:34 161792 ----a-w- C:\windows\SysWow64\d3d10_1.dll
2010-11-02 04:34:44 192000 ----a-w- C:\windows\SysWow64\taskeng.exe
2010-11-02 04:34:33 179712 ----a-w- C:\windows\SysWow64\schtasks.exe
2010-11-02 02:50:58 258048 ----a-w- C:\windows\System32\drivers\dxgmms1.sys
2010-10-30 05:42:54 108032 ----a-w- C:\windows\SysWow64\ff_vfw.dll
2010-10-30 05:42:30 50688 ----a-w- C:\windows\SysWow64\ff_acm.acm
2010-10-27 05:06:22 2048 ----a-w- C:\windows\System32\tzres.dll
2010-10-27 04:32:36 2048 ----a-w- C:\windows\SysWow64\tzres.dll

============= FINISH: 20:31:28.41 ===============

MarkFromNJ · Jan 21, 2011

Dds attach

DS ATTACH

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 2/4/2010 3:55:22 AM
System Uptime: 1/21/2011 8:08:03 PM (0 hours ago)

Motherboard: TOSHIBA | | Qosmio X505
Processor: Intel(R) Core(TM) i7 CPU Q 720 @ 1.60GHz | CPU 1 | 1600/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 137 GiB total, 25.864 GiB free.
D: is FIXED (NTFS) - 466 GiB total, 125.745 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Description: Photosmart 3200 series
Device ID: ROOT\IMAGE\0001
Manufacturer: HP
Name: Photosmart 3200 series
PNP Device ID: ROOT\IMAGE\0001
Service: StillCam

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Virtual WiFi Miniport Adapter
Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&14BCE7CD&0&01
Manufacturer: Microsoft
Name: Microsoft Virtual WiFi Miniport Adapter
PNP Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&14BCE7CD&0&01
Service: vwifimp

Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: HP LaserJet P2055dn
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: Hewlett-Packard
Name: HP LaserJet P2055dn
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:

Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Photosmart C6200 series
Device ID: ROOT\MULTIFUNCTION\0001
Manufacturer: HP
Name: Photosmart C6200 series
PNP Device ID: ROOT\MULTIFUNCTION\0001
Service:

Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Photosmart Pro B9100 series
Device ID: ROOT\MULTIFUNCTION\0002
Manufacturer: HP
Name: Photosmart Pro B9100 series
PNP Device ID: ROOT\MULTIFUNCTION\0002
Service:

Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Photosmart 3200 series
Device ID: ROOT\MULTIFUNCTION\0003
Manufacturer: HP
Name: Photosmart 3200 series
PNP Device ID: ROOT\MULTIFUNCTION\0003
Service:

Class GUID: {4d36e968-e325-11ce-bfc1-08002be10318}
Description: LogMeIn Mirror Driver
Device ID: ROOT\DISPLAY\0000
Manufacturer: LogMeIn, Inc.
Name: LogMeIn Mirror Driver
PNP Device ID: ROOT\DISPLAY\0000
Service: lmimirr

Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Description: Photosmart C6200 series
Device ID: ROOT\IMAGE\0000
Manufacturer: HP
Name: Photosmart C6200 series
PNP Device ID: ROOT\IMAGE\0000
Service: StillCam

==== System Restore Points ===================

RP440: 1/17/2011 12:43:34 AM - Windows Update
RP441: 1/17/2011 2:37:41 AM - Cleaned registry with Windows Live OneCare safety scanner
RP442: 1/17/2011 9:44:25 AM - Spyware Doctor: Cleaning Threats
RP443: 1/18/2011 1:50:36 AM - Windows Update
RP444: 1/19/2011 7:45:52 AM - Windows Update
RP445: 1/20/2011 1:50:36 AM - Windows Update
RP446: 1/21/2011 2:48:40 AM - Windows Update

==== Installed Programs ======================

2007 Microsoft Office Suite Service Pack 2 (SP2)
3100_3200_3300_Help
3100_3200_3300trb
3200
950000 ClickArt
AddCustomPaper
Adobe Acrobat 9 Pro - English, Français, Deutsch
Adobe Acrobat 9.4.1 - CPSID_83708
Adobe After Effects CS4
Adobe After Effects CS4 Presets
Adobe After Effects CS4 Template Projects & Footage
Adobe After Effects CS4 Third Party Content
Adobe AIR
Adobe Anchor Service CS4
Adobe Bridge CS4
Adobe CMaps CS4
Adobe Color - Photoshop Specific CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Color Video Profiles AE CS4
Adobe Color Video Profiles CS CS4
Adobe Creative Suite 4 Master Collection
Adobe CS4 American English Speech Analysis Models
Adobe CSI CS4
Adobe Default Language CS4
Adobe Dreamweaver CS4
Adobe Dynamiclink Support
Adobe Encore CS4
Adobe Encore CS4 Codecs
Adobe Encore CS4 Library
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash CS4
Adobe Flash CS4 Extension - Flash Lite STI en
Adobe Flash CS4 STI-en
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Illustrator CS4
Adobe InDesign CS4
Adobe InDesign CS4 Application Feature Set Files (Roman)
Adobe InDesign CS4 Common Base Files
Adobe InDesign CS4 Icon Handler
Adobe Linguistics CS4
Adobe Media Encoder CS4
Adobe Media Encoder CS4 Additional Exporter
Adobe Media Encoder CS4 Dolby
Adobe Media Encoder CS4 Exporter
Adobe Media Encoder CS4 Importer
Adobe MotionPicture Color Files CS4
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS4
Adobe Photoshop CS4 Support
Adobe Photoshop.com Inspiration Browser
Adobe Premiere Elements 8.0
Adobe Premiere Elements 8.0 Templates
Adobe Premiere Pro CS4
Adobe Premiere Pro CS4 Functional Content
Adobe Premiere Pro CS4 Third Party Content
Adobe Reader 9.4.0
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe SGM CS4
Adobe Shockwave Player 11.5
Adobe SING CS4
Adobe Soundbooth CS4
Adobe Soundbooth CS4 Codecs
Adobe Type Support CS4
Adobe Update Manager CS4
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
AIO_CDB_ProductContext
AIO_CDB_Software
AIO_Scan
Amazon MP3 Downloader 1.0.10
AnyDVD
Apple Application Support
Apple Software Update
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
audT30b
Autodesk Design Review 2011
AviSynth 2.5
B9100
Badaboom 1.2.1.367
BSIZE_CDA_B9100_Software_Min
BufferChm
C6200
C6200_Help
CDBurnerXP
Compatibility Pack for the 2007 Office system
Connect
Copy
DataPilot
Destinations
DeviceDiscovery
Direct DiscRecorder
DivX Setup
DocProc
DreamStation DXi2
DVD Decrypter (Remove Only)
DVD MovieFactory for TOSHIBA
DVD Shrink 3.2
DxO Optics Pro 6
EAGLE 5.6.0
EasyBCD 2.0
Emicsoft M2TS Converter
ExpressCard CF Adapter
ExpressPCB
Fax
ffdshow v1.1.3631 [2010-11-15]
File Shredder 2.0
FileZilla Client 3.3.4.1
Front Panel Designer
GlassWare Tube Manual
Google Apps
Google Chrome
Google Desktop
Google Earth
Google SketchUp 7
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
GPBaseService2
GPL Ghostscript 9.00
Haali Media Splitter
HDMI Control Manager
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946344)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB948127)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB951708)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB948127)
Hotfix for Microsoft Visual Studio 2008 Remote Debugger Light (x64) - ENU (KB944899)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB946344)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB946581)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU (KB951708)
HP LaserJet P1500 series
HP Photosmart Pro print plug-in for Adobe Photoshop ®
HP Update
HPPhotoGadget
HPPhotoSmartDiscLabel_PaperLabel
HPPhotoSmartDiscLabel_PrintOnDisc
HPPhotoSmartDiscLabelContent1
hpphotosmartdisclabelplugin
HPPhotosmartEssential
HPProductAssistant
HPSSupply
Intel(R) Control Center
Intel(R) Rapid Storage Technology
InterVideo WinDVD BD for TOSHIBA
IrfanView (remove only)
iSEEK AnswerWorks English Runtime
Java Auto Updater
Java(TM) 6 Update 21
Java(TM) SE Development Kit 6 Update 21
Junk Mail filter update
KODAK Gallery Upload Software
kuler
LG USB Modem driver
Lizardtech Express View Browser Plug-in
LogMeIn
Malwarebytes' Anti-Malware
MarketResearch
Microsoft Choice Guard
Microsoft Document Explorer 2008
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office SharePoint Designer 2007 Service Pack 2 (SP2)
Microsoft Office Visio Professional 2003
Microsoft Office Visual Web Developer 2007
Microsoft Office Visual Web Developer MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server 2008
Microsoft SQL Server 2008 Browser
Microsoft SQL Server 2008 Common Files
Microsoft SQL Server 2008 Database Engine Services
Microsoft SQL Server 2008 Database Engine Shared
Microsoft SQL Server 2008 Management Objects
Microsoft SQL Server 2008 RsFx Driver
Microsoft SQL Server 2008 Setup Support Files (English)
Microsoft SQL Server Compact 3.5 SP1 Design Tools English
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft SQL Server Database Publishing Wizard 1.3
Microsoft Visual Basic 2008 Express Edition with SP1 - ENU
Microsoft Visual C# 2008 Express Edition with SP1 - ENU
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Express Edition with SP1 - ENU
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual J# 2.0 Redistributable Package
Microsoft Visual Studio 2008 Remote Debugger Light (x64) - ENU Service Pack 1 (KB945140)
Microsoft Visual Studio Web Authoring Component
Microsoft Visual Web Developer 2008 Express Edition with SP1 - ENU
Microsoft WorldWide Telescope
MinGW-Get version 0.1-alpha-5
Moto Helper Service
MotoConnect
Movavi Video Suite 8
Movavi Video Suite 8 Help
Mozilla Firefox (3.6.13)
Mozilla Thunderbird (3.1.7)
MPLAB C for dsPIC DSCs and PIC24 MCUs - Lite
MPLAB C18 v3.35 Lite
MPLAB C32 v1.05
MPLAB Tools v8.46
MrvlUsgTracking
MSDN Library for Visual Studio 2008 SP1
MSDN Library for Visual Studio 2008 SP1 - ENU
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NetBurner Development Kit USB to UART Bridge (Driver Removal)
NetBurner NNDK
Novarm DipTrace
NVIDIA PhysX
O2Micro Flash Memory Card Windows Driver
OpenDNS Updater 2.2.1
PdaNet for Android 2.42
PDF Settings CS4
Pen Tablet
Photoshop Camera Raw
Picasa 3
Pinnacle Studio 12
Pixel Bender Toolkit
PL-2303 USB-to-Serial
Podium
Portrait Professional Studio 9.1
Programmer's Notepad 2
PS_AIO_02_ProductContext
PS_AIO_02_Software
PS_AIO_02_Software_Min
Push-Pull Calculator 2
PuTTY version 0.60
Quick Screen Capture 3.0
Quicken WillMaker Plus 2010
QuickTime
Realtek WLAN Driver
RescuePRO 3.2
RSDLite
Safari
Scan
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
SketchUp DWG Importer
Skype Launcher
Skype Toolbars
Skype™ 4.2
SmartSound Quicktracks for Premiere Elements 8.0
SmartWebPrinting
SolutionCenter
Sony Sound Forge Audio Studio 9.0
Sony Vocal Eraser
Spelling Dictionaries Support For Adobe Reader 9
Spyware Doctor with AntiVirus 8.0
Sql Server Customer Experience Improvement Program
SQL Server System CLR Types
Status
Suite Shared Configuration CS4
SuperSpice
Susteen Launcher
Synology Assistant (remove only)
Synology Data Replicator 3
Synology Download Redirector
TCJ Filter Designer
TDSL Personal Edition 1.1
Toolbox
TopStudio EasyCrypto 2000
TOSHIBA Application Installer
TOSHIBA Assist
TOSHIBA Bulletin Board
TOSHIBA ConfigFree
TOSHIBA DVD PLAYER
TOSHIBA Extended Tiles for Windows Mobility Center
TOSHIBA Face Recognition
TOSHIBA Hardware Setup
TOSHIBA HDD/SSD Alert
TOSHIBA Media Controller
TOSHIBA Quality Application
TOSHIBA Service Station
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
TOSHIBA Supervisor Password
TOSHIBA USB Sleep and Charge Utility
TOSHIBA Value Added Package
TOSHIBA Web Camera Application
ToshibaRegistration
TrayApp
TreeSize Personal 5.2
TurboCAD Deluxe 15
TurboTax 2009
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 wnjiper
TurboTax 2009 wrapper
Uninstall PGE
Universal Document Converter (Demo)
UnloadSupport
Update for 2007 Microsoft Office System (KB2284654)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2412171)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Microsoft Visual Studio Web Authoring Component (KB945140)
Update for Outlook 2007 Junk Email Filter (KB2483110)
VC80CRTRedist - 8.0.50727.4053
ViewMate Deluxe 11.0
Virtual Account Numbers
Visviva Animation Player
VLC media player 1.0.3
VZAccess Manager
WebReg
WebTablet IE Plugin
WebTablet Netscape Plugin
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live OneCare safety scanner
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Player Firefox Plugin
WinSCP 4.2.9

==== Event Viewer Messages From Past Week ========

1/21/2011 8:09:27 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
1/21/2011 2:15:50 PM, Error: Service Control Manager [7034] - The Google Desktop Manager 5.9.1005.12335 service terminated unexpectedly. It has done this 1 time(s).
1/21/2011 2:15:50 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
1/20/2011 9:53:20 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR7.
1/20/2011 1:56:01 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR9.
1/20/2011 1:51:06 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR8.
1/18/2011 9:51:35 AM, Error: Microsoft-Windows-HAL [12] - The platform firmware has corrupted memory across the previous system power transition. Please check for updated firmware for your system.
1/17/2011 2:02:13 AM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
1/17/2011 2:01:28 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
1/17/2011 2:00:20 AM, Error: Service Control Manager [7034] - The WTouch Service service terminated unexpectedly. It has done this 1 time(s).
1/17/2011 2:00:01 AM, Error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
1/17/2011 12:43:08 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
1/17/2011 12:43:08 AM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/17/2011 12:43:08 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
1/17/2011 1:36:47 AM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
1/17/2011 1:35:59 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
1/17/2011 1:35:57 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
1/17/2011 1:35:01 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
1/17/2011 1:35:01 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
1/17/2011 1:35:00 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
1/17/2011 1:34:54 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
1/17/2011 1:34:47 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache ElbyCDIO MpFilter spldr Tosrfcom Wanarpv6
1/17/2011 1:31:10 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
1/17/2011 1:31:10 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
1/17/2011 1:31:07 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
1/17/2011 1:31:07 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
1/17/2011 1:31:07 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
1/17/2011 1:30:56 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache ElbyCDIO MpFilter NetBIOS NetBT nsiproxy Psched rdbss spldr tdx Tosrfcom vwififlt Wanarpv6 WfpLwf
1/17/2011 1:30:56 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
1/17/2011 1:30:56 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
1/17/2011 1:30:56 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
1/17/2011 1:30:56 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
1/17/2011 1:30:56 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
1/17/2011 1:30:56 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
1/17/2011 1:30:56 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
1/17/2011 1:30:56 AM, Error: Service Control Manager [7001] - The MotoConnect Service service depends on the Workstation service which failed to start because of the following error: The dependency service or group failed to start.
1/17/2011 1:30:56 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
1/17/2011 1:30:56 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
1/17/2011 1:30:56 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

==== End Of File ===========================

Broni · Jan 21, 2011

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running tools or applying updates other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

======================================================================

Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
Enter N to exit.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

==========================================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

MarkFromNJ · Jan 22, 2011

[Google Redirect] Results of MBRCheck

Hi,

Thanks again for your help. Here are the contents of MBRCheck.

Thanks
Mark

****************************************************************************************************

MBRCheck:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 64-bit
Base Board Manufacturer: TOSHIBA
BIOS Manufacturer: TOSHIBA
System Manufacturer: TOSHIBA
System Product Name: Qosmio X505
Logical Drives Mask: 0x0180001c

Kernel Drivers (total 185):
0x0324B000 \SystemRoot\system32\ntoskrnl.exe
0x03202000 \SystemRoot\system32\hal.dll
0x00B9F000 \SystemRoot\system32\kdcom.dll
0x00CE5000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00D29000 \SystemRoot\system32\PSHED.dll
0x00D3D000 \SystemRoot\system32\CLFS.SYS
0x00C00000 \SystemRoot\system32\CI.dll
0x00EAB000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F4F000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F5E000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x00FB5000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x00E00000 \SystemRoot\system32\drivers\fltmgr.sys
0x00E4C000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x00E56000 \SystemRoot\system32\DRIVERS\pci.sys
0x00E89000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x00E96000 \SystemRoot\System32\drivers\partmgr.sys
0x00FBE000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00FC7000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00FD3000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x00D9B000 \SystemRoot\System32\drivers\volmgrx.sys
0x00FE8000 \SystemRoot\system32\DRIVERS\pciide.sys
0x00FEF000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x00CC0000 \SystemRoot\System32\drivers\mountmgr.sys
0x010A5000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x012AD000 \SystemRoot\system32\DRIVERS\atapi.sys
0x012B6000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x012E0000 \SystemRoot\system32\DRIVERS\msahci.sys
0x012EB000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x012F6000 \SystemRoot\system32\drivers\fileinfo.sys
0x0130A000 \SystemRoot\system32\drivers\PCTCore64.sys
0x0134D000 \SystemRoot\system32\drivers\pctDS64.sys
0x014B6000 \SystemRoot\system32\drivers\pctEFA64.sys
0x01582000 \SystemRoot\System32\Drivers\PxHlpa64.sys
0x01600000 \SystemRoot\System32\Drivers\Ntfs.sys
0x0158F000 \SystemRoot\System32\Drivers\msrpc.sys
0x017A3000 \SystemRoot\System32\Drivers\ksecdd.sys
0x01400000 \SystemRoot\System32\Drivers\cng.sys
0x017BD000 \SystemRoot\System32\drivers\pcw.sys
0x017CE000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x018BE000 \SystemRoot\system32\drivers\ndis.sys
0x01800000 \SystemRoot\system32\drivers\NETIO.SYS
0x01860000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01A00000 \SystemRoot\System32\drivers\tcpip.sys
0x019B0000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x01000000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x019FA000 \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
0x01CCE000 \SystemRoot\system32\DRIVERS\tos_sps64.sys
0x01D48000 \SystemRoot\system32\DRIVERS\Thpevm.SYS
0x01D4A000 \SystemRoot\system32\DRIVERS\thpdrv.sys
0x01D56000 \SystemRoot\System32\Drivers\spldr.sys
0x01D5E000 \SystemRoot\System32\drivers\rdyboost.sys
0x01D98000 \SystemRoot\System32\Drivers\mup.sys
0x01DAA000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01DB3000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x01C00000 \SystemRoot\system32\DRIVERS\disk.sys
0x01C16000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x01C46000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x01C70000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0x01C9D000 \SystemRoot\System32\Drivers\Null.SYS
0x01CA6000 \SystemRoot\System32\Drivers\Beep.SYS
0x01CAD000 \SystemRoot\System32\drivers\vga.sys
0x0188B000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x01CBB000 \SystemRoot\System32\drivers\watchdog.sys
0x01DED000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x01DF6000 \SystemRoot\system32\drivers\rdpencdd.sys
0x018B0000 \SystemRoot\system32\drivers\rdprefmp.sys
0x017D8000 \SystemRoot\System32\Drivers\Msfs.SYS
0x017E3000 \SystemRoot\System32\Drivers\Npfs.SYS
0x01473000 \SystemRoot\system32\DRIVERS\tdx.sys
0x01491000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x03058000 \SystemRoot\system32\drivers\afd.sys
0x030E2000 \SystemRoot\System32\DRIVERS\netbt.sys
0x03127000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x03130000 \SystemRoot\system32\DRIVERS\pacer.sys
0x03156000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x0316C000 \SystemRoot\system32\DRIVERS\netbios.sys
0x0317B000 \SystemRoot\System32\Drivers\tosrfcom.sys
0x0318E000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x031A9000 \SystemRoot\system32\DRIVERS\termdd.sys
0x03000000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x031BD000 \SystemRoot\system32\drivers\nsiproxy.sys
0x031C9000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x031D4000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0x031E0000 \SystemRoot\System32\drivers\discache.sys
0x0104C000 \SystemRoot\System32\Drivers\dfsc.sys
0x031EF000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x0106A000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x017F4000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x04C0B000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x057ED000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x0441A000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x0450E000 \SystemRoot\System32\drivers\dxgmms1.sys
0x04554000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x04578000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x04589000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x013BE000 \SystemRoot\system32\DRIVERS\1394ohci.sys
0x045DF000 \SystemRoot\system32\DRIVERS\o2sdgx64.sys
0x04860000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x0488F000 \SystemRoot\system32\DRIVERS\o2mdgx64.sys
0x048A0000 \SystemRoot\system32\DRIVERS\rtl8192se.sys
0x049CD000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x049DA000 \SystemRoot\system32\DRIVERS\L1C62x64.sys
0x04800000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x0481E000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x05C28000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x05C73000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x05C75000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x05C84000 \SystemRoot\system32\DRIVERS\tdcmdpst.sys
0x05C8E000 \SystemRoot\System32\Drivers\AnyDVD.sys
0x05CB1000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x05CBE000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x05CD4000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x05CD9000 \SystemRoot\system32\DRIVERS\tosrfec.sys
0x05CE2000 \SystemRoot\system32\DRIVERS\TVALZFL.sys
0x05CE9000 \SystemRoot\system32\DRIVERS\QIOMem.sys
0x05CF3000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x05D03000 \SystemRoot\system32\DRIVERS\wacomvhid.sys
0x05D06000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x05D1F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x05D28000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x05D3E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x05D62000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x05D6E000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x05D9D000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x05DB8000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x05DD9000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x05DF3000 \SystemRoot\system32\DRIVERS\pnetmdm64.sys
0x05C00000 \SystemRoot\system32\drivers\modem.sys
0x05C0F000 \SystemRoot\system32\DRIVERS\swenum.sys
0x05A76000 \SystemRoot\system32\DRIVERS\ks.sys
0x05AB9000 \SystemRoot\system32\DRIVERS\MarvinBus64.sys
0x05AFD000 \SystemRoot\system32\DRIVERS\umbus.sys
0x05B0F000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x05B69000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x05B76000 \SystemRoot\system32\DRIVERS\wacommousefilter.sys
0x05B7E000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x05B93000 \SystemRoot\system32\drivers\nvhda64v.sys
0x05BAB000 \SystemRoot\system32\drivers\portcls.sys
0x05A00000 \SystemRoot\system32\drivers\drmk.sys
0x05A22000 \SystemRoot\system32\drivers\ksthunk.sys
0x064A1000 \SystemRoot\system32\drivers\CHDRT64.sys
0x06551000 \SystemRoot\system32\DRIVERS\tosporte.sys
0x06562000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x0657F000 \SystemRoot\system32\DRIVERS\dc3d.sys
0x06591000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x0659F000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x065AD000 \SystemRoot\system32\DRIVERS\point64.sys
0x065BD000 \SystemRoot\System32\Drivers\usbvideo.sys
0x065EB000 \SystemRoot\system32\DRIVERS\pgeffect.sys
0x00010000 \SystemRoot\System32\win32k.sys
0x065F2000 \SystemRoot\System32\drivers\Dxapi.sys
0x06400000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00430000 \SystemRoot\System32\TSDDD.dll
0x00720000 \SystemRoot\System32\cdd.dll
0x00970000 \SystemRoot\System32\ATMFD.DLL
0x0640E000 \SystemRoot\system32\drivers\luafv.sys
0x06431000 \SystemRoot\system32\drivers\WudfPf.sys
0x06452000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x04A96000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x04AE9000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x04AFC000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x04B14000 \SystemRoot\system32\drivers\HTTP.sys
0x04BDC000 \SystemRoot\system32\DRIVERS\bowser.sys
0x04A00000 \SystemRoot\System32\drivers\mpsdrv.sys
0x04A18000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x04A45000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x06467000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x05A28000 \SystemRoot\System32\Drivers\adfs.SYS
0x0648A000 \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys
0x05A40000 \??\C:\windows\system32\drivers\LMIRfsDriver.sys
0x098EF000 \SystemRoot\system32\drivers\peauth.sys
0x09995000 \SystemRoot\system32\drivers\regi.sys
0x0999D000 \SystemRoot\System32\Drivers\secdrv.SYS
0x099A8000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x099D5000 \SystemRoot\System32\drivers\tcpipreg.sys
0x09800000 \SystemRoot\System32\DRIVERS\srv2.sys
0x0A02B000 \SystemRoot\System32\DRIVERS\srv.sys
0x0A0C1000 \SystemRoot\system32\DRIVERS\MpNWMon.sys
0x0A0D1000 \SystemRoot\system32\DRIVERS\serscan.sys
0x0A0D9000 \SystemRoot\system32\drivers\spsys.sys
0x0A14A000 \SystemRoot\system32\DRIVERS\WSDPrint.sys
0x77A10000 \Windows\System32\ntdll.dll
0x47650000 \Windows\System32\smss.exe
0xFFD30000 \Windows\System32\apisetschema.dll
0xFFED0000 \Windows\System32\autochk.exe

Processes (total 104):
0 System Idle Process
4 System
400 C:\Windows\System32\smss.exe
596 csrss.exe
660 C:\Windows\System32\wininit.exe
680 csrss.exe
728 C:\Windows\System32\services.exe
744 C:\Windows\System32\lsass.exe
752 C:\Windows\System32\lsm.exe
844 C:\Windows\System32\svchost.exe
908 C:\Windows\System32\nvvsvc.exe
948 C:\Windows\System32\svchost.exe
1016 C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
524 C:\Windows\System32\svchost.exe
588 C:\Windows\System32\svchost.exe
748 C:\Windows\System32\svchost.exe
1108 C:\Windows\System32\audiodg.exe
1164 C:\Windows\System32\winlogon.exe
1204 C:\Windows\System32\svchost.exe
1292 C:\Program Files\WTouch\WTouchService.exe
1432 C:\Windows\System32\svchost.exe
1692 C:\Windows\System32\spoolsv.exe
1736 C:\Windows\System32\svchost.exe
1756 C:\Windows\System32\nvvsvc.exe
1868 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1916 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
1964 C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
2036 C:\Windows\SysWOW64\svchost.exe
1100 C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
1404 C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
1836 C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
964 C:\Program Files (x86)\LogMeIn\x64\LMIGuardian.exe
1424 C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
2084 C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe
2120 C:\Program Files (x86)\Motorola\Moto Helper Service\MotoHelper.exe
2168 C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
2200 C:\Windows\System32\svchost.exe
2228 C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
2292 C:\Windows\System32\svchost.exe
2392 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
2424 C:\Windows\System32\svchost.exe
2448 C:\Windows\System32\ThpSrv.exe
2496 C:\Windows\System32\TODDSrv.exe
2532 C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
2636 C:\Windows\System32\SearchIndexer.exe
2672 C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
2680 C:\Windows\System32\SearchProtocolHost.exe
3688 C:\Windows\System32\svchost.exe
3956 C:\Windows\System32\svchost.exe
4064 HP1006MC.EXE
872 C:\Windows\System32\taskhost.exe
3320 C:\Windows\System32\taskeng.exe
408 C:\Program Files\WTouch\WTouchUser.exe
1548 C:\Windows\System32\dwm.exe
2156 C:\Windows\explorer.exe
2684 C:\Windows\System32\svchost.exe
2320 C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
956 C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe
1784 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3964 C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
3204 C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
3404 C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
3416 C:\Windows\System32\ThpSrv.exe
3440 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
4016 C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
3484 C:\Program Files\Microsoft Security Essentials\msseces.exe
3448 WmiPrvSE.exe
1372 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
1340 C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe
2832 C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
2864 C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
4120 C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
4312 C:\Program Files (x86)\UCS\Virtual Account Numbers\CitiUCS.exe
4320 C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
4336 C:\Program Files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe
4348 C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
4368 C:\Program Files (x86)\DivX\DivX Plus Web Player\DDMService.exe
4448 C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
4860 C:\Program Files\TOSHIBA\FlashCards\Hotkey\TCrdKBB.exe
4896 C:\Windows\SysWOW64\OBroker.exe
5008 C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
4656 C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
4636 C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnect.exe
2968 C:\Program Files\TOSHIBA\HDMICtrlMan\HCMSoundChanger.exe
1316 C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
5360 C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
5404 C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
5472 C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
5752 C:\Windows\System32\taskeng.exe
5792 C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
5664 C:\Program Files\Windows Media Player\wmpnetwk.exe
1600 C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
6124 WmiPrvSE.exe
4088 C:\Windows\System32\sppsvc.exe
6644 C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
6664 C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
6708 C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
6772 C:\Windows\System32\SearchFilterHost.exe
6980 C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
2276 C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
5640 C:\Windows\System32\wuauclt.exe
3496 C:\Windows\explorer.exe
6808 C:\Users\mark\Desktop\MBRCheck.exe
6800 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00100000 (NTFS)

PhysicalDrive0 Model Number: INTELSSDSA2M160G2GC, Rev: 2CV102HA
PhysicalDrive1 Model Number: ST9500420AS, Rev: 0002SDM1

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
465 GB \\.\PhysicalDrive1 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79

Done!

MarkFromNJ · Jan 22, 2011

[Google Redirect] Results of Combofix

And here is C:\ComboFix.txt:

ComboFix 11-01-22.01 - mark 01/22/2011 13:43:03.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8180.6163 [GMT -5:00]
Running from: c:\users\mark\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BF5CEBDC-F2D3-7540-343C-F0CE11FD6E66}
AV: Spyware Doctor with AntiVirus *Disabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}
SP: Microsoft Security Essentials *Disabled/Updated* {043D0A38-D4E9-7ACE-0E8C-CBBC6A7A24DB}
SP: Spyware Doctor *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
ADS - windows: deleted 24 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
c:\users\mark\AppData\Local\{B1EBAD7E-4D02-4A41-86A7-A8573DE581EB}
c:\users\mark\AppData\Local\{B1EBAD7E-4D02-4A41-86A7-A8573DE581EB}\chrome.manifest
c:\users\mark\AppData\Local\{B1EBAD7E-4D02-4A41-86A7-A8573DE581EB}\chrome\content\_cfg.js
c:\users\mark\AppData\Local\{B1EBAD7E-4D02-4A41-86A7-A8573DE581EB}\chrome\content\overlay.xul
c:\users\mark\AppData\Local\{B1EBAD7E-4D02-4A41-86A7-A8573DE581EB}\install.rdf
c:\users\mark\AppData\Roaming\EurekaLog
c:\users\mark\AppData\Roaming\EurekaLog\TreeSize\TreeSize.elf
c:\users\mark\AppData\Roaming\Local
c:\windows\system32\out.txt
c:\windows\system32\zlibwapi.dll
c:\windows\SysWow64\out.txt
c:\windows\SysWow64\zlibwapi.dll

.
((((((((((((((((((((((((( Files Created from 2010-12-22 to 2011-01-22 )))))))))))))))))))))))))))))))
.

2011-01-22 18:48 . 2011-01-22 18:48 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2011-01-22 18:48 . 2011-01-22 18:48 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-22 02:10 . 2011-01-13 10:20 7844688 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BB8685AB-F7E3-44F0-AC32-C6192E452964}\mpengine.dll
2011-01-22 01:51 . 2011-01-22 01:51 -------- d-----w- c:\windows\Sun
2011-01-21 19:19 . 2011-01-21 19:19 -------- d-----w- c:\users\mark\AppData\Roaming\Malwarebytes
2011-01-21 19:19 . 2010-12-20 23:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-01-21 19:19 . 2011-01-21 19:19 -------- d-----w- c:\programdata\Malwarebytes
2011-01-21 19:19 . 2011-01-21 19:19 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-01-21 19:19 . 2010-12-20 23:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-18 08:44 . 2011-01-21 16:54 -------- d-----w- C:\divx
2011-01-18 08:37 . 2011-01-18 14:16 -------- d-----w- c:\users\mark\AppData\Roaming\DivX
2011-01-18 08:37 . 2011-01-18 08:37 -------- d-----w- c:\program files\DivX
2011-01-18 08:37 . 2011-01-18 08:37 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared
2011-01-18 08:36 . 2011-01-18 08:55 -------- d-----w- c:\program files (x86)\DivX
2011-01-18 08:36 . 2011-01-18 08:56 -------- d-----w- c:\programdata\DivX
2011-01-18 08:21 . 2011-01-18 08:21 -------- d-----w- c:\users\mark\AppData\Roaming\NVIDIA
2011-01-17 07:11 . 2010-07-16 19:53 816016 ----a-w- c:\windows\system32\drivers\pctEFA64.sys
2011-01-17 07:11 . 2010-06-29 15:35 452872 ----a-w- c:\windows\system32\drivers\pctDS64.sys
2011-01-17 07:11 . 2010-11-17 15:20 331368 ----a-w- c:\windows\system32\drivers\pctgntdi64.sys
2011-01-17 07:11 . 2010-11-17 15:20 136168 ----a-w- c:\windows\system32\drivers\pctwfpfilter64.sys
2011-01-17 07:11 . 2010-11-25 15:43 257232 ----a-w- c:\windows\system32\drivers\PCTCore64.sys
2011-01-17 07:11 . 2010-11-25 15:42 92896 ----a-w- c:\windows\system32\drivers\pctplsg64.sys
2011-01-17 07:10 . 2011-01-17 15:24 -------- d-----w- c:\program files (x86)\PC Tools Security
2011-01-17 07:10 . 2011-01-17 07:12 -------- d-----w- c:\program files (x86)\Common Files\PC Tools
2011-01-17 07:10 . 2011-01-17 07:11 -------- d-----w- c:\programdata\PC Tools
2011-01-17 07:10 . 2011-01-17 07:10 -------- d-----w- c:\users\mark\AppData\Roaming\PC Tools
2011-01-17 07:07 . 2011-01-17 07:07 119808 ----a-w- c:\program files (x86)\Mozilla Firefox\components\GoogleDesktopMozilla.dll
2011-01-17 07:07 . 2011-01-17 07:40 -------- d-----w- c:\programdata\Google Updater
2011-01-17 06:36 . 2011-01-17 06:36 -------- d-----w- c:\users\mark\AppData\Local\ElevatedDiagnostics
2011-01-17 06:05 . 2011-01-17 06:56 -------- d-----w- c:\program files (x86)\Windows Live Safety Center
2011-01-17 05:44 . 2009-08-20 03:50 24416 ----a-r- c:\windows\system32\AdobePDFUI.dll
2011-01-13 06:27 . 2011-01-13 06:27 -------- d-----w- c:\users\mark\AppData\Local\Quicken WillMaker Plus 2010
2011-01-12 11:33 . 2011-01-12 11:33 -------- d-----w- c:\program files\iPod
2011-01-12 11:33 . 2011-01-12 11:33 -------- d-----w- c:\program files\iTunes
2011-01-12 11:33 . 2011-01-12 11:33 -------- d-----w- c:\program files (x86)\iTunes
2011-01-12 09:12 . 2011-01-12 09:12 -------- d-----w- c:\users\mark\AppData\Local\Apple
2011-01-12 08:24 . 2011-01-12 08:24 -------- d-----w- c:\users\mark\AppData\Local\Microsoft Help
2011-01-05 13:02 . 2011-01-05 13:02 -------- d-----w- c:\program files\mbed
2011-01-05 13:02 . 2009-09-30 16:02 61488 ----a-w- c:\windows\system32\drivers\mbedSerial_x64.sys
2011-01-05 13:02 . 2009-09-30 16:02 49200 ----a-w- c:\windows\system32\drivers\mbedComposite_x64.sys
2011-01-05 13:02 . 2009-09-30 16:02 197120 ----a-w- c:\windows\system32\mbedClassCoInst_x64.dll
2010-12-31 15:04 . 2006-08-30 18:33 522224 ----a-w- c:\windows\SysWow64\Difxac74.rra
2010-12-29 01:27 . 2011-01-10 06:08 -------- d-----w- C:\nburn
2010-12-27 10:05 . 2010-12-27 10:06 -------- d-----w- C:\MinGW
2010-12-26 14:09 . 2010-12-26 14:09 -------- d-----w- c:\users\mark\.nbprofiler
2010-12-26 14:09 . 2010-12-26 14:09 -------- d-----w- c:\users\mark\.netbeans
2010-12-26 14:09 . 2010-12-26 14:09 -------- d-----w- c:\users\mark\AppData\Roaming\.visualvm
2010-12-24 16:33 . 2011-01-10 06:14 -------- d-----w- C:\EclipseWorkspace
2010-12-24 07:49 . 2010-12-24 07:49 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2010-12-24 07:48 . 2010-12-24 07:48 -------- d-----w- c:\programdata\NVIDIA Corporation
2010-12-24 07:48 . 2010-12-24 07:49 -------- d-----w- c:\program files\NVIDIA Corporation

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-22 01:40 . 2010-02-04 10:31 44544 ----a-w- c:\windows\SysWow64\agremove.exe
2011-01-22 01:08 . 2010-02-04 10:59 17920 ----a-w- c:\windows\system32\rpcnetp.exe
2010-12-01 19:06 . 2010-12-01 19:06 125512 ----a-w- c:\windows\SysWow64\drivers\AnyDVD.sys
2010-12-01 19:06 . 2010-12-01 19:06 125512 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
2010-11-30 20:43 . 2010-11-30 20:43 41128 ----a-w- c:\windows\system32\drivers\ElbyCDIO.sys
2010-11-29 22:38 . 2010-11-29 22:38 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2010-11-29 22:38 . 2010-11-29 22:38 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2010-11-25 18:29 . 2010-11-25 18:29 89256 ----a-w- c:\windows\SysWow64\ElbyCDIO.dll
2010-11-12 00:44 . 2010-11-12 00:44 94208 ----a-w- c:\windows\SysWow64\dpl100.dll
2010-11-10 05:35 . 2010-02-06 08:59 8199504 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-11-08 22:57 . 2010-11-08 22:57 353592 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl
2010-11-04 06:35 . 2010-12-15 05:37 1194496 ----a-w- c:\windows\system32\wininet.dll
2010-11-04 06:31 . 2010-12-15 05:37 57856 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-04 05:52 . 2010-12-15 05:37 978944 ----a-w- c:\windows\SysWow64\wininet.dll
2010-11-04 05:48 . 2010-12-15 05:37 44544 ----a-w- c:\windows\SysWow64\licmgr10.dll
2010-11-04 05:16 . 2010-12-15 05:37 482816 ----a-w- c:\windows\system32\html.iec
2010-11-04 04:41 . 2010-12-15 05:37 386048 ----a-w- c:\windows\SysWow64\html.iec
2010-11-04 04:35 . 2010-12-15 05:37 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2010-11-04 04:08 . 2010-12-15 05:37 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2010-11-02 05:18 . 2010-12-15 05:37 524288 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-11-02 05:17 . 2010-12-15 05:37 1169408 ----a-w- c:\windows\system32\taskschd.dll
2010-11-02 05:17 . 2010-12-15 05:37 473600 ----a-w- c:\windows\system32\taskcomp.dll
2010-11-02 05:16 . 2010-12-15 05:37 1114624 ----a-w- c:\windows\system32\schedsvc.dll
2010-11-02 05:10 . 2010-12-15 05:37 464384 ----a-w- c:\windows\system32\taskeng.exe
2010-11-02 05:10 . 2010-12-15 05:37 285696 ----a-w- c:\windows\system32\schtasks.exe
2010-11-02 04:40 . 2010-12-15 05:37 496128 ----a-w- c:\windows\SysWow64\taskschd.dll
2010-11-02 04:40 . 2010-12-15 05:37 305152 ----a-w- c:\windows\SysWow64\taskcomp.dll
2010-11-02 04:34 . 2010-12-15 05:37 192000 ----a-w- c:\windows\SysWow64\taskeng.exe
2010-11-02 04:34 . 2010-12-15 05:37 179712 ----a-w- c:\windows\SysWow64\schtasks.exe
2010-10-30 05:42 . 2010-12-06 19:43 108032 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2010-10-30 05:42 . 2010-12-06 19:43 50688 ----a-w- c:\windows\SysWow64\ff_acm.acm
2010-10-28 14:50 . 2010-10-28 14:50 32768 ----a-r- c:\users\mark\AppData\Roaming\Microsoft\Installer\{FE9A4493-8112-4527-9AAF-BB32F721AFC3}\_F4D2F5577828_4EE4_BEB8_D76E42284BC2.exe
2010-10-27 05:06 . 2010-12-15 05:37 2048 ----a-w- c:\windows\system32\tzres.dll
2010-10-27 04:32 . 2010-12-15 05:37 2048 ----a-w- c:\windows\SysWow64\tzres.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpenDNS Updater"="c:\program files (x86)\OpenDNS Updater\OpenDNSUpdater.exe" [2010-06-16 839680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-10-02 284696]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-11-24 2454840]
"UCS Virtual Account Numbers"="c:\progra~2\UCS\VIRTUA~1\CitiUCS.exe" [2009-07-10 373248]
"Google Desktop Search"="c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" [2011-01-17 30192]
"Google Quick Search Box"="c:\program files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2011-01-17 126976]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files (x86)\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2009-11-6 2717024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\Google\GOOGLE~4\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer7"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-17 136176]
R3 ALSysIO;ALSysIO;c:\users\mark\AppData\Local\Temp\ALSysIO64.sys [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [2009-07-10 31744]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-02-05 1038088]
R3 JMCR_CF;JMCR_CF;c:\windows\system32\DRIVERS\jmcr_cf.sys [2007-07-30 35840]
R3 mbedComposite;mbedComposite;c:\windows\system32\DRIVERS\mbedComposite_x64.sys [2009-09-30 49200]
R3 mbedSerial_x64;mbedSerial_x64;c:\windows\system32\DRIVERS\mbedSerial_x64.sys [2009-09-30 61488]
R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [2009-05-08 53632]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools Security\pctsAuxs.exe [2010-03-15 366840]
R3 silabenm;NetBurner Development Kit USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys [2009-07-17 23040]
R3 silabser;NetBurner Development Kit USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [2009-07-17 71168]
R3 SMSIVZAM5X64;SMSIVZAM5X64 NDIS Protocol Driver;c:\progra~2\VERIZO~1\VZACCE~1\SMSIVZAM5X64.SYS [2009-05-25 43032]
R3 SUSTUCAM;Susteen USB Cable Modem Driver;c:\windows\system32\DRIVERS\sustucam.sys [2009-11-25 56832]
R3 SUSTUCAP;Susteen USB Cable Port Driver;c:\windows\system32\DRIVERS\sustucap.sys [2009-11-25 56832]
R3 SUSTUCAU;Susteen USB Cable USB Driver;c:\windows\system32\DRIVERS\sustucau.sys [2009-11-25 33792]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2009-08-27 18216]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-13 1255736]
R4 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-10 369688]
R4 SynoDrService;SynoDrService;c:\program files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe [2010-01-07 404480]
R4 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-11-23 5556520]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [2010-11-25 257232]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [2010-06-29 452872]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sys [2010-07-16 816016]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-07-12 55856]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [2009-06-29 34880]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [2009-06-30 14784]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2009-07-24 482384]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-10-28 252784]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448]
S2 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-01-17 30192]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [2010-01-27 15928]
S2 MotoConnect Service;MotoConnect Service;c:\program files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-06-24 91456]
S2 MotoHelper.exe;Motorola Helper;c:\program files (x86)\Motorola\Moto Helper Service\MotoHelper.exe [2010-04-21 6656]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 14112]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [2009-06-20 14472]
S2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [2009-11-23 127784]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2010-07-07 51600]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2009-11-14 67072]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-26 40832]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2009-08-21 84512]
S3 O2MDGRDR;O2MDGRDR;c:\windows\system32\DRIVERS\o2mdgx64.sys [2009-11-03 74016]
S3 O2SDGRDR;O2SDGRDR;c:\windows\system32\DRIVERS\o2sdgx64.sys [2009-08-19 49568]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2009-06-23 35008]
S3 pnetmdm;PdaNet Modem;c:\windows\system32\DRIVERS\pnetmdm64.sys [2007-03-07 17920]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2010-07-21 45456]
S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [2009-06-15 12800]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-04-26 1103904]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-11-05 137560]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2009-11-10 824688]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]

--- Other Services/Drivers In Memory ---

*Deregistered* - PROCEXP100

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2011-01-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-01-17 07:07]

2011-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-17 07:08]

2011-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-17 07:08]
.

--------- x86-64 -----------

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-07-16 307768]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-10-09 508472]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-11-05 709976]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1448568]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.optonline.net/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:6092
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Trusted Zone: intuit.com\ttlc
FF - ProfilePath - c:\users\mark\AppData\Roaming\Mozilla\Firefox\Profiles\rxtkzg0n.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF - Ext: DownThemAll!: {DDC359D1-844A-42a7-9AA1-88A850A938A8} - %profile%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: LogMeIn, Inc. Remote Access Plugin: LogMeInClient@logmein.com - %profile%\extensions\LogMeInClient@logmein.com
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-ITSecMng - %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
Toolbar-Locked - (no file)
HKLM-Run-(Default) - (no file)
HKLM-Run-HDMICtrlMan - %ProgramFiles%\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe
HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-TPwrMain - %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-HSON - %ProgramFiles%\TOSHIBA\TBS\HSON.exe
HKLM-Run-SmoothView - %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
HKLM-Run-00TCrdMain - %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-TosWaitSrv - %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-NBURCOMM&10C4&84A0 - c:\windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\NBURCOMM&10C4&84A0

.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3247679737-3806144897-3848185987-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{566BFFEA-B4B2-E9BD-EF6B-0A2A90EA1AD3}*]
@Allowed: (Read) (RestrictedCode)
"haakpcdccmjjgaif"=hex:6b,61,6a,67,62,63,70,6b,6d,6b,64,62,65,69,64,6b,6f,6a,
69,6a,6e,67,00,66
"haakpcdcemlhnmjd"=hex:64,62,70,68,70,6b,64,6a,65,6d,68,62,61,69,66,70,6a,65,
62,65,66,67,6f,66,6d,67,6f,68,65,6d,66,6d,64,66,6b,66,61,67,64,69,00,00
"iaehmconjilnoceelo"=hex:69,61,63,6f,64,6b,62,6d,63,65,65,6c,6c,65,61,69,66,62,
00,63
"hakgocfnjokngebb"=hex:6a,61,6e,6e,69,6d,69,66,68,6c,69,6a,6d,65,6f,63,65,65,
69,66,00,04

[HKEY_USERS\S-1-5-21-3247679737-3806144897-3848185987-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BAC5F9B8-B87D-FEB8-EBAE-39291BC201A3}*]
@Allowed: (Read) (RestrictedCode)
"iaefgblgdbmagjlale"=hex:6a,61,67,70,68,64,65,62,68,68,6d,6f,6b,68,62,66,6d,68,
67,6b,00,0d
"hakeeijgdocllegb"=hex:6b,61,61,61,65,62,6c,6b,6c,6c,6f,65,65,61,64,6a,6e,6c,
6b,67,6b,63,00,00
"haaeniljaafjionj"=hex:6b,61,6a,65,66,69,68,64,68,6d,70,64,61,6a,6b,70,63,69,
61,6b,65,6d,00,61
"haaeniljgnpielfe"=hex:64,62,70,66,65,6d,70,66,6d,6f,69,62,64,62,65,66,69,62,
6a,6f,69,63,62,61,6a,63,69,62,68,68,6f,69,68,66,6c,6c,68,62,62,70,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-01-22 13:51:03
ComboFix-quarantined-files.txt 2011-01-22 18:51

Pre-Run: 30,991,810,560 bytes free
Post-Run: 30,032,736,256 bytes free

- - End Of File - - AC25C4CF18A397B41397CB9D4531359F

MarkFromNJ · Jan 22, 2011

Is it really fixed?

Hi Broni,

I ran MBRCheck and ComboFix and posted the logs previously. Google search seems to be working OK now - I did searches on some common commercial terms like "dog food", "perfume", "car repair" and when I clicked on the google result I got the page I was supposed to get.

Can you tell from the logs if I am really clean or should I bite the bullet and just reformat the machine (ugh - maybe 200 apps installed...)

Thanks in advance for your help, you are a lifesaver.

Mark

Broni · Jan 22, 2011

Good news

No, there is no reason to reinstall, since we did a lot already to clean up your computer and the things seem to be going in right direction.

========================================================================

You're running two AV programs, Spyware Doctor with AntiVirus and Microsoft Security Essentials.
One of them has to go.
I suggest, Spyware Doctor goes.

======================================================================

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

DDS::
uInternet Settings,ProxyOverride = <local>;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:6092

RegNull::
[HKEY_USERS\S-1-5-21-3247679737-3806144897-3848185987-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{566BFFEA-B4B2-E9BD-EF6B-0A2A90EA1AD3}*]
[HKEY_USERS\S-1-5-21-3247679737-3806144897-3848185987-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BAC5F9B8-B87D-FEB8-EBAE-39291BC201A3}*]

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

MarkFromNJ · Jan 23, 2011

Second ComboFix Log

Broni,
Here is my second ComboFix log. Please let me know if it is safe for me to install other software yet or if there is more to do. Thanks very much,
Mark

ComboFix 11-01-22.02 - mark 01/23/2011 1:06.2.8 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8180.5841 [GMT -5:00]
Running from: c:\users\mark\Desktop\ComboFix.exe
Command switches used :: c:\users\mark\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BF5CEBDC-F2D3-7540-343C-F0CE11FD6E66}
SP: Microsoft Security Essentials *Disabled/Updated* {043D0A38-D4E9-7ACE-0E8C-CBBC6A7A24DB}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-12-23 to 2011-01-23 )))))))))))))))))))))))))))))))
.

2011-01-23 06:10 . 2011-01-23 06:10 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2011-01-23 06:10 . 2011-01-23 06:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-22 21:21 . 2011-01-22 21:28 -------- d-----w- c:\users\mark\SecurityScans
2011-01-22 19:15 . 2011-01-13 10:20 7844688 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A4FADEA9-5B17-4130-B073-F8191CE470C9}\mpengine.dll
2011-01-22 01:51 . 2011-01-22 01:51 -------- d-----w- c:\windows\Sun
2011-01-21 19:19 . 2011-01-21 19:19 -------- d-----w- c:\users\mark\AppData\Roaming\Malwarebytes
2011-01-21 19:19 . 2010-12-20 23:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-01-21 19:19 . 2011-01-21 19:19 -------- d-----w- c:\programdata\Malwarebytes
2011-01-21 19:19 . 2011-01-21 19:19 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-01-21 19:19 . 2010-12-20 23:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-18 08:44 . 2011-01-21 16:54 -------- d-----w- C:\divx
2011-01-18 08:37 . 2011-01-18 14:16 -------- d-----w- c:\users\mark\AppData\Roaming\DivX
2011-01-18 08:37 . 2011-01-18 08:37 -------- d-----w- c:\program files\DivX
2011-01-18 08:37 . 2011-01-18 08:37 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared
2011-01-18 08:36 . 2011-01-18 08:55 -------- d-----w- c:\program files (x86)\DivX
2011-01-18 08:36 . 2011-01-18 08:56 -------- d-----w- c:\programdata\DivX
2011-01-18 08:21 . 2011-01-18 08:21 -------- d-----w- c:\users\mark\AppData\Roaming\NVIDIA
2011-01-17 07:07 . 2011-01-17 07:07 119808 ----a-w- c:\program files (x86)\Mozilla Firefox\components\GoogleDesktopMozilla.dll
2011-01-17 07:07 . 2011-01-17 07:40 -------- d-----w- c:\programdata\Google Updater
2011-01-17 06:36 . 2011-01-17 06:36 -------- d-----w- c:\users\mark\AppData\Local\ElevatedDiagnostics
2011-01-17 06:05 . 2011-01-17 06:56 -------- d-----w- c:\program files (x86)\Windows Live Safety Center
2011-01-17 05:44 . 2009-08-20 03:50 24416 ----a-r- c:\windows\system32\AdobePDFUI.dll
2011-01-13 06:27 . 2011-01-13 06:27 -------- d-----w- c:\users\mark\AppData\Local\Quicken WillMaker Plus 2010
2011-01-12 11:33 . 2011-01-12 11:33 -------- d-----w- c:\program files\iPod
2011-01-12 11:33 . 2011-01-12 11:33 -------- d-----w- c:\program files\iTunes
2011-01-12 11:33 . 2011-01-12 11:33 -------- d-----w- c:\program files (x86)\iTunes
2011-01-12 09:12 . 2011-01-12 09:12 -------- d-----w- c:\users\mark\AppData\Local\Apple
2011-01-12 08:24 . 2011-01-12 08:24 -------- d-----w- c:\users\mark\AppData\Local\Microsoft Help
2011-01-05 13:02 . 2011-01-05 13:02 -------- d-----w- c:\program files\mbed
2011-01-05 13:02 . 2009-09-30 16:02 61488 ----a-w- c:\windows\system32\drivers\mbedSerial_x64.sys
2011-01-05 13:02 . 2009-09-30 16:02 49200 ----a-w- c:\windows\system32\drivers\mbedComposite_x64.sys
2011-01-05 13:02 . 2009-09-30 16:02 197120 ----a-w- c:\windows\system32\mbedClassCoInst_x64.dll
2010-12-31 15:04 . 2006-08-30 18:33 522224 ----a-w- c:\windows\SysWow64\Difxac74.rra
2010-12-29 01:27 . 2011-01-10 06:08 -------- d-----w- C:\nburn
2010-12-27 10:05 . 2010-12-27 10:06 -------- d-----w- C:\MinGW
2010-12-26 14:09 . 2010-12-26 14:09 -------- d-----w- c:\users\mark\.nbprofiler
2010-12-26 14:09 . 2010-12-26 14:09 -------- d-----w- c:\users\mark\.netbeans
2010-12-26 14:09 . 2010-12-26 14:09 -------- d-----w- c:\users\mark\AppData\Roaming\.visualvm
2010-12-24 16:33 . 2011-01-10 06:14 -------- d-----w- C:\EclipseWorkspace
2010-12-24 07:49 . 2010-12-24 07:49 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2010-12-24 07:48 . 2010-12-24 07:48 -------- d-----w- c:\programdata\NVIDIA Corporation
2010-12-24 07:48 . 2010-12-24 07:49 -------- d-----w- c:\program files\NVIDIA Corporation

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-22 19:59 . 2010-02-04 10:31 44544 ----a-w- c:\windows\SysWow64\agremove.exe
2011-01-22 19:57 . 2010-02-04 10:59 17920 ----a-w- c:\windows\system32\rpcnetp.exe
2010-12-01 19:06 . 2010-12-01 19:06 125512 ----a-w- c:\windows\SysWow64\drivers\AnyDVD.sys
2010-12-01 19:06 . 2010-12-01 19:06 125512 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
2010-11-30 20:43 . 2010-11-30 20:43 41128 ----a-w- c:\windows\system32\drivers\ElbyCDIO.sys
2010-11-29 22:38 . 2010-11-29 22:38 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2010-11-29 22:38 . 2010-11-29 22:38 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2010-11-25 18:29 . 2010-11-25 18:29 89256 ----a-w- c:\windows\SysWow64\ElbyCDIO.dll
2010-11-12 00:44 . 2010-11-12 00:44 94208 ----a-w- c:\windows\SysWow64\dpl100.dll
2010-11-10 05:35 . 2010-02-06 08:59 8199504 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2010-11-08 22:57 . 2010-11-08 22:57 353592 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl
2010-11-04 06:35 . 2010-12-15 05:37 1194496 ----a-w- c:\windows\system32\wininet.dll
2010-11-04 06:31 . 2010-12-15 05:37 57856 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-04 05:52 . 2010-12-15 05:37 978944 ----a-w- c:\windows\SysWow64\wininet.dll
2010-11-04 05:48 . 2010-12-15 05:37 44544 ----a-w- c:\windows\SysWow64\licmgr10.dll
2010-11-04 05:16 . 2010-12-15 05:37 482816 ----a-w- c:\windows\system32\html.iec
2010-11-04 04:41 . 2010-12-15 05:37 386048 ----a-w- c:\windows\SysWow64\html.iec
2010-11-04 04:35 . 2010-12-15 05:37 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2010-11-04 04:08 . 2010-12-15 05:37 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2010-11-02 05:18 . 2010-12-15 05:37 524288 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-11-02 05:17 . 2010-12-15 05:37 1169408 ----a-w- c:\windows\system32\taskschd.dll
2010-11-02 05:17 . 2010-12-15 05:37 473600 ----a-w- c:\windows\system32\taskcomp.dll
2010-11-02 05:16 . 2010-12-15 05:37 1114624 ----a-w- c:\windows\system32\schedsvc.dll
2010-11-02 05:10 . 2010-12-15 05:37 464384 ----a-w- c:\windows\system32\taskeng.exe
2010-11-02 05:10 . 2010-12-15 05:37 285696 ----a-w- c:\windows\system32\schtasks.exe
2010-11-02 04:40 . 2010-12-15 05:37 496128 ----a-w- c:\windows\SysWow64\taskschd.dll
2010-11-02 04:40 . 2010-12-15 05:37 305152 ----a-w- c:\windows\SysWow64\taskcomp.dll
2010-11-02 04:34 . 2010-12-15 05:37 192000 ----a-w- c:\windows\SysWow64\taskeng.exe
2010-11-02 04:34 . 2010-12-15 05:37 179712 ----a-w- c:\windows\SysWow64\schtasks.exe
2010-10-30 05:42 . 2010-12-06 19:43 108032 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2010-10-30 05:42 . 2010-12-06 19:43 50688 ----a-w- c:\windows\SysWow64\ff_acm.acm
2010-10-28 14:50 . 2010-10-28 14:50 32768 ----a-r- c:\users\mark\AppData\Roaming\Microsoft\Installer\{FE9A4493-8112-4527-9AAF-BB32F721AFC3}\_F4D2F5577828_4EE4_BEB8_D76E42284BC2.exe
2010-10-27 05:06 . 2010-12-15 05:37 2048 ----a-w- c:\windows\system32\tzres.dll
2010-10-27 04:32 . 2010-12-15 05:37 2048 ----a-w- c:\windows\SysWow64\tzres.dll
.

((((((((((((((((((((((((((((( SnapShot@2011-01-22_18.48.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-15 04:09 . 2011-01-22 21:21 70552 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-01-22 21:21 47366 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-02-04 08:56 . 2011-01-22 21:21 10500 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3247679737-3806144897-3848185987-1000_UserData.bin
+ 2010-02-04 11:50 . 2011-01-22 21:19 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-02-04 11:50 . 2011-01-22 18:31 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-02-04 11:50 . 2011-01-22 18:31 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-02-04 11:50 . 2011-01-22 21:19 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-01-22 21:19 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-01-22 18:31 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:46 . 2011-01-23 05:25 80672 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2009-07-14 04:46 . 2011-01-21 17:04 80672 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2010-02-04 10:16 . 2011-01-22 18:14 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-04 10:16 . 2011-01-23 05:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-04 10:16 . 2011-01-23 05:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-04 10:16 . 2011-01-22 18:14 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-01-22 20:04 . 2011-01-22 20:04 69686 c:\windows\Installer\{401AB74C-74DA-463B-B67A-01F972DD0BBA}\_EF45CFAAD39E9FF1440282.exe
+ 2011-01-22 20:04 . 2011-01-22 20:04 69686 c:\windows\Installer\{401AB74C-74DA-463B-B67A-01F972DD0BBA}\_6FEFF9B68218417F98F549.exe
+ 2011-01-22 20:04 . 2011-01-22 20:04 69686 c:\windows\Installer\{401AB74C-74DA-463B-B67A-01F972DD0BBA}\_63632E0EF933356DB9A44D.exe
+ 2011-01-22 20:04 . 2011-01-22 20:04 69686 c:\windows\Installer\{401AB74C-74DA-463B-B67A-01F972DD0BBA}\_42CFF3787CA59EE7B3C5F9.exe
+ 2011-01-22 20:04 . 2011-01-22 20:04 69686 c:\windows\Installer\{401AB74C-74DA-463B-B67A-01F972DD0BBA}\_12C071CF926A902C83039A.exe
+ 2011-01-22 20:38 . 2011-01-22 20:38 30240 c:\windows\Installer\{08C3441C-4FAF-48D3-A551-70DD6031734F}\mbsa.exe
+ 2011-01-22 21:19 . 2011-01-22 21:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-01-22 18:27 . 2011-01-22 18:27 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-01-22 18:27 . 2011-01-22 18:27 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-01-22 21:19 . 2011-01-22 21:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-02-04 11:37 . 2011-01-23 04:54 402348 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-07-14 02:36 . 2011-01-22 21:25 923454 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-01-22 21:25 214022 c:\windows\system32\perfc009.dat
- 2009-07-14 05:01 . 2011-01-22 18:21 603872 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-01-22 21:18 603872 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 04:45 . 2011-01-17 06:19 3798234 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2009-07-14 04:45 . 2011-01-22 21:21 3798234 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2011-01-22 19:43 . 2011-01-22 19:43 5489664 c:\windows\Installer\69ada.msi
+ 2011-01-22 20:38 . 2011-01-22 20:38 1777664 c:\windows\Installer\26628d.msi
+ 2009-07-14 02:34 . 2011-01-23 05:08 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
- 2009-07-14 02:34 . 2011-01-22 14:24 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpenDNS Updater"="c:\program files (x86)\OpenDNS Updater\OpenDNSUpdater.exe" [2010-06-16 839680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-10-02 284696]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-10-06 1294136]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-11-24 2454840]
"UCS Virtual Account Numbers"="c:\progra~2\UCS\VIRTUA~1\CitiUCS.exe" [2009-07-10 373248]
"Google Desktop Search"="c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" [2011-01-17 30192]
"Google Quick Search Box"="c:\program files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2011-01-17 126976]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files (x86)\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2009-11-6 2717024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\Google\GOOGLE~4\GoogleDesktopNetwork3.dll c:\progra~2\Google\GOOGLE~4\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer7"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-17 136176]
R3 ALSysIO;ALSysIO;c:\users\mark\AppData\Local\Temp\ALSysIO64.sys [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [2009-07-10 31744]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-02-05 1038088]
R3 JMCR_CF;JMCR_CF;c:\windows\system32\DRIVERS\jmcr_cf.sys [2007-07-30 35840]
R3 mbedComposite;mbedComposite;c:\windows\system32\DRIVERS\mbedComposite_x64.sys [2009-09-30 49200]
R3 mbedSerial_x64;mbedSerial_x64;c:\windows\system32\DRIVERS\mbedSerial_x64.sys [2009-09-30 61488]
R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [2009-05-08 53632]
R3 silabenm;NetBurner Development Kit USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys [2009-07-17 23040]
R3 silabser;NetBurner Development Kit USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [2009-07-17 71168]
R3 SMSIVZAM5X64;SMSIVZAM5X64 NDIS Protocol Driver;c:\progra~2\VERIZO~1\VZACCE~1\SMSIVZAM5X64.SYS [2009-05-25 43032]
R3 SUSTUCAM;Susteen USB Cable Modem Driver;c:\windows\system32\DRIVERS\sustucam.sys [2009-11-25 56832]
R3 SUSTUCAP;Susteen USB Cable Port Driver;c:\windows\system32\DRIVERS\sustucap.sys [2009-11-25 56832]
R3 SUSTUCAU;Susteen USB Cable USB Driver;c:\windows\system32\DRIVERS\sustucau.sys [2009-11-25 33792]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2009-08-27 18216]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-13 1255736]
R4 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-10 369688]
R4 SynoDrService;SynoDrService;c:\program files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe [2010-01-07 404480]
R4 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-11-23 5556520]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-07-12 55856]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [2009-06-29 34880]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [2009-06-30 14784]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2009-07-24 482384]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-10-28 252784]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448]
S2 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-01-17 30192]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [2010-01-27 15928]
S2 MotoConnect Service;MotoConnect Service;c:\program files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-06-24 91456]
S2 MotoHelper.exe;Motorola Helper;c:\program files (x86)\Motorola\Moto Helper Service\MotoHelper.exe [2010-04-21 6656]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 14112]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [2009-06-20 14472]
S2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [2009-11-23 127784]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2010-07-07 51600]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2009-11-14 67072]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-26 40832]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2009-08-21 84512]
S3 O2MDGRDR;O2MDGRDR;c:\windows\system32\DRIVERS\o2mdgx64.sys [2009-11-03 74016]
S3 O2SDGRDR;O2SDGRDR;c:\windows\system32\DRIVERS\o2sdgx64.sys [2009-08-19 49568]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2009-06-23 35008]
S3 pnetmdm;PdaNet Modem;c:\windows\system32\DRIVERS\pnetmdm64.sys [2007-03-07 17920]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2010-07-21 45456]
S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [2009-06-15 12800]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-04-26 1103904]
S3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-10-06 51512]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-11-05 137560]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2009-11-10 824688]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2011-01-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-01-17 07:07]

2011-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-17 07:08]

2011-01-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-17 07:08]
.

--------- x86-64 -----------

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 23:12 98056 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-07-16 307768]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-10-09 508472]
"HDMICtrlMan"="%ProgramFiles%\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [BU]
"SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe" [BU]
"TPwrMain"="%ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="%ProgramFiles%\TOSHIBA\TBS\HSON.exe" [BU]
"SmoothView"="%ProgramFiles%\Toshiba\SmoothView\SmoothView.exe" [BU]
"00TCrdMain"="%ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
"TosWaitSrv"="%ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe" [BU]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-11-05 709976]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-09-15 1448568]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.optonline.net/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
Trusted Zone: intuit.com\ttlc
FF - ProfilePath - c:\users\mark\AppData\Roaming\Mozilla\Firefox\Profiles\rxtkzg0n.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF - Ext: DownThemAll!: {DDC359D1-844A-42a7-9AA1-88A850A938A8} - %profile%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: LogMeIn, Inc. Remote Access Plugin: LogMeInClient@logmein.com - %profile%\extensions\LogMeInClient@logmein.com
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)

.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-01-23 01:12:12
ComboFix-quarantined-files.txt 2011-01-23 06:12
ComboFix2.txt 2011-01-22 18:51

Pre-Run: 27,990,470,656 bytes free
Post-Run: 27,752,947,712 bytes free

- - End Of File - - E8EE9A2A2B90477E12D60DBC228B8B1A

Broni · Jan 23, 2011

Good job

How is computer doing?

Until we're done, avoid installing anything new.

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

Inactive Google Redirect Virus Removal Win 7 64 Bit

MarkFromNJ

Posts: 6 +0

MarkFromNJ

Posts: 6 +0

Broni

Posts: 56,041 +516

MarkFromNJ

Posts: 6 +0

MarkFromNJ

Posts: 6 +0

MarkFromNJ

Posts: 6 +0

Broni

Posts: 56,041 +516

MarkFromNJ

Posts: 6 +0

Broni

Posts: 56,041 +516

Similar threads

Latest posts