Solved Google redirect

nNeedofHelp · Jan 9, 2012

I got a 2012 Vista Virus warning, so I ran MWB and it did find a few things. Went on for a week or so, the realized I had the Google Redirect issue.

I would really like to get rid of it once and for all. Thank you in advance for helping, your time and effort are appreciated.

Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.04.02

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19170
Chris :: WORKHORSE [administrator]

1/4/2012 8:23:34 AM
mbam-log-2012-01-04 (08-23-34).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 232187
Time elapsed: 16 minute(s), 46 second(s)

Memory Processes Detected: 1
C:\Users\Chris\AppData\Local\Temp\Low\nsg.exe (Trojan.FakeMS) -> 5692 -> Delete on reboot.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 3
HKCR\CLSID\{96AFBE69-C3B0-4b00-8578-D933D2896EE2} (TrojanProxy.Agent) -> Quarantined and deleted successfully.
HKCR\sp (TrojanProxy.Agent) -> Quarantined and deleted successfully.
HKLM\System\CurrentControlSet\Services\SPService (TrojanProxy.Agent) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 4
C:\Users\Chris\AppData\Local\Temp\Low\nsg.exe (Trojan.FakeMS) -> Delete on reboot.
c:\users\chris\appdata\local\temp\cuapszyvkb (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\Chris\AppData\Local\Temp\Low\0.2607898525151373df35.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
C:\Users\Chris\Local Settings\Temporary Internet Files\Content.IE5\9WPH4SIN\iwxsgvarjqfpblc3[1].exe (Trojan.FakeMS) -> Quarantined and deleted successfully.

(end)

gmer to follow.

Broni · Jan 9, 2012

Welcome aboard

Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running tools or applying updates other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

nNeedofHelp · Jan 9, 2012

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-01-08 19:34:46
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000053 ST316081 rev.3.AD
Running: h75fez0c.exe; Driver: C:\Users\Chris\AppData\Local\Temp\kxddapoc.sys

---- System - GMER 1.0.15 ----

Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x82A391E8]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0x82A39212]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x82A391FE]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0x82A391D4]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwYieldExecution 82442982 5 Bytes JMP 82A391D8 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwTerminateProcess 82608143 5 Bytes JMP 82A39216 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtMapViewOfSection 8262789A 7 Bytes JMP 82A391EC \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 82627B5D 5 Bytes JMP 82A39202 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8BE0D340, 0x28B977, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\System32\svchost.exe[572] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 00130FE5
.text C:\Windows\System32\svchost.exe[572] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 00130011
.text C:\Windows\System32\svchost.exe[572] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 00130000
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 000A008C
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 000A0F46
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 000A00C9
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 000A00B8
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 000A0071
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 000A0FD4
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 000A0FC3
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 000A0F57
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 000A0060
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 000A002F
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 000A0F97
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 000A0FA8
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 000A0F7C
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 000A0F17
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 000A0FE5
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 000A0000
.text C:\Windows\System32\svchost.exe[572] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 000A00A7
.text C:\Windows\System32\svchost.exe[572] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 00250049
.text C:\Windows\System32\svchost.exe[572] msvcrt.dll!system 760E804B 5 Bytes JMP 00250038
.text C:\Windows\System32\svchost.exe[572] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 0025001D
.text C:\Windows\System32\svchost.exe[572] msvcrt.dll!_open 760ED106 5 Bytes JMP 00250000
.text C:\Windows\System32\svchost.exe[572] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 00250FC8
.text C:\Windows\System32\svchost.exe[572] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 00250FE3
.text C:\Windows\System32\svchost.exe[572] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 00120058
.text C:\Windows\System32\svchost.exe[572] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 0012002C
.text C:\Windows\System32\svchost.exe[572] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 00120000
.text C:\Windows\System32\svchost.exe[572] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 00120047
.text C:\Windows\System32\svchost.exe[572] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 00120FA5
.text C:\Windows\System32\svchost.exe[572] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 0012001B
.text C:\Windows\System32\svchost.exe[572] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 00120FE5
.text C:\Windows\System32\svchost.exe[572] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 00120FCA
.text C:\Windows\system32\services.exe[708] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 002F0000
.text C:\Windows\system32\services.exe[708] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 002F0FCA
.text C:\Windows\system32\services.exe[708] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 002F0FE5
.text C:\Windows\system32\services.exe[708] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 00310F83
.text C:\Windows\system32\services.exe[708] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 003100C9
.text C:\Windows\system32\services.exe[708] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 00310F4D
.text C:\Windows\system32\services.exe[708] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 003100DA
.text C:\Windows\system32\services.exe[708] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 00310093
.text C:\Windows\system32\services.exe[708] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 00310FDE
.text C:\Windows\system32\services.exe[708] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 00310FC3
.text C:\Windows\system32\services.exe[708] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 00310F9E
.text C:\Windows\system32\services.exe[708] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 00310082
.text C:\Windows\system32\services.exe[708] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 0031004A
.text C:\Windows\system32\services.exe[708] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 00310065
.text C:\Windows\system32\services.exe[708] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 0031002F
.text C:\Windows\system32\services.exe[708] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 003100AE
.text C:\Windows\system32\services.exe[708] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 00310109
.text C:\Windows\system32\services.exe[708] kernel32.dll!CreateFileW 7669B0EB 1 Byte [E9]
.text C:\Windows\system32\services.exe[708] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 00310FEF
.text C:\Windows\system32\services.exe[708] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 00310000
.text C:\Windows\system32\services.exe[708] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 00310F5E
.text C:\Windows\system32\services.exe[708] ADVAPI32.dll!RegCreateKeyExA 774D39AB 1 Byte [E9]
.text C:\Windows\system32\services.exe[708] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 00900FAF
.text C:\Windows\system32\services.exe[708] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 00900051
.text C:\Windows\system32\services.exe[708] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 00900000
.text C:\Windows\system32\services.exe[708] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 00900FC0
.text C:\Windows\system32\services.exe[708] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 0090006C
.text C:\Windows\system32\services.exe[708] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 00900FE5
.text C:\Windows\system32\services.exe[708] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 0090001B
.text C:\Windows\system32\services.exe[708] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 00900036
.text C:\Windows\system32\services.exe[708] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 0030004E
.text C:\Windows\system32\services.exe[708] msvcrt.dll!system 760E804B 5 Bytes JMP 0030003D
.text C:\Windows\system32\services.exe[708] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 00300022
.text C:\Windows\system32\services.exe[708] msvcrt.dll!_open 760ED106 5 Bytes JMP 00300FEF
.text C:\Windows\system32\services.exe[708] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 00300FCD
.text C:\Windows\system32\services.exe[708] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 00300FDE
.text C:\Windows\system32\services.exe[708] WS2_32.dll!socket 776436D1 5 Bytes JMP 00910FEF
.text C:\Windows\system32\services.exe[708] WININET.dll!InternetOpenA 773ED6A8 5 Bytes JMP 00360FE5
.text C:\Windows\system32\services.exe[708] WININET.dll!InternetOpenW 773EDB21 5 Bytes JMP 00360000
.text C:\Windows\system32\services.exe[708] WININET.dll!InternetOpenUrlA 773EF3BC 5 Bytes JMP 00360011
.text C:\Windows\system32\services.exe[708] WININET.dll!InternetOpenUrlW 77436DFF 5 Bytes JMP 00360FC0
.text C:\Windows\system32\lsass.exe[748] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 00210FE5
.text C:\Windows\system32\lsass.exe[748] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 00210000
.text C:\Windows\system32\lsass.exe[748] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 00210FD4
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 00580F0B
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 00580051
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 00580084
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 00580073
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 00580F41
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 0058000A
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 00580FB9
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 00580F26
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 0058001B
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 00580F83
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 00580F68
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 00580F9E
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 00580036
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 00580095
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 00580FDE
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 00580FEF
.text C:\Windows\system32\lsass.exe[748] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 00580062
.text C:\Windows\system32\lsass.exe[748] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 005E0F72
.text C:\Windows\system32\lsass.exe[748] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 005E0F83
.text C:\Windows\system32\lsass.exe[748] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 005E0FE5
.text C:\Windows\system32\lsass.exe[748] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 005E000A
.text C:\Windows\system32\lsass.exe[748] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 005E0025
.text C:\Windows\system32\lsass.exe[748] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 005E0FC3
.text C:\Windows\system32\lsass.exe[748] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 005E0FD4
.text C:\Windows\system32\lsass.exe[748] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 005E0FA8
.text C:\Windows\system32\lsass.exe[748] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 00570049
.text C:\Windows\system32\lsass.exe[748] msvcrt.dll!system 760E804B 5 Bytes JMP 00570FBE
.text C:\Windows\system32\lsass.exe[748] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 0057001D
.text C:\Windows\system32\lsass.exe[748] msvcrt.dll!_open 760ED106 5 Bytes JMP 00570FEF
.text C:\Windows\system32\lsass.exe[748] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 0057002E
.text C:\Windows\system32\lsass.exe[748] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 0057000C
.text C:\Windows\system32\lsass.exe[748] WS2_32.dll!socket 776436D1 5 Bytes JMP 005F0000
.text C:\Windows\system32\lsass.exe[748] WININET.dll!InternetOpenA 773ED6A8 5 Bytes JMP 00590000
.text C:\Windows\system32\lsass.exe[748] WININET.dll!InternetOpenW 773EDB21 5 Bytes JMP 00590FE5
.text C:\Windows\system32\lsass.exe[748] WININET.dll!InternetOpenUrlA 773EF3BC 1 Byte [E9]
.text C:\Windows\system32\lsass.exe[748] WININET.dll!InternetOpenUrlA 773EF3BC 5 Bytes JMP 00590FC0
.text C:\Windows\system32\lsass.exe[748] WININET.dll!InternetOpenUrlW 77436DFF 5 Bytes JMP 00590FAF
.text C:\Windows\system32\svchost.exe[948] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 00720FEF
.text C:\Windows\system32\svchost.exe[948] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 00720FCA
.text C:\Windows\system32\svchost.exe[948] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 00720000
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 00740093
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 00740078
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 007400AE
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 00740F17
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 0074005D
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 00740FC0
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 0074001B
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 00740F4D
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 00740F79
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 00740036
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 00740F94
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 00740FAF
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 00740F5E
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 00740EFC
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 00740000
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 00740FEF
.text C:\Windows\system32\svchost.exe[948] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 00740F32
.text C:\Windows\system32\svchost.exe[948] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 00710FB7
.text C:\Windows\system32\svchost.exe[948] msvcrt.dll!system 760E804B 5 Bytes JMP 00710042
.text C:\Windows\system32\svchost.exe[948] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 00710FD2
.text C:\Windows\system32\svchost.exe[948] msvcrt.dll!_open 760ED106 5 Bytes JMP 00710FE3
.text C:\Windows\system32\svchost.exe[948] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 00710027
.text C:\Windows\system32\svchost.exe[948] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 0071000C
.text C:\Windows\system32\svchost.exe[948] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 0075006C
.text C:\Windows\system32\svchost.exe[948] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 00750051
.text C:\Windows\system32\svchost.exe[948] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 00750FEF
.text C:\Windows\system32\svchost.exe[948] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 00750FCA
.text C:\Windows\system32\svchost.exe[948] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 00750FAF
.text C:\Windows\system32\svchost.exe[948] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 0075001B
.text C:\Windows\system32\svchost.exe[948] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 0075000A
.text C:\Windows\system32\svchost.exe[948] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 0075002C
.text C:\Windows\system32\svchost.exe[948] WS2_32.dll!socket 776436D1 5 Bytes JMP 00760000
.text C:\Windows\system32\svchost.exe[1028] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 00950000
.text C:\Windows\system32\svchost.exe[1028] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 00950FCA
.text C:\Windows\system32\svchost.exe[1028] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 00950FE5
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 009B0F55
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 009B009B
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 009B0F15
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 009B0F30
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 009B0F77
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 009B0FE5
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 009B0FCA
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 009B0080
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 009B005B
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 009B0036
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 009B0F9E
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 009B0FB9
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 009B0F66
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 009B00D1
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 009B001B
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 009B0000
.text C:\Windows\system32\svchost.exe[1028] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 009B00AC
.text C:\Windows\system32\svchost.exe[1028] msvcrt.dll!_wsystem 760E7F2F 3 Bytes JMP 009A0FB2
.text C:\Windows\system32\svchost.exe[1028] msvcrt.dll!_wsystem + 4 760E7F33 1 Byte [8A]
.text C:\Windows\system32\svchost.exe[1028] msvcrt.dll!system 760E804B 3 Bytes JMP 009A0FC3
.text C:\Windows\system32\svchost.exe[1028] msvcrt.dll!system + 4 760E804F 1 Byte [8A]
.text C:\Windows\system32\svchost.exe[1028] msvcrt.dll!_creat 760EBBE1 3 Bytes JMP 009A0029
.text C:\Windows\system32\svchost.exe[1028] msvcrt.dll!_creat + 4 760EBBE5 1 Byte [8A]
.text C:\Windows\system32\svchost.exe[1028] msvcrt.dll!_open 760ED106 5 Bytes JMP 009A0FEF
.text C:\Windows\system32\svchost.exe[1028] msvcrt.dll!_wcreat 760ED326 3 Bytes JMP 009A0FDE
.text C:\Windows\system32\svchost.exe[1028] msvcrt.dll!_wcreat + 4 760ED32A 1 Byte [8A]
.text C:\Windows\system32\svchost.exe[1028] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 009A0018
.text C:\Windows\system32\svchost.exe[1028] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 00D60FA1
.text C:\Windows\system32\svchost.exe[1028] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 00D60FC3
.text C:\Windows\system32\svchost.exe[1028] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 00D60FEF
.text C:\Windows\system32\svchost.exe[1028] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 00D60FB2
.text C:\Windows\system32\svchost.exe[1028] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 00D60F7C
.text C:\Windows\system32\svchost.exe[1028] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 00D60FD4
.text C:\Windows\system32\svchost.exe[1028] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 00D6000A
.text C:\Windows\system32\svchost.exe[1028] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 00D6002F
.text C:\Windows\system32\svchost.exe[1028] WS2_32.dll!socket 776436D1 5 Bytes JMP 00D70FEF
.text C:\Windows\system32\svchost.exe[1028] WININET.dll!InternetOpenA 773ED6A8 5 Bytes JMP 00D50000
.text C:\Windows\system32\svchost.exe[1028] WININET.dll!InternetOpenW 773EDB21 5 Bytes JMP 00D50FE5
.text C:\Windows\system32\svchost.exe[1028] WININET.dll!InternetOpenUrlA 773EF3BC 5 Bytes JMP 00D50FCA
.text C:\Windows\system32\svchost.exe[1028] WININET.dll!InternetOpenUrlW 77436DFF 5 Bytes JMP 00D5001B
.text C:\Windows\System32\svchost.exe[1084] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 00160FEF
.text C:\Windows\System32\svchost.exe[1084] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 00160014
.text C:\Windows\System32\svchost.exe[1084] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 00160FDE
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 001500EE
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 001500D3
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 00150121
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 00150110
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 001500AE
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 00150FDB
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 0015002C
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 00150FA8
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 00150093
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 0015006C
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 00150FCA
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 00150051
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 00150FB9
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 0015013C
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 00150011
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 00150000
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 001500FF
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 00170038
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!system 760E804B 5 Bytes JMP 00170027
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 00170FD2
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!_open 760ED106 5 Bytes JMP 00170FEF
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 00170FC1
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 0017000C
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 008B004D
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 008B0FBC
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 008B0FEF
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 008B0FA1
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 008B005E
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 008B001E
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 008B0FDE
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 008B0FCD
.text C:\Windows\System32\svchost.exe[1084] WS2_32.dll!socket 776436D1 5 Bytes JMP 008C0FEF
.text C:\Windows\System32\svchost.exe[1084] WININET.dll!InternetOpenA 773ED6A8 5 Bytes JMP 0018000A
.text C:\Windows\System32\svchost.exe[1084] WININET.dll!InternetOpenW 773EDB21 5 Bytes JMP 00180FEF
.text C:\Windows\System32\svchost.exe[1084] WININET.dll!InternetOpenUrlA 773EF3BC 5 Bytes JMP 00180FD4
.text C:\Windows\System32\svchost.exe[1084] WININET.dll!InternetOpenUrlW 77436DFF 5 Bytes JMP 00180FB9
.text C:\Windows\System32\svchost.exe[1172] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 0170000A
.text C:\Windows\System32\svchost.exe[1172] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 01700040
.text C:\Windows\System32\svchost.exe[1172] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 0170001B
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 016900C9
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 016900A4
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 01690F32
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 01690F4D
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 01690078
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 01690011
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 01690FCA
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 01690F79
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 01690F9E
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 01690FAF
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 0169005B
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 01690036
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 01690089
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 01690F17
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 01690FE5
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 01690000
.text C:\Windows\System32\svchost.exe[1172] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 01690F5E
.text C:\Windows\System32\svchost.exe[1172] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 01750FA1
.text C:\Windows\System32\svchost.exe[1172] msvcrt.dll!system 760E804B 5 Bytes JMP 0175002C
.text C:\Windows\System32\svchost.exe[1172] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 01750FCD
.text C:\Windows\System32\svchost.exe[1172] msvcrt.dll!_open 760ED106 5 Bytes JMP 01750FEF
.text C:\Windows\System32\svchost.exe[1172] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 01750FBC
.text C:\Windows\System32\svchost.exe[1172] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 01750FDE
.text C:\Windows\System32\svchost.exe[1172] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 018B0062
.text C:\Windows\System32\svchost.exe[1172] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 018B0051
.text C:\Windows\System32\svchost.exe[1172] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 018B0000
.text C:\Windows\System32\svchost.exe[1172] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 018B0FC0
.text C:\Windows\System32\svchost.exe[1172] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 018B0F9B
.text C:\Windows\System32\svchost.exe[1172] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 018B002C
.text C:\Windows\System32\svchost.exe[1172] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 018B0011
.text C:\Windows\System32\svchost.exe[1172] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 018B0FDB
.text C:\Windows\System32\svchost.exe[1172] WS2_32.dll!socket 776436D1 5 Bytes JMP 01900000
.text C:\Windows\System32\svchost.exe[1172] WININET.dll!InternetOpenA 773ED6A8 5 Bytes JMP 017A000A
.text C:\Windows\System32\svchost.exe[1172] WININET.dll!InternetOpenW 773EDB21 5 Bytes JMP 017A0FE5
.text C:\Windows\System32\svchost.exe[1172] WININET.dll!InternetOpenUrlA 773EF3BC 5 Bytes JMP 017A0FCA
.text C:\Windows\System32\svchost.exe[1172] WININET.dll!InternetOpenUrlW 77436DFF 5 Bytes JMP 017A0FB9
.text C:\Windows\system32\svchost.exe[1192] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 01430FEF
.text C:\Windows\system32\svchost.exe[1192] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 01430000
.text C:\Windows\system32\svchost.exe[1192] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 01430FD4
.text C:\Windows\system32\svchost.exe[1192] ntdll.dll!NtWriteVirtualMemory 777254C4 5 Bytes JMP 00D8000A
.text C:\Windows\system32\svchost.exe[1192] ntdll.dll!KiUserExceptionDispatcher 77725BF8 5 Bytes JMP 0094000A
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 013E008E
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 013E0F52
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 013E009F
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 013E0F12
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 013E005B
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 013E0FC3
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 013E001E
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 013E007D
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 013E0F81
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 013E0040
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 013E0F9E
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 013E002F
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 013E006C
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 013E0EE3
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 013E0FDE
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 013E0FEF
.text C:\Windows\system32\svchost.exe[1192] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 013E0F23
.text C:\Windows\system32\svchost.exe[1192] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 014C0FAD
.text C:\Windows\system32\svchost.exe[1192] msvcrt.dll!system 760E804B 5 Bytes JMP 014C0FC8
.text C:\Windows\system32\svchost.exe[1192] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 014C0FE3
.text C:\Windows\system32\svchost.exe[1192] msvcrt.dll!_open 760ED106 5 Bytes JMP 014C000C
.text C:\Windows\system32\svchost.exe[1192] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 014C0038

nNeedofHelp · Jan 9, 2012

.text C:\Windows\system32\svchost.exe[1192] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 014C001D
.text C:\Windows\system32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 014E0F80
.text C:\Windows\system32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 014E0011
.text C:\Windows\system32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 014E0FEF
.text C:\Windows\system32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyW 774E391E 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 014E0022
.text C:\Windows\system32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 014E0F6F
.text C:\Windows\system32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 014E0FAF
.text C:\Windows\system32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 014E0FCA
.text C:\Windows\system32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 014E0000
.text C:\Windows\system32\svchost.exe[1192] WS2_32.dll!socket 776436D1 5 Bytes JMP 019B0FE5
.text C:\Windows\system32\svchost.exe[1192] WININET.dll!InternetOpenA 773ED6A8 5 Bytes JMP 014D0FEF
.text C:\Windows\system32\svchost.exe[1192] WININET.dll!InternetOpenW 773EDB21 5 Bytes JMP 014D000A
.text C:\Windows\system32\svchost.exe[1192] WININET.dll!InternetOpenUrlA 773EF3BC 5 Bytes JMP 014D0FD4
.text C:\Windows\system32\svchost.exe[1192] WININET.dll!InternetOpenUrlW 77436DFF 5 Bytes JMP 014D001B
.text C:\Windows\system32\svchost.exe[1332] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 00090FEF
.text C:\Windows\system32\svchost.exe[1332] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 00090FDE
.text C:\Windows\system32\svchost.exe[1332] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 0009000A
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 00070F72
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 000700AE
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 00070F2B
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 00070F3C
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 0007007B
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 00070FD4
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 00070FC3
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 0007009D
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 00070054
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 00070039
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 00070F97
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 00070FB2
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 0007008C
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 000700D3
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 00070FE5
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 00070000
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 00070F57
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 000A002C
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!system 760E804B 5 Bytes JMP 000A001B
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 000A000A
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!_open 760ED106 5 Bytes JMP 000A0FEF
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 000A0FB5
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 000A0FD2
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 000B0F97
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 000B002F
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 000B0000
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 000B0FA8
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 000B0054
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 000B0FCA
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 000B0FE5
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 000B0FB9
.text C:\Windows\system32\svchost.exe[1332] WS2_32.dll!socket 776436D1 5 Bytes JMP 000C0000
.text C:\Windows\system32\svchost.exe[1412] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 00D30000
.text C:\Windows\system32\svchost.exe[1412] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 00D30FDB
.text C:\Windows\system32\svchost.exe[1412] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 00D30011
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 001600B5
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 0016009A
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 001600D7
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 001600C6
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 0016006E
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 0016001B
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 0016002C
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 00160089
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 00160F94
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 00160FAF
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 00160051
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 00160FC0
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 00160F6F
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 00160F25
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 00160000
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 00160FE5
.text C:\Windows\system32\svchost.exe[1412] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 00160F4A
.text C:\Windows\system32\svchost.exe[1412] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 00D50F92
.text C:\Windows\system32\svchost.exe[1412] msvcrt.dll!system 760E804B 5 Bytes JMP 00D5001D
.text C:\Windows\system32\svchost.exe[1412] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 00D50FD2
.text C:\Windows\system32\svchost.exe[1412] msvcrt.dll!_open 760ED106 5 Bytes JMP 00D50FEF
.text C:\Windows\system32\svchost.exe[1412] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 00D50FAD
.text C:\Windows\system32\svchost.exe[1412] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 00D50000
.text C:\Windows\system32\svchost.exe[1412] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 01130F5E
.text C:\Windows\system32\svchost.exe[1412] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 01130F94
.text C:\Windows\system32\svchost.exe[1412] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 01130FE5
.text C:\Windows\system32\svchost.exe[1412] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 01130F83
.text C:\Windows\system32\svchost.exe[1412] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 0113001B
.text C:\Windows\system32\svchost.exe[1412] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 0113000A
.text C:\Windows\system32\svchost.exe[1412] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 01130FCA
.text C:\Windows\system32\svchost.exe[1412] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 01130FB9
.text C:\Windows\system32\svchost.exe[1412] WS2_32.dll!socket 776436D1 5 Bytes JMP 01140FEF
.text C:\Windows\system32\svchost.exe[1412] WinInet.dll!InternetOpenA 773ED6A8 5 Bytes JMP 010A0000
.text C:\Windows\system32\svchost.exe[1412] WinInet.dll!InternetOpenW 773EDB21 5 Bytes JMP 010A0FE5
.text C:\Windows\system32\svchost.exe[1412] WinInet.dll!InternetOpenUrlA 773EF3BC 5 Bytes JMP 010A0011
.text C:\Windows\system32\svchost.exe[1412] WinInet.dll!InternetOpenUrlW 77436DFF 5 Bytes JMP 010A0022
.text C:\Windows\system32\svchost.exe[1564] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 01080FEF
.text C:\Windows\system32\svchost.exe[1564] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 01080FB9
.text C:\Windows\system32\svchost.exe[1564] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 01080FDE
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 008F00A4
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 008F0093
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 008F0F21
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 008F0F32
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 008F0F72
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 008F0025
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 008F0FD4
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 008F0082
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 008F0F83
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 008F0FAF
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 008F0F94
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 008F0040
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 008F0071
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 008F00C9
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 008F000A
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 008F0FEF
.text C:\Windows\system32\svchost.exe[1564] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 008F0F43
.text C:\Windows\system32\svchost.exe[1564] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 01090FC3
.text C:\Windows\system32\svchost.exe[1564] msvcrt.dll!system 760E804B 5 Bytes JMP 0109004E
.text C:\Windows\system32\svchost.exe[1564] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 01090FEF
.text C:\Windows\system32\svchost.exe[1564] msvcrt.dll!_open 760ED106 5 Bytes JMP 0109000C
.text C:\Windows\system32\svchost.exe[1564] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 01090FDE
.text C:\Windows\system32\svchost.exe[1564] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 0109001D
.text C:\Windows\system32\svchost.exe[1564] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 00DF0040
.text C:\Windows\system32\svchost.exe[1564] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 00DF0FAF
.text C:\Windows\system32\svchost.exe[1564] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 00DF0000
.text C:\Windows\system32\svchost.exe[1564] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 00DF0F9E
.text C:\Windows\system32\svchost.exe[1564] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 00DF0065
.text C:\Windows\system32\svchost.exe[1564] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 00DF0FDB
.text C:\Windows\system32\svchost.exe[1564] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 00DF001B
.text C:\Windows\system32\svchost.exe[1564] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 00DF0FC0
.text C:\Windows\system32\svchost.exe[1564] WS2_32.dll!socket 776436D1 5 Bytes JMP 01190FEF
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 00D90FEF
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 00D90014
.text C:\Windows\system32\svchost.exe[1616] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 00D90FD4
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 00D40080
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 00D40F44
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 00D400AC
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 00D40F15
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 00D4006F
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 00D40FD4
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 00D40FC3
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 00D40F5F
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 00D40FA1
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 00D40FB2
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 00D4005E
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 00D40039
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 00D40F7A
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 00D400BD
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 00D4000A
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 00D40FEF
.text C:\Windows\system32\svchost.exe[1616] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 00D40091
.text C:\Windows\system32\svchost.exe[1616] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 00DE0F84
.text C:\Windows\system32\svchost.exe[1616] msvcrt.dll!system 760E804B 5 Bytes JMP 00DE0F95
.text C:\Windows\system32\svchost.exe[1616] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 00DE0FC1
.text C:\Windows\system32\svchost.exe[1616] msvcrt.dll!_open 760ED106 5 Bytes JMP 00DE0FEF
.text C:\Windows\system32\svchost.exe[1616] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 00DE0FB0
.text C:\Windows\system32\svchost.exe[1616] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 00DE0FD2
.text C:\Windows\system32\svchost.exe[1616] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 01000065
.text C:\Windows\system32\svchost.exe[1616] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 01000039
.text C:\Windows\system32\svchost.exe[1616] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 01000FEF
.text C:\Windows\system32\svchost.exe[1616] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 0100004A
.text C:\Windows\system32\svchost.exe[1616] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 01000080
.text C:\Windows\system32\svchost.exe[1616] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 01000FCD
.text C:\Windows\system32\svchost.exe[1616] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 01000FDE
.text C:\Windows\system32\svchost.exe[1616] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 0100001E
.text C:\Windows\system32\svchost.exe[1616] WS2_32.dll!socket 776436D1 5 Bytes JMP 01010000
.text C:\Windows\system32\svchost.exe[1616] WININET.dll!InternetOpenA 773ED6A8 5 Bytes JMP 00DF0000
.text C:\Windows\system32\svchost.exe[1616] WININET.dll!InternetOpenW 773EDB21 5 Bytes JMP 00DF0011
.text C:\Windows\system32\svchost.exe[1616] WININET.dll!InternetOpenUrlA 773EF3BC 5 Bytes JMP 00DF0022
.text C:\Windows\system32\svchost.exe[1616] WININET.dll!InternetOpenUrlW 77436DFF 5 Bytes JMP 00DF0FD1
.text C:\Windows\System32\svchost.exe[2076] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 00070000
.text C:\Windows\System32\svchost.exe[2076] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 0007002C
.text C:\Windows\System32\svchost.exe[2076] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 00070011
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 00050091
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 00050F55
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 00050F1F
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 000500C0
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 00050F92
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 0005001B
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 00050036
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 00050F66
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 00050FAF
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 00050051
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 00050062
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 00050FC0
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 00050F77
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 00050F0E
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 0005000A
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 00050FE5
.text C:\Windows\System32\svchost.exe[2076] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 00050F3A
.text C:\Windows\System32\svchost.exe[2076] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 00080069
.text C:\Windows\System32\svchost.exe[2076] msvcrt.dll!system 760E804B 5 Bytes JMP 0008004E
.text C:\Windows\System32\svchost.exe[2076] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 00080033
.text C:\Windows\System32\svchost.exe[2076] msvcrt.dll!_open 760ED106 5 Bytes JMP 00080000
.text C:\Windows\System32\svchost.exe[2076] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 00080FDE
.text C:\Windows\System32\svchost.exe[2076] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 00080FEF
.text C:\Windows\System32\svchost.exe[2076] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 00060051
.text C:\Windows\System32\svchost.exe[2076] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 00060FC3
.text C:\Windows\System32\svchost.exe[2076] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 00060000
.text C:\Windows\System32\svchost.exe[2076] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 00060040
.text C:\Windows\System32\svchost.exe[2076] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 00060F94
.text C:\Windows\System32\svchost.exe[2076] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 00060025
.text C:\Windows\System32\svchost.exe[2076] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 00060FE5
.text C:\Windows\System32\svchost.exe[2076] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 00060FD4
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[2796] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 6D939AE2 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[2796] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 6D939A20 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Windows\system32\svchost.exe[3604] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 00040000
.text C:\Windows\system32\svchost.exe[3604] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 00040FDB
.text C:\Windows\system32\svchost.exe[3604] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 00040011
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 000100A9
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 00010F6D
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 00010F52
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 000100E9
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 00010076
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 00010FDE
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 0001002F
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 00010098
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 0001005B
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 00010F9E
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 00010040
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 00010FC3
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 00010087
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 00010F41
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 00010014
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 00010FEF
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 000100CE
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 000A001B
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!system 760E804B 5 Bytes JMP 000A000A
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 000A0FB5
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!_open 760ED106 5 Bytes JMP 000A0FEF
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 000A0F9A
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 000A0FC6
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 000B005F
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 000B0033
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 000B0000
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 000B0044
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 000B0084
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 000B0022
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 000B0011
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 000B0FD1
.text C:\Windows\system32\svchost.exe[3604] WS2_32.dll!socket 776436D1 5 Bytes JMP 000C0000
.text C:\Windows\Explorer.EXE[5508] ntdll.dll!NtCreateFile 77724224 5 Bytes JMP 00040FE5
.text C:\Windows\Explorer.EXE[5508] ntdll.dll!NtCreateProcess 777242E4 5 Bytes JMP 00040FC3
.text C:\Windows\Explorer.EXE[5508] ntdll.dll!NtProtectVirtualMemory 77724B84 5 Bytes JMP 00040FD4
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!GetStartupInfoW 76651929 5 Bytes JMP 000100C9
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!GetStartupInfoA 766519C9 5 Bytes JMP 000100AE
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!CreateProcessW 76651BF3 5 Bytes JMP 000100FC
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!CreateProcessA 76651C28 5 Bytes JMP 000100EB
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!VirtualProtect 76651DC3 5 Bytes JMP 00010F8D
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!CreateNamedPipeA 76652EF5 5 Bytes JMP 00010FE5
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!CreateNamedPipeW 76655C0C 5 Bytes JMP 00010FD4
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!CreatePipe 76678F06 5 Bytes JMP 0001009D
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!LoadLibraryExW 7667927C 5 Bytes JMP 00010067
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!LoadLibraryW 76679400 5 Bytes JMP 00010FC3
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!LoadLibraryExA 76679554 5 Bytes JMP 00010FA8
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!LoadLibraryA 7667957C 5 Bytes JMP 0001004A
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!VirtualProtectEx 7667DC52 5 Bytes JMP 00010082
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!GetProcAddress 7669925B 5 Bytes JMP 00010F4A
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!CreateFileW 7669B0EB 5 Bytes JMP 0001001B
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!CreateFileA 7669D07F 5 Bytes JMP 00010000
.text C:\Windows\Explorer.EXE[5508] kernel32.dll!WinExec 766E60CF 5 Bytes JMP 000100DA
.text C:\Windows\Explorer.EXE[5508] ADVAPI32.dll!RegCreateKeyExA 774D39AB 5 Bytes JMP 0006006F
.text C:\Windows\Explorer.EXE[5508] ADVAPI32.dll!RegCreateKeyA 774D3BA9 5 Bytes JMP 00060FC3
.text C:\Windows\Explorer.EXE[5508] ADVAPI32.dll!RegOpenKeyA 774D89C7 5 Bytes JMP 00060FEF
.text C:\Windows\Explorer.EXE[5508] ADVAPI32.dll!RegCreateKeyW 774E391E 5 Bytes JMP 0006004A
.text C:\Windows\Explorer.EXE[5508] ADVAPI32.dll!RegCreateKeyExW 774E41F1 5 Bytes JMP 00060080
.text C:\Windows\Explorer.EXE[5508] ADVAPI32.dll!RegOpenKeyExA 774E7C42 5 Bytes JMP 00060FDE
.text C:\Windows\Explorer.EXE[5508] ADVAPI32.dll!RegOpenKeyW 774EE2B5 5 Bytes JMP 00060014
.text C:\Windows\Explorer.EXE[5508] ADVAPI32.dll!RegOpenKeyExW 774F7BA1 5 Bytes JMP 0006002F
.text C:\Windows\Explorer.EXE[5508] msvcrt.dll!_wsystem 760E7F2F 5 Bytes JMP 000B0FB7
.text C:\Windows\Explorer.EXE[5508] msvcrt.dll!system 760E804B 5 Bytes JMP 000B0038
.text C:\Windows\Explorer.EXE[5508] msvcrt.dll!_creat 760EBBE1 5 Bytes JMP 000B0FD2
.text C:\Windows\Explorer.EXE[5508] msvcrt.dll!_open 760ED106 5 Bytes JMP 000B0FEF
.text C:\Windows\Explorer.EXE[5508] msvcrt.dll!_wcreat 760ED326 5 Bytes JMP 000B0027
.text C:\Windows\Explorer.EXE[5508] msvcrt.dll!_wopen 760ED501 5 Bytes JMP 000B000C
.text C:\Windows\Explorer.EXE[5508] WS2_32.dll!socket 776436D1 5 Bytes JMP 0323000A
.text C:\Windows\Explorer.EXE[5508] WININET.dll!InternetOpenA 773ED6A8 5 Bytes JMP 052B000A
.text C:\Windows\Explorer.EXE[5508] WININET.dll!InternetOpenW 773EDB21 5 Bytes JMP 052B0FE5
.text C:\Windows\Explorer.EXE[5508] WININET.dll!InternetOpenUrlA 773EF3BC 5 Bytes JMP 052B0025
.text C:\Windows\Explorer.EXE[5508] WININET.dll!InternetOpenUrlW 77436DFF 5 Bytes JMP 052B0FD4

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\system32\mfevtps.exe[616] @ C:\Windows\system32\CRYPT32.dll [ADVAPI32.dll!RegQueryValueExW] [01287740] C:\Windows\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)
IAT C:\Windows\system32\mfevtps.exe[616] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [012877A0] C:\Windows\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)

Device \Driver\tdx \Device\Tcp [8C96CE58] \SystemRoot\system32\DRIVERS\tdx.sys[.data]
Device \Driver\tdx \Device\Udp [8C96CE58] \SystemRoot\system32\DRIVERS\tdx.sys[.data]
Device \Driver\tdx \Device\RawIp [8C96CE58] \SystemRoot\system32\DRIVERS\tdx.sys[.data]

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat mfehidk.sys (McAfee Link Driver/McAfee, Inc.)

---- Modules - GMER 1.0.15 ----

Module (noname) (*** hidden *** ) 8C94B000-8C961000 (90112 bytes)

---- Files - GMER 1.0.15 ----

File C:\Windows\$NtUninstallKB61696$\1260042778 0 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\@ 2048 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\bckfg.tmp 929 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\cfg.ini 208 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\Desktop.ini 4608 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\keywords 202 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\kwrd.dll 223744 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\L 0 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\L\qnbwvoto 72192 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\lsflt7.ver 5176 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\U 0 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\U\00000001.@ 2048 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\U\00000002.@ 224768 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\U\00000004.@ 1024 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\U\80000000.@ 11264 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\U\80000004.@ 12800 bytes
File C:\Windows\$NtUninstallKB61696$\1260042778\U\80000032.@ 77312 bytes
File C:\Windows\$NtUninstallKB61696$\3739174216 0 bytes

---- EOF - GMER 1.0.15 ----

nNeedofHelp · Jan 9, 2012

DDS text

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.19170
Run by Chris at 19:42:25 on 2012-01-08
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1982.624 [GMT -8:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\LEXBCES.EXE
C:\Windows\System32\LEXPPS.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\atashost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\mfevtps.exe
C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Western Digital\WD SmartWare\WDFME.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\schtasks.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Windows\sttray.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Pure Networks\Network Magic\nmapp.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Western Digital\WD SmartWare\WDDMStatus.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
C:\PROGRA~1\McAfee\MSM\McSmtFwk.exe
C:\PROGRA~1\COMMON~1\McAfee\MSC\McUICnt.exe
C:\Program Files\Common Files\McAfee\Core\mchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil11e_ActiveX.exe
C:\Windows\System32\ping.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://login.live.com/login.srf?wa...x&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
uWindow Title = Internet Explorer provided by Dell
uInternet Settings,ProxyOverride = <local>;192.168.*.*
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - No File
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110511190655.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: {2C0A5F28-48D8-408B-9172-9C6121025BCE} - No File
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [LDM] c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [<NO NAME>]
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SigmatelSysTrayApp] sttray.exe
mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
mRun: [nmapp] "c:\program files\pure networks\network magic\nmapp.exe" -autorun -nosplash
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\logite~2.lnk - c:\program files\logitech\desktop messenger\8876480\program\LDMConf.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\wdquic~1.lnk - c:\program files\western digital\wd smartware\WDDMStatus.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &ieSpell Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\iespell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\iespell\wikipedia.HTM
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
LSP: mswsock.dll
DPF: Web-Based Email Tools - hxxp://email01.secureserver.net/Download.CAB
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} - hxxp://www3.authentium.com/cssrelease/bin/wizard.exe
DPF: {3528A58B-595D-4AFD-A5F6-B914BD306DC3} - hxxp://dishconnectivity.sling.com/dpit/downloads/pc/SlingHealth.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photos.walmart.com/WalmartActivia.cab
DPF: {42B182F9-3F08-484E-9913-07193A5D36A9} - hxxp://astak.dyndns.org:8080/web/WebClient.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUplden-us.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} - hxxp://68.101.171.235:82/xplugLiteAL.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-us.cab
TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
TCP: Interfaces\{0158B184-94DE-4BE6-A7C2-A031A5AA602E} : DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll
Handler: x-excid - {9D6CC632-1337-4a33-9214-2DA092E776F4} - c:\windows\downloaded program files\mimectl.dll
AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-12-18 387480]
R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2010-12-18 64584]
R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-12-18 165032]
R2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2010-10-5 20376]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-9-19 21504]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2007-5-19 3712]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-12-18 56064]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-12-18 153280]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-12-18 52320]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-12-18 314088]
S2 0060281189143824mcinstcleanup;McAfee Application Installer Cleanup (0060281189143824); [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 dlbc_device;dlbc_device;c:\windows\system32\dlbccoms.exe -service --> c:\windows\system32\dlbccoms.exe -service [?]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2007-5-10 30192]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-12-18 84488]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]
.
=============== Created Last 30 ================
.
2011-12-15 09:15:30 644368 ----a-w- c:\programdata\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll
.
==================== Find3M ====================
.
2011-12-10 23:24:06 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-29 20:25:58 1062984 ----a-w- c:\users\chris\gotomypc_540.exe
2011-11-23 13:37:27 2043904 ----a-w- c:\windows\system32\win32k.sys
2011-11-21 23:20:35 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-08 14:42:19 2048 ----a-w- c:\windows\system32\tzres.dll
2011-11-03 06:22:04 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-03 06:17:38 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-03 06:17:23 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-11-03 06:17:08 71680 ----a-w- c:\windows\system32\iesetup.dll
2011-11-03 06:17:08 109056 ----a-w- c:\windows\system32\iesysprep.dll
2011-11-03 05:22:43 385024 ----a-w- c:\windows\system32\html.iec
2011-11-03 04:45:39 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2011-11-03 04:43:59 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-10-27 08:01:53 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-27 08:01:53 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 15:56:04 49152 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-14 16:02:19 429056 ----a-w- c:\windows\system32\EncDec.dll
.
============= FINISH: 19:43:42.72 ===============

nNeedofHelp · Jan 9, 2012

Attach

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume3
Install Date: 5/10/2007 11:41:33 AM
System Uptime: 1/7/2012 5:41:51 PM (26 hours ago)
.
Motherboard: Dell Inc | |
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ | Socket M2 | 2000/1000mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 139 GiB total, 25.887 GiB free.
D: is FIXED (NTFS) - 10 GiB total, 5.471 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is Removable
H: is Removable
I: is Removable
J: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1903: 12/16/2011 12:00:04 AM - Scheduled Checkpoint
RP1904: 12/16/2011 7:18:41 PM - Scheduled Checkpoint
RP1905: 12/18/2011 12:00:05 AM - Scheduled Checkpoint
RP1906: 12/19/2011 12:00:04 AM - Scheduled Checkpoint
RP1907: 12/19/2011 2:49:26 PM - Scheduled Checkpoint
RP1908: 12/21/2011 7:53:45 AM - Scheduled Checkpoint
RP1909: 12/22/2011 8:32:09 AM - Scheduled Checkpoint
RP1910: 1/4/2012 3:35:27 AM - Scheduled Checkpoint
RP1911: 1/4/2012 4:22:52 PM - Windows Update
RP1912: 1/6/2012 12:00:16 AM - Scheduled Checkpoint
RP1913: 1/7/2012 12:00:07 AM - Scheduled Checkpoint
RP1914: 1/7/2012 5:34:26 PM - Scheduled Checkpoint
RP1915: 1/8/2012 3:38:15 PM - Scheduled Checkpoint
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Adobe Flash Player 11 ActiveX
Adobe Reader 7.0.8
Adobe Shockwave Player
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Authentium Web Install Helper
AutoUpdate
Bonjour
Cisco Network Magic
Corel Paint Shop Pro Photo XI
Corel Snapfire Plus
Dell Digital Jukebox Driver
Dell DJ Explorer
Dell Games
Dell Photo Printer 720
Dell Support Center (Support Software)
Dell System Customization Wizard
DellSupport
DivX Codec
DivX Converter
DivX Player
DivX Web Player
Documentation & Support Launcher
EarthLink Setup Files
FileZilla Client 3.2.7.1
Free CD to MP3 Converter
Games, Music, & Photos Launcher
Google Desktop
Google SketchUp 6
Google Toolbar for Internet Explorer
GoToMeeting/GoToWebinar 3.0.0.198
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
ieSpell
Internet Service Offers Launcher
iTunes
Java(TM) SE Runtime Environment 6
KhalSetup
Logitech Communications Manager
Logitech Desktop Messenger
Logitech SetPoint
Malwarebytes Anti-Malware version 1.60.0.1800
McAfee SecurityCenter
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Outlook Web Access S/MIME
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
MotoHelper 2.0.45 Driver 5.0.0
MotoHelper MergeModules
Motorola Mobile Drivers Installation 5.0.0
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Network Magic
NVIDIA Drivers
OGA Notifier 2.0.0048.0
Pure Networks Platform
QuickTime
Recuva
Roxio Creator Audio
Roxio Creator BDAV Plugin
Roxio Creator Copy
Roxio Creator Data
Roxio Creator Premier
Roxio Creator Tools
Roxio EasyArchive
Roxio MyDVD Premier
Roxio Update Manager
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2553089)
Security Update for 2007 Microsoft Office System (KB2553090)
Security Update for 2007 Microsoft Office System (KB2584063)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
SigmaTel Audio
SlingHealth ActiveX
Sonic Activation Module
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
URL Assistant
User's Guides
WavePad Sound Editor
WD SmartWare
WebEx Support Manager for Internet Explorer
.
==== Event Viewer Messages From Past Week ========
.
1/7/2012 5:43:51 PM, Error: Service Control Manager [7034] - The dlbc_device service terminated unexpectedly. It has done this 1 time(s).
1/7/2012 5:43:51 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
1/7/2012 5:43:51 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
1/7/2012 5:43:51 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
1/7/2012 5:42:08 PM, Error: EventLog [6008] - The previous system shutdown at 5:40:03 PM on 1/7/2012 was unexpected.
1/3/2012 8:09:02 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user Workhorse\Chris SID (S-1-5-21-2408829221-1492129756-583714143-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
1/3/2012 8:02:45 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SPService service to connect.
1/3/2012 8:02:45 AM, Error: Service Control Manager [7000] - The SPService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/3/2012 8:01:02 AM, Error: EventLog [6008] - The previous system shutdown at 7:58:29 AM on 1/3/2012 was unexpected.
1/3/2012 7:15:16 AM, Error: Service Control Manager [7022] - The Pure Networks Platform Service service hung on starting.
.
==== End Of File ===========================

Broni · Jan 9, 2012

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan.
On completion of the scan click "Save log", save it to your desktop and post in your next reply.

NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

=============================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.

**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode (How to...)

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

nNeedofHelp · Jan 9, 2012

aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-09 08:59:41
-----------------------------
08:59:41.351 OS Version: Windows 6.0.6002 Service Pack 2
08:59:41.352 Number of processors: 2 586 0x4B02
08:59:41.353 ComputerName: WORKHORSE UserName: Chris
08:59:49.405 Initialize success
09:02:31.086 AVAST engine defs: 12010900
09:03:07.075 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000053
09:03:07.078 Disk 0 Vendor: ST316081 3.AD Size: 152587MB BusType: 6
09:03:07.550 Disk 0 MBR read successfully
09:03:07.553 Disk 0 MBR scan
09:03:07.560 Disk 0 Windows VISTA default MBR code
09:03:07.770 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
09:03:07.995 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 81920
09:03:08.248 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 142306 MB offset 21053440
09:03:08.722 Disk 0 scanning sectors +312496128
09:03:09.594 Disk 0 scanning C:\Windows\system32\drivers
09:05:37.199 File: C:\Windows\system32\drivers\tdx.sys **INFECTED** Win32:Aluroot [Rtk]
09:06:00.785 Disk 0 trace - called modules:
09:06:00.855 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x86ffcf10]<<
09:06:00.865 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85d094b8]
09:06:00.873 3 CLASSPNP.SYS[831db8b3] -> nt!IofCallDriver -> [0x86f8edd0]
09:06:00.882 \Driver\00000636[0x86f8ef38] -> IRP_MJ_CREATE -> 0x86ffcf10
09:06:03.339 AVAST engine scan C:\Windows
09:07:52.009 AVAST engine scan C:\Windows\system32
09:23:19.444 AVAST engine scan C:\Windows\system32\drivers
09:23:41.518 File: C:\Windows\system32\drivers\tdx.sys **INFECTED** Win32:Aluroot [Rtk]
09:23:48.179 AVAST engine scan C:\Users\Chris
09:41:41.974 AVAST engine scan C:\ProgramData
10:42:59.695 Scan finished successfully
10:45:29.564 Disk 0 MBR has been saved successfully to "C:\Users\Chris\Desktop\MBR.dat"
10:45:29.611 The log file has been saved successfully to "C:\Users\Chris\Desktop\aswMBR.txt"

nNeedofHelp · Jan 9, 2012

ComboFix 12-01-09.03 - Chris 01/09/2012 11:49:50.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1982.1161 [GMT -8:00]
Running from: c:\users\Chris\Desktop\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Chris\g2mdlhlpx.exe
c:\users\Chris\gotomypc_540.exe
c:\windows\$NtUninstallKB61696$\1260042778\@
c:\windows\$NtUninstallKB61696$\1260042778\bckfg.tmp
c:\windows\$NtUninstallKB61696$\1260042778\cfg.ini
c:\windows\$NtUninstallKB61696$\1260042778\Desktop.ini
c:\windows\$NtUninstallKB61696$\1260042778\keywords
c:\windows\$NtUninstallKB61696$\1260042778\kwrd.dll
c:\windows\$NtUninstallKB61696$\1260042778\L\qnbwvoto
c:\windows\$NtUninstallKB61696$\1260042778\lsflt7.ver
c:\windows\$NtUninstallKB61696$\1260042778\U\00000001.@
c:\windows\$NtUninstallKB61696$\1260042778\U\00000002.@
c:\windows\$NtUninstallKB61696$\1260042778\U\00000004.@
c:\windows\$NtUninstallKB61696$\1260042778\U\80000000.@
c:\windows\$NtUninstallKB61696$\1260042778\U\80000004.@
c:\windows\$NtUninstallKB61696$\1260042778\U\80000032.@
c:\windows\$NtUninstallKB61696$\3739174216
c:\windows\bwUnin-7.2.0.137-8876480SL.exe
c:\windows\system32\nscA33B.tmp
c:\windows\system32\nsd7043.tmp
c:\windows\system32\nsd70E1.tmp
c:\windows\system32\nshA30B.tmp
c:\windows\system32\nshF024.tmp
c:\windows\system32\nshF073.tmp
c:\windows\system32\nsmA37A.tmp
c:\windows\system32\nso6FE5.tmp
c:\windows\system32\nso7083.tmp
c:\windows\system32\nsrA20E.tmp
c:\windows\system32\nsrA2AB.tmp
c:\windows\system32\nst6F18.tmp
c:\windows\system32\nst6FB5.tmp
c:\windows\system32\nsxA2CC.tmp
c:\windows\$NtUninstallKB61696$ . . . . Failed to delete
.
.
((((((((((((((((((((((((( Files Created from 2011-12-09 to 2012-01-09 )))))))))))))))))))))))))))))))
.
.
2012-01-09 20:10 . 2012-01-09 20:18 -------- d-----w- c:\users\Chris\AppData\Local\temp
2012-01-09 20:10 . 2012-01-09 20:10 -------- d-----w- c:\users\Hooper\AppData\Local\temp
2012-01-09 20:10 . 2012-01-09 20:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-01-09 20:10 . 2012-01-09 20:10 -------- d-----w- c:\users\Guest\AppData\Local\temp
2012-01-09 20:10 . 2012-01-09 20:10 -------- d-----w- c:\users\Angi\AppData\Local\temp
2011-12-20 01:24 . 2011-12-20 01:24 -------- d-----w- c:\windows\Sun
2011-12-15 09:15 . 2011-12-15 09:15 644368 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-10 23:24 . 2010-10-24 16:15 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-21 23:20 . 2011-06-07 14:11 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-04-11 04:45 . D4681AB1350AB51BA37FCF5B1061B90B . 72192 . . [------] . . c:\windows\System32\drivers\tdx.sys
[-] 2009-04-11 04:45 . D4681AB1350AB51BA37FCF5B1061B90B . 72192 . . [------] . . c:\windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6002.18005_none_ec294157d9377403\tdx.sys
[7] 2008-01-19 . D09276B1FAB033CE1D40DCBDF303D10F . 71680 . . [6.0.6001.18000] . . c:\windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6001.18000_none_ea3dc84bdc15a8b7\tdx.sys
[7] 2006-11-02 . AB4FDE8AF4A0270A46A001C08CBCE1C2 . 68096 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6000.16386_none_e807064fdf2a97e3\tdx.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2006-11-12 446976]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-05-20 32768]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-22 30192]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2006-11-17 17920]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-05-10 94208]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 92704]
"SigmatelSysTrayApp"="sttray.exe" [2007-02-08 303104]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2009-07-08 472112]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-06-28 1195408]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-12-25 981680]
.
c:\users\Angi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\users\Hooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-5-19 450560]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-5-19 593920]
WD Quick View.lnk - c:\program files\Western Digital\WD SmartWare\WDDMStatus.exe [2011-8-1 3983760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ymetray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ymetray.lnk
backup=c:\windows\pss\ymetray.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-23 03:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2006-05-17 21:18 480816 ----a-w- c:\program files\Common Files\Logitech\LComMgr\Communications_Helper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
2006-05-17 17:12 243248 ----a-w- c:\program files\Common Files\Logitech\LComMgr\LVComSX.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 07:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R2 0060281189143824mcinstcleanup;McAfee Application Installer Cleanup (0060281189143824); [x]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Supplementary Scan -------
.
uStart Page = https://login.live.com/login.srf?wa...x&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
uInternet Settings,ProxyOverride = <local>;192.168.*.*
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Web-Based Email Tools - hxxp://email01.secureserver.net/Download.CAB
DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} - hxxp://www3.authentium.com/cssrelease/bin/wizard.exe
DPF: {3528A58B-595D-4AFD-A5F6-B914BD306DC3} - hxxp://dishconnectivity.sling.com/dpit/downloads/pc/SlingHealth.cab
DPF: {42B182F9-3F08-484E-9913-07193A5D36A9} - hxxp://astak.dyndns.org:8080/web/WebClient.cab
DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} - hxxp://68.101.171.235:82/xplugLiteAL.cab
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-Corel Photo Downloader - c:\program files\Corel\Corel Snapfire Plus\PhotoDownloader.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-09 12:17
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,88,77,1d,12,35,f9,93,40,ab,0f,e4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,88,77,1d,12,35,f9,93,40,ab,0f,e4,\
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(5656)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\program files\Pure Networks\Network Magic\nmrsrc.dll
c:\program files\FileZilla FTP Client\fzshellext.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\windows\System32\LEXBCES.EXE
c:\windows\System32\LEXPPS.EXE
c:\windows\system32\atashost.exe
c:\windows\system32\dlbccoms.exe
c:\windows\system32\mfevtps.exe
c:\program files\Motorola\MotoHelper\MotoHelperService.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\Western Digital\WD SmartWare\WDDMService.exe
c:\program files\Western Digital\WD SmartWare\WDRulesEngine.exe
c:\program files\Motorola\MotoHelper\MotoHelperAgent.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\program files\Common Files\McAfee\SystemCore\mfefire.exe
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Western Digital\WD SmartWare\WDFME.exe
c:\windows\system32\schtasks.exe
c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe
c:\windows\sttray.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\WerCon.exe
.
**************************************************************************
.
Completion time: 2012-01-09 12:26:24 - machine was rebooted
ComboFix-quarantined-files.txt 2012-01-09 20:26
.
Pre-Run: 27,173,138,432 bytes free
Post-Run: 29,132,021,760 bytes free
.
- - End Of File - - 4EE806C0F4B8830C1A586D5C5B844BF0

Broni · Jan 9, 2012

1. Please open Notepad (Start>All Programs>Accessories>Notepad).

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

FCopy::
c:\windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6001.18000_none_ea3dc84bdc15a8b7\tdx.sys | c:\windows\System32\drivers\tdx.sys
c:\windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6001.18000_none_ea3dc84bdc15a8b7\tdx.sys | c:\windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6002.18005_none_ec294157d9377403\tdx.sys

DDS::
uInternet Settings,ProxyOverride = <local>;192.168.*.*

ClearJavaCache::

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

nNeedofHelp · Jan 9, 2012

Both times I tried to cancel McAfee I get the message that antivirus & antispyware are still running from Combofix. I went into McAfee and turned off real time scanning and firewall and auto updates, then went to services and stopped all mcafee process. But still get warning. What should I do?

Broni · Jan 9, 2012

Go ahead and run Combofix fix anyway.

nNeedofHelp · Jan 9, 2012

ComboFix 12-01-09.03 - Chris 01/09/2012 13:45:31.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1982.1107 [GMT -8:00]
Running from: c:\users\Chris\Desktop\ComboFix.exe
Command switches used :: c:\users\Chris\Documents\CFScript.txt
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6001.18000_none_ea3dc84bdc15a8b7\tdx.sys --> c:\windows\System32\drivers\tdx.sys
.
((((((((((((((((((((((((( Files Created from 2011-12-09 to 2012-01-09 )))))))))))))))))))))))))))))))
.
.
2012-01-09 22:01 . 2012-01-09 22:02 -------- d-----w- c:\users\Chris\AppData\Local\temp
2012-01-09 22:01 . 2012-01-09 22:01 -------- d-----w- c:\users\Hooper\AppData\Local\temp
2012-01-09 22:01 . 2012-01-09 22:01 -------- d-----w- c:\users\Guest\AppData\Local\temp
2012-01-09 22:01 . 2012-01-09 22:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-01-09 22:01 . 2012-01-09 22:01 -------- d-----w- c:\users\Angi\AppData\Local\temp
2011-12-20 01:24 . 2011-12-20 01:24 -------- d-----w- c:\windows\Sun
2011-12-15 09:15 . 2011-12-15 09:15 644368 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-10 23:24 . 2010-10-24 16:15 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-21 23:20 . 2011-06-07 14:11 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2006-11-12 446976]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-05-20 32768]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-22 30192]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2006-11-17 17920]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-05-10 94208]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 92704]
"SigmatelSysTrayApp"="sttray.exe" [2007-02-08 303104]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2009-07-08 472112]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-06-28 1195408]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-12-25 981680]
.
c:\users\Angi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\users\Hooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-5-19 450560]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-5-19 593920]
WD Quick View.lnk - c:\program files\Western Digital\WD SmartWare\WDDMStatus.exe [2011-8-1 3983760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ymetray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ymetray.lnk
backup=c:\windows\pss\ymetray.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-23 03:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2006-05-17 21:18 480816 ----a-w- c:\program files\Common Files\Logitech\LComMgr\Communications_Helper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]
2006-05-17 17:12 243248 ----a-w- c:\program files\Common Files\Logitech\LComMgr\LVComSX.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 07:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R2 0060281189143824mcinstcleanup;McAfee Application Installer Cleanup (0060281189143824); [x]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Supplementary Scan -------
.
uStart Page = https://login.live.com/login.srf?wa...x&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Web-Based Email Tools - hxxp://email01.secureserver.net/Download.CAB
DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} - hxxp://www3.authentium.com/cssrelease/bin/wizard.exe
DPF: {3528A58B-595D-4AFD-A5F6-B914BD306DC3} - hxxp://dishconnectivity.sling.com/dpit/downloads/pc/SlingHealth.cab
DPF: {42B182F9-3F08-484E-9913-07193A5D36A9} - hxxp://astak.dyndns.org:8080/web/WebClient.cab
DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} - hxxp://68.101.171.235:82/xplugLiteAL.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-09 14:02
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,88,77,1d,12,35,f9,93,40,ab,0f,e4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,88,77,1d,12,35,f9,93,40,ab,0f,e4,\
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2012-01-09 14:05:03
ComboFix-quarantined-files.txt 2012-01-09 22:04
ComboFix2.txt 2012-01-09 20:26
.
Pre-Run: 29,023,145,984 bytes free
Post-Run: 29,039,706,112 bytes free
.
- - End Of File - - 2A7D8B62A6F1A3A825AA275A81D5878E

Broni · Jan 9, 2012

Looks good.

How is computer doing?

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

nNeedofHelp · Jan 9, 2012

OTL logfile created on: 1/9/2012 3:45:23 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Chris\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 0.73 Gb Available Physical Memory | 37.83% Memory free
4.11 Gb Paging File | 2.71 Gb Available in Paging File | 66.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 138.97 Gb Total Space | 27.07 Gb Free Space | 19.48% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.47 Gb Free Space | 54.71% Space Free | Partition Type: NTFS

Computer Name: WORKHORSE | User Name: Chris | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/01/09 15:43:41 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Chris\Desktop\OTL.exe
PRC - [2011/08/01 10:11:38 | 001,091,984 | ---- | M] (Western Digital ) -- C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe
PRC - [2011/08/01 10:11:36 | 001,592,208 | ---- | M] (Western Digital ) -- C:\Program Files\Western Digital\WD SmartWare\WDFME.exe
PRC - [2011/08/01 10:11:34 | 003,983,760 | ---- | M] (Western Digital Technologies, Inc.) -- C:\Program Files\Western Digital\WD SmartWare\WDDMStatus.exe
PRC - [2011/08/01 10:11:32 | 000,263,056 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe
PRC - [2011/06/28 06:01:30 | 001,195,408 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2011/04/14 13:01:38 | 000,188,136 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
PRC - [2011/04/14 13:01:38 | 000,171,168 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
PRC - [2011/04/14 13:01:38 | 000,141,792 | ---- | M] (McAfee, Inc.) -- C:\Windows\System32\mfevtps.exe
PRC - [2011/01/27 13:13:50 | 000,226,624 | ---- | M] () -- C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
PRC - [2011/01/27 13:13:40 | 000,673,088 | ---- | M] () -- C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
PRC - [2010/03/10 10:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
PRC - [2009/07/07 13:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2009/04/10 22:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/03/06 11:59:12 | 000,020,376 | ---- | M] (WebEx Communications, Inc.) -- C:\Windows\System32\atashost.exe
PRC - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/01/18 23:33:27 | 000,151,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe
PRC - [2007/02/07 15:26:52 | 000,538,096 | ---- | M] ( ) -- C:\Windows\System32\dlbccoms.exe
PRC - [2006/05/24 23:20:50 | 000,593,920 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2006/05/17 13:18:36 | 000,480,816 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
PRC - [2006/05/17 09:12:50 | 000,243,248 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
PRC - [2006/05/10 08:48:08 | 000,094,208 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe

========== Modules (No Company Name) ==========

MOD - [2011/01/27 13:13:40 | 000,673,088 | ---- | M] () -- C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (0060281189143824mcinstcleanup) McAfee Application Installer Cleanup (0060281189143824)
SRV - [2011/08/01 10:11:38 | 001,091,984 | ---- | M] (Western Digital ) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe -- (WDRulesService)
SRV - [2011/08/01 10:11:36 | 001,592,208 | ---- | M] (Western Digital ) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WDFME.exe -- (WDFMEService)
SRV - [2011/08/01 10:11:32 | 000,263,056 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe -- (WDDMService)
SRV - [2011/04/14 13:01:38 | 000,188,136 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe -- (mfefire)
SRV - [2011/04/14 13:01:38 | 000,171,168 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV - [2011/04/14 13:01:38 | 000,141,792 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Windows\System32\mfevtps.exe -- (mfevtp)
SRV - [2011/01/27 13:13:50 | 000,226,624 | ---- | M] () [Auto | Running] -- C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe -- (MotoHelper)
SRV - [2010/10/07 20:34:28 | 000,364,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2010/03/10 10:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McProxy)
SRV - [2010/03/10 10:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV - [2010/03/10 10:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV - [2010/03/10 10:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV - [2010/03/10 10:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV - [2009/07/07 13:48:44 | 000,647,216 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2009/03/06 11:59:12 | 000,020,376 | ---- | M] (WebEx Communications, Inc.) [Auto | Running] -- C:\Windows\System32\atashost.exe -- (atashost)
SRV - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2007/02/07 15:26:52 | 000,538,096 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\dlbccoms.exe -- (dlbc_device)
SRV - [2006/11/07 10:27:02 | 000,070,656 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2011/04/14 13:01:38 | 000,387,480 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2011/04/14 13:01:38 | 000,314,088 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfefirek.sys -- (mfefirek)
DRV - [2011/04/14 13:01:38 | 000,165,032 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfewfpk.sys -- (mfewfpk)
DRV - [2011/04/14 13:01:38 | 000,153,280 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2011/04/14 13:01:38 | 000,095,824 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2011/04/14 13:01:38 | 000,084,488 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2011/04/14 13:01:38 | 000,064,584 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfenlfk.sys -- (mfenlfk)
DRV - [2011/04/14 13:01:38 | 000,056,064 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\cfwids.sys -- (cfwids)
DRV - [2011/04/14 13:01:38 | 000,052,320 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2009/07/07 13:48:44 | 000,027,696 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis)
DRV - [2009/07/07 13:48:44 | 000,026,672 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)
DRV - [2008/05/06 15:06:00 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2007/08/09 17:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
DRV - [2007/03/20 06:21:18 | 000,046,848 | ---- | M] (Mars Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mr7910.sys -- (mr7910)
DRV - [2007/02/07 21:16:26 | 000,647,680 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2006/11/01 23:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/11/01 23:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2006/11/01 23:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/10/13 19:04:33 | 004,422,560 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006/10/05 13:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006/08/17 12:43:52 | 000,007,424 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Program Files\DellSupport\Drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/05/24 23:53:06 | 000,003,712 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2006/05/10 08:56:54 | 000,027,264 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidKE.Sys -- (LHidKe)
DRV - [2006/05/10 08:56:50 | 000,071,680 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMOUKE.sys -- (LMouKE)
DRV - [2005/08/17 06:47:48 | 000,073,696 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdserd.sys -- (sscdserd) SAMSUNG CDMA Modem Diagnostic Serial Port (WDM)
DRV - [2005/08/17 06:46:26 | 000,093,872 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2005/08/17 06:46:20 | 000,008,272 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2005/08/17 06:45:00 | 000,058,352 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
DRV - [2003/10/28 00:00:00 | 000,016,890 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ctpdusb2.sys -- (Jukebox)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:33440

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:33440

IE - HKU\S-1-5-21-2408829221-1492129756-583714143-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://login.live.com/login.srf?wa...x&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
IE - HKU\S-1-5-21-2408829221-1492129756-583714143-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2408829221-1492129756-583714143-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

O1 HOSTS File: ([2012/01/09 12:15:47 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110511190655.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKU\S-1-5-21-2408829221-1492129756-583714143-1000\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] c:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [nmapp] C:\Program Files\Pure Networks\Network Magic\nmapp.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray.exe (SigmaTel, Inc.)
O4 - HKU\S-1-5-21-2408829221-1492129756-583714143-1000..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKU\S-1-5-21-2408829221-1492129756-583714143-1000..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKU\S-1-5-21-2408829221-1492129756-583714143-1000..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2408829221-1492129756-583714143-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2408829221-1492129756-583714143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-2408829221-1492129756-583714143-1000\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} http://www3.authentium.com/cssrelease/bin/wizard.exe (CNavigationManager Object)
O16 - DPF: {3528A58B-595D-4AFD-A5F6-B914BD306DC3} http://dishconnectivity.sling.com/dpit/downloads/pc/SlingHealth.cab (SlingHealth Class)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photos.walmart.com/WalmartActivia.cab (Snapfish Activia)
O16 - DPF: {42B182F9-3F08-484E-9913-07193A5D36A9} http://astak.dyndns.org:8080/web/WebClient.cab (WebClient Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUplden-us.cab (MSN Photo Upload Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} http://68.101.171.235:82/xplugLiteAL.cab (Gif89 Lite Class)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-us.cab (Windows Live Hotmail Photo Upload Tool)
O16 - DPF: Web-Based Email Tools http://email01.secureserver.net/Download.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0158B184-94DE-4BE6-A7C2-A031A5AA602E}: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O18 - Protocol\Handler\bw+0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw+0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw-0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw00 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw00s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw-0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw10 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw10s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw20 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw20s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw30 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw30s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw40 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw40s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw50 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw50s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw60 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw60s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw70 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw70s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw80 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw80s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw90 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw90s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwa0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwa0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwb0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwb0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwc0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwc0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwd0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwd0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwe0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwe0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwf0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwf0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwg0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwg0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwh0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwh0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwi0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwi0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwj0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwj0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwk0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwk0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwl0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwl0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwm0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwm0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwn0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwn0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwo0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwo0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwp0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwp0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwq0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwq0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwr0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwr0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bws0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bws0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwt0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwt0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwu0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwu0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwv0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwv0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bww0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bww0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwx0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwx0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwy0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwy0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwz0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwz0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\offline-8876480 {11A19727-B155-4C53-BFC8-7A0B22195F50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\x-excid {9D6CC632-1337-4a33-9214-2DA092E776F4} - c:\Windows\Downloaded Program Files\mimectl.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) -C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Chris\Pictures\Colorado\P1140133.JPG
O24 - Desktop BackupWallPaper: C:\Users\Chris\Pictures\Colorado\P1140133.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 13:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

nNeedofHelp · Jan 9, 2012

Part 2

========== Files/Folders - Created Within 30 Days ==========

[2012/01/09 15:43:27 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Chris\Desktop\OTL.exe
[2012/01/09 14:05:13 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/01/09 14:05:06 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\temp
[2012/01/09 13:41:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012/01/09 13:33:12 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/01/09 11:19:20 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/01/09 11:19:20 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/01/09 11:19:20 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/01/09 11:02:11 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012/01/09 10:52:12 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/01/09 10:47:22 | 004,376,389 | R--- | C] (Swearware) -- C:\Users\Chris\Desktop\ComboFix.exe
[2012/01/09 08:58:59 | 004,713,472 | ---- | C] (AVAST Software) -- C:\Users\Chris\Desktop\aswMBR.exe
[2012/01/08 19:41:04 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Chris\Desktop\dds.scr
[2011/12/19 17:24:46 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2007/08/07 20:45:24 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\dlbcinpa.dll
[2007/08/07 20:45:24 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\dlbciesc.dll
[2007/08/07 20:45:24 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\DLBChcp.dll
[2007/08/07 20:45:23 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\dlbcserv.dll
[2007/08/07 20:45:23 | 000,991,232 | ---- | C] ( ) -- C:\Windows\System32\dlbcusb1.dll
[2007/08/07 20:45:23 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\dlbcpmui.dll
[2007/08/07 20:45:23 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\dlbclmpm.dll
[2007/08/07 20:45:23 | 000,483,328 | ---- | C] ( ) -- C:\Windows\System32\dlbcjswr.dll
[2007/08/07 20:45:23 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\dlbcprox.dll
[2007/08/07 20:45:23 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\dlbcpplc.dll
[2007/08/07 20:45:22 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\dlbchbn3.dll
[2007/08/07 20:45:22 | 000,538,096 | ---- | C] ( ) -- C:\Windows\System32\dlbccoms.exe
[2007/08/07 20:45:22 | 000,386,544 | ---- | C] ( ) -- C:\Windows\System32\dlbcih.exe
[2007/08/07 20:45:22 | 000,073,728 | ---- | C] ( ) -- C:\Windows\System32\dlbccu.dll
[2007/08/07 20:45:21 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\dlbccomc.dll
[2007/08/07 20:45:21 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\dlbccomm.dll
[2007/08/07 20:45:21 | 000,382,448 | ---- | C] ( ) -- C:\Windows\System32\dlbccfg.exe
[2006/09/14 08:32:20 | 000,028,672 | R--- | C] ( ) -- C:\Windows\System32\DivXGraphBuilderCallback.dll

========== Files - Modified Within 30 Days ==========

[2012/01/09 15:43:41 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Chris\Desktop\OTL.exe
[2012/01/09 15:39:33 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/09 15:39:33 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/09 13:39:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/01/09 12:15:47 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/01/09 10:47:29 | 004,376,389 | R--- | M] (Swearware) -- C:\Users\Chris\Desktop\ComboFix.exe
[2012/01/09 10:45:29 | 000,000,512 | ---- | M] () -- C:\Users\Chris\Desktop\MBR.dat
[2012/01/09 08:59:01 | 004,713,472 | ---- | M] (AVAST Software) -- C:\Users\Chris\Desktop\aswMBR.exe
[2012/01/08 19:41:07 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Chris\Desktop\dds.scr
[2012/01/07 17:42:02 | 200,163,303 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/01/05 13:32:00 | 000,604,264 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/01/05 13:32:00 | 000,103,964 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/01/04 08:22:47 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011/12/20 15:08:53 | 000,002,627 | ---- | M] () -- C:\Users\Chris\Desktop\Microsoft Office Word 2007.lnk
[2011/12/19 08:26:47 | 000,014,088 | -HS- | M] () -- C:\Users\Chris\AppData\Local\s8ta14g2pp4nrg
[2011/12/19 08:26:47 | 000,014,088 | -HS- | M] () -- C:\ProgramData\s8ta14g2pp4nrg
[2011/12/14 03:34:26 | 000,313,136 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/12/10 17:11:43 | 000,001,356 | ---- | M] () -- C:\Users\Chris\AppData\Local\d3d9caps.dat

========== Files Created - No Company Name ==========

[2012/01/09 11:19:20 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/01/09 11:19:20 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/01/09 11:19:20 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/01/09 11:19:20 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/01/09 11:19:20 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/01/09 10:45:29 | 000,000,512 | ---- | C] () -- C:\Users\Chris\Desktop\MBR.dat
[2012/01/04 08:22:47 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011/12/19 08:07:43 | 000,014,088 | -HS- | C] () -- C:\Users\Chris\AppData\Local\s8ta14g2pp4nrg
[2011/12/19 08:07:43 | 000,014,088 | -HS- | C] () -- C:\ProgramData\s8ta14g2pp4nrg
[2011/10/10 14:56:28 | 000,094,208 | ---- | C] () -- C:\Windows\System32\PdeSrv2p.dll
[2011/10/10 14:55:37 | 000,149,504 | ---- | C] () -- C:\Windows\UNWISE.EXE
[2011/05/11 15:53:19 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2011/02/25 12:59:20 | 000,816,904 | ---- | C] () -- C:\Windows\System32\HsPlayer.dll
[2011/02/22 18:15:02 | 000,186,120 | ---- | C] () -- C:\Windows\System32\OpeSDK.dll
[2010/11/01 17:30:56 | 000,309,000 | ---- | C] () -- C:\Windows\System32\HsPlayer.exe
[2009/12/02 07:39:08 | 008,892,928 | ---- | C] () -- C:\ProgramData\atscie.msi
[2009/09/10 16:35:54 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/09/10 16:35:53 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2008/11/21 13:47:52 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008/11/21 13:44:16 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008/09/28 02:01:24 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2007/11/03 17:43:19 | 000,001,356 | ---- | C] () -- C:\Users\Chris\AppData\Local\d3d9caps.dat
[2007/08/07 20:45:24 | 000,274,432 | ---- | C] () -- C:\Windows\System32\DLBCinst.dll
[2007/08/07 20:45:23 | 000,413,696 | ---- | C] () -- C:\Windows\System32\dlbcutil.dll
[2007/08/07 20:45:23 | 000,155,648 | ---- | C] () -- C:\Windows\System32\dlbcinsb.dll
[2007/08/07 20:45:22 | 000,090,112 | ---- | C] () -- C:\Windows\System32\dlbccur.dll
[2007/05/19 17:56:15 | 000,000,226 | ---- | C] () -- C:\Windows\dellstat.ini
[2007/05/19 17:55:56 | 000,040,960 | ---- | C] () -- C:\Windows\System32\dlbcvs.dll
[2007/05/19 17:55:56 | 000,000,373 | ---- | C] () -- C:\Windows\System32\dlbccoin.ini
[2007/05/19 16:49:05 | 000,038,912 | ---- | C] () -- C:\Users\Chris\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/01/22 07:49:34 | 000,344,064 | ---- | C] () -- C:\Windows\System32\dlbccoin.dll
[2007/01/03 04:10:58 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006/11/10 05:26:12 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006/11/02 04:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 04:47:37 | 000,313,136 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 04:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 02:33:01 | 000,604,264 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 02:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 02:33:01 | 000,103,964 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 02:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 02:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 02:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 00:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 00:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/01 23:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/01 23:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/09/16 20:36:50 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/16 20:36:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll

========== LOP Check ==========

[2009/10/15 20:46:09 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\FileZilla
[2011/11/08 09:58:41 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mjusbsp
[2008/02/27 22:33:27 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\MusicNet
[2011/09/30 17:16:10 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\Sling Media
[2007/06/02 11:07:16 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\WildTangent
[2009/05/21 20:10:27 | 000,000,000 | ---D | M] -- C:\Users\Hooper\AppData\Roaming\MusicNet
[2012/01/09 13:38:42 | 000,032,580 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 13:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/04/10 22:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2006/11/10 05:22:24 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2012/01/09 14:05:04 | 000,012,117 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 13:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2007/05/10 18:34:22 | 000,005,036 | R--- | M] () -- C:\dell.sdr
[2007/05/19 17:54:32 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2007/05/19 17:54:32 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012/01/09 13:39:27 | 2392,596,480 | -HS- | M] () -- C:\pagefile.sys
[2011/12/19 09:04:22 | 000,000,403 | ---- | M] () -- C:\rkill.log
[2007/05/10 11:10:37 | 000,000,070 | ---- | M] () -- C:\SystemInfo.ini
[2011/08/02 20:57:52 | 000,061,550 | ---- | M] () -- C:\TDSSKiller.2.5.13.0_02.08.2011_21.56.52_log.txt
[2011/12/19 09:12:56 | 000,073,068 | ---- | M] () -- C:\TDSSKiller.2.6.23.0_19.12.2011_09.11.16_log.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 04:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 04:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 04:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/10/01 19:20:50 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 13:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/01/31 21:11:52 | 000,102,400 | ---- | M] () -- C:\Windows\system32\spool\prtprocs\w32x86\dlbcpp5c.dll
[2006/11/02 04:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 16:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/09/27 10:58:27 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 02:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 02:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 02:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 02:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 02:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/09/03 13:25:26 | 000,000,286 | -HS- | M] () -- C:\Users\Chris\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/01/09 08:59:01 | 004,713,472 | ---- | M] (AVAST Software) -- C:\Users\Chris\Desktop\aswMBR.exe
[2012/01/09 10:47:29 | 004,376,389 | R--- | M] (Swearware) -- C:\Users\Chris\Desktop\ComboFix.exe
[2012/01/09 15:43:41 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Chris\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >
[2009/10/01 19:42:11 | 000,008,192 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.chk
[2009/10/01 19:41:41 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.log
[2007/05/10 10:41:07 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00001.jrs
[2007/05/10 10:41:07 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00002.jrs
[2009/10/01 19:41:41 | 001,056,768 | ---- | M] () -- C:\Windows\SECURITY\Database\tmp.edb

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/08/30 06:16:51 | 000,000,402 | -HS- | M] () -- C:\Users\Chris\Favorites\desktop.ini
[2011/12/19 08:56:35 | 000,000,236 | ---- | M] () -- C:\Users\Chris\Favorites\NCH Software Download Site.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/10/05 18:24:22 | 008,892,928 | ---- | M] () -- C:\ProgramData\atscie.msi
[2011/12/19 08:26:47 | 000,014,088 | -HS- | M] () -- C:\ProgramData\s8ta14g2pp4nrg
[2011/09/30 17:16:10 | 000,008,884 | ---- | M] () -- C:\ProgramData\SlingSetup.log

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:CB0AACC9
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:27AAAD97

< End of report >

nNeedofHelp · Jan 9, 2012

Extras

OTL Extras logfile created on: 1/9/2012 3:45:23 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Chris\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 0.73 Gb Available Physical Memory | 37.83% Memory free
4.11 Gb Paging File | 2.71 Gb Available in Paging File | 66.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 138.97 Gb Total Space | 27.07 Gb Free Space | 19.48% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.47 Gb Free Space | 54.71% Space Free | Partition Type: NTFS

Computer Name: WORKHORSE | User Name: Chris | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05ED4801-4207-4FC2-BBFB-C9E07756B0BD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{11212777-39B6-4EDA-ADC2-23E81FE71D6C}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{18C8FEBC-1579-4E32-B766-26F10411B78A}" = rport=137 | protocol=17 | dir=out | app=system |
"{2CA9BF49-7022-42DC-8F98-90B543320AE4}" = rport=138 | protocol=17 | dir=out | app=system |
"{2F60437D-74D5-4E0A-9375-AAB0CBB8748D}" = lport=445 | protocol=6 | dir=in | app=system |
"{34DCAE2C-4C5D-4A4D-B059-1CD9B9BC4D42}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=file and printer sharing (spooler service - rpc-epmap) |
"{356A942C-3E93-4B27-B04C-A3CC1D47F41C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{46F572F7-6A53-43CA-A89F-615E3AF9F7DC}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{6873340E-7FB1-4258-B223-41D0BDEF04A3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=c:\windows\system32\spoolsv.exe |
"{7158886E-44FD-41E4-9CD1-5DAD55C39BD3}" = lport=137 | protocol=17 | dir=in | app=system |
"{7C0948ED-55B6-4870-BC6C-B9DD084C8C66}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |
"{8BBEDE84-5AF7-47AE-9500-A026CFF0FBCE}" = lport=138 | protocol=17 | dir=in | app=system |
"{9BD36F50-9E36-4076-9569-46F857EA7D4E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9E73D638-26E7-4B19-B436-83568578B787}" = rport=445 | protocol=6 | dir=out | app=system |
"{A5A4BC0C-C9A3-4B40-B9A5-5B1B56F411BE}" = lport=139 | protocol=6 | dir=in | app=system |
"{AA1A2096-0469-4B83-B25A-08181415BFCB}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{C710EE5A-FFF9-4EFB-BC54-0EAEAAD16F59}" = rport=139 | protocol=6 | dir=out | app=system |
"{D289CAAD-88D6-43E1-ABCE-55D19DFF9635}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F115D513-F060-46B0-ADE6-34906160587F}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02E37774-1B23-44D3-98D9-3641A7EEA7C5}" = protocol=58 | dir=out | name=file and printer sharing (echo request - icmpv6-out) |
"{09EB3FC1-4497-466B-89AE-DD1B29E542C1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{28ADEDE1-A4D5-42D8-9B05-BF7C283C4059}" = protocol=6 | dir=in | app=c:\windows\system32\svchost.exe |
"{28ADEDE1-A4D5-42D8-9B05-BF7C283C4060}" = protocol=6 | dir=out | app=c:\windows\system32\svchost.exe |
"{319F7DD2-8FCF-4E4C-A1D6-C86D374F2C02}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{333C7EE6-DE31-4F96-B55B-CABC1D5DAE29}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{37D97517-FEA2-4035-910F-ADB28E4D13B1}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{3E7B660A-74CD-41DB-BF0D-70E24023404F}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{470D8AE0-B6A6-42E1-B3BC-8EE30226B0AB}" = protocol=1 | dir=out | name=file and printer sharing (echo request - icmpv4-out) |
"{78F656DD-820A-449A-AED5-845415F639C8}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{78FF3BD6-D3B4-4A1C-9F2F-9224B5D9A71A}" = protocol=17 | dir=in | app=c:\windows\system32\dlbccoms.exe |
"{924846CE-FE16-4BB6-BAC2-4D607E8AF088}" = protocol=6 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |
"{97ADADAF-5EA6-440B-B203-DDEC322BFEFB}" = protocol=6 | dir=in | app=c:\program files\yahoo!\yahoo! music jukebox\yahoomusicengine.exe |
"{9A51B613-B091-4256-9664-A0D7F5DA584A}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{9DE45750-9C34-47C8-A11C-8EA6DB83E32D}" = protocol=17 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |
"{A9180651-69EA-4FC4-89FB-DB00BE29BDEF}" = protocol=58 | dir=in | name=file and printer sharing (echo request - icmpv6-in) |
"{B17B9802-151D-4357-93B4-5435C809C016}" = dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{B673CC9E-1C4D-4A5C-A301-769AA44C7EF1}" = protocol=1 | dir=in | name=file and printer sharing (echo request - icmpv4-in) |
"{C4CEDEC5-54D1-42A0-9E05-9058B388D3A6}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{CC649F7D-B332-4514-A83B-F731274100AE}" = protocol=6 | dir=in | app=c:\windows\system32\dlbccoms.exe |
"{D8CE8FEF-B61F-4071-92BB-8181E7B43902}" = protocol=17 | dir=in | app=c:\program files\yahoo!\yahoo! music jukebox\yahoomusicengine.exe |
"{DB0E6167-4979-4762-A550-B29385CFD89C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{E99F9981-9611-408F-AFBF-D62DDD7D71F0}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"TCP Query User{D3651C98-B578-491C-AE95-8C0A2832A4A4}C:\users\chris\appdata\roaming\mjusbsp\magicjack.exe" = protocol=6 | dir=in | app=c:\users\chris\appdata\roaming\mjusbsp\magicjack.exe |
"TCP Query User{E1D61797-C661-4A18-96B2-AB7DD863A85E}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{2AAAFE96-F5D1-4218-B2A1-20E565E0CA22}C:\users\chris\appdata\roaming\mjusbsp\magicjack.exe" = protocol=17 | dir=in | app=c:\users\chris\appdata\roaming\mjusbsp\magicjack.exe |
"UDP Query User{A47638AD-A87E-4A4C-B4AF-E20A83294308}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio EasyArchive
"{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E25E350-949F-4DB7-8288-2A60E018B4C1}" = Games, Music, & Photos Launcher
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{51B055DD-A5F8-4D0C-A09C-66E58AD56F20}" = WD SmartWare
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5E68BB65-4059-4FE5-AAC4-0CD1D79BBDE2}" = EarthLink Setup Files
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6CF08AD2-00C5-4A63-B74B-2EFFFAFEBE1A}" = Microsoft Outlook Web Access S/MIME
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71F6261F-C0EC-46EF-85D6-67EDEEE2EF89}" = Corel Snapfire Plus
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7AC0886A-CE48-4EB6-9CC3-4C56D427F2E1}" = Cisco Network Magic
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{7FCC4EDC-6EE2-4309-ABD7-85F2667A7B90}" = WebEx Support Manager for Internet Explorer
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Documentation & Support Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{93A1B09E-BAFA-4628-A5B6-921CB026955A}" = Corel Paint Shop Pro Photo XI
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{98736A65-3C79-49EC-B7E9-A3C77774B0E6}" = Google SketchUp 6
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{AAC90D5F-B8B1-4A06-B888-F3A241124D0D}" = Roxio MyDVD Premier
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A70800000002}" = Adobe Reader 7.0.8
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}" = Google SketchUp 6
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BD202930-5F70-4B35-B875-1E28604F328D}" = Logitech Communications Manager
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Premier
"{CCFF1E13-77A2-4032-8B12-7566982A27DF}" = Internet Service Offers Launcher
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{EE7B9A8D-19F0-450D-8E94-3E391E6044CD}" = KhalSetup
"{F439D7AF-03F3-4F8E-AEC4-571BFE977C61}" = iTunes
"{FB29B583-945C-4094-BB4B-3A405574C560}" = Motorola Mobile Drivers Installation 5.0.0
"{FC467B61-F890-4E29-8585-365DAB66F13E}" = Pure Networks Platform
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player
"AuthentiumWebInstaller" = Authentium Web Install Helper
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"Dell File Manager" = Dell DJ Explorer
"Dell Photo Printer 720" = Dell Photo Printer 720
"Free CD to MP3 Converter" = Free CD to MP3 Converter
"Google Desktop" = Google Desktop
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ieSpell" = ieSpell
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.0.1800
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MotoHelper" = MotoHelper 2.0.45 Driver 5.0.0
"MSC" = McAfee SecurityCenter
"Network MagicUninstall" = Network Magic
"NVIDIA Drivers" = NVIDIA Drivers
"Recuva" = Recuva
"SlingHealth ActiveX" = SlingHealth ActiveX
"WavePad" = WavePad Sound Editor
"WildTangent dell Master Uninstall" = Dell Games

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2408829221-1492129756-583714143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FileZilla Client" = FileZilla Client 3.2.7.1
"GoToMeeting" = GoToMeeting/GoToWebinar 3.0.0.198

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/26/2011 11:58:32 PM | Computer Name = Workhorse | Source = Windows Search Service | ID = 3013
Description =

Error - 1/26/2011 11:58:33 PM | Computer Name = Workhorse | Source = Windows Search Service | ID = 3013
Description =

Error - 1/26/2011 11:58:33 PM | Computer Name = Workhorse | Source = Windows Search Service | ID = 3013
Description =

Error - 1/26/2011 11:59:15 PM | Computer Name = Workhorse | Source = Windows Search Service | ID = 3013
Description =

Error - 1/26/2011 11:59:15 PM | Computer Name = Workhorse | Source = Windows Search Service | ID = 3013
Description =

Error - 1/29/2011 1:27:24 PM | Computer Name = Workhorse | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18999, time stamp
0x4ccf92fb, faulting module nmspce2.dll_unloaded, version 0.0.0.0, time stamp 0x4a5d0a51,
exception code 0xc0000005, fault offset 0x676c8062, process id 0x11ac, application
start time 0x01cbbf6280d58104.

Error - 1/31/2011 9:53:45 PM | Computer Name = Workhorse | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18999, time stamp
0x4ccf92fb, faulting module IEShims.dll, version 8.0.6001.18999, time stamp 0x4ccfa85d,
exception code 0xc0000005, fault offset 0x00021e16, process id 0x16b0, application
start time 0x01cbc1b2db7a3274.

Error - 2/1/2011 11:59:44 AM | Computer Name = Workhorse | Source = McLogEvent | ID = 5051
Description = A thread in process C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
took longer than 90000 ms to complete a request. The process will be terminated.
Thread
id : 2904 (0xb58) Thread address : 0x77285E74 Thread message : Build VSCORE.14.2.0.794
/ 5400.1158 Object being scanned = \Device\HarddiskVolume3\Program Files\Common
Files\McAfee\Core\mchost.exe by C:\Windows\system32\svchost.exe 4(0)(0) 4(0)(0)

7200(0)(0) 7595(0)(0) 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0)

Error - 2/1/2011 12:00:24 PM | Computer Name = Workhorse | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 8.0.6001.18999 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 4c8 Start Time: 01cbc227b9cce534 Termination Time: 140

Error - 2/8/2011 12:36:37 PM | Computer Name = Workhorse | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18999, time stamp
0x4ccf92fb, faulting module nmspce2.dll_unloaded, version 0.0.0.0, time stamp 0x4a5d0a51,
exception code 0xc0000005, fault offset 0x676c8062, process id 0x162c, application
start time 0x01cbc741175bf67a.

[ Media Center Events ]
Error - 6/1/2008 10:04:35 AM | Computer Name = Workhorse | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 2/4/2009 2:35:59 PM | Computer Name = Workhorse | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 3/4/2009 2:30:40 PM | Computer Name = Workhorse | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ OSession Events ]
Error - 10/11/2010 10:41:07 PM | Computer Name = Workhorse | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6535.5002, Microsoft Office Version: 12.0.6425.1000. This session lasted 765
seconds with 420 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 1/9/2012 4:11:34 PM | Computer Name = Workhorse | Source = Service Control Manager | ID = 7030
Description =

Error - 1/9/2012 4:14:59 PM | Computer Name = Workhorse | Source = Service Control Manager | ID = 7023
Description =

Error - 1/9/2012 4:22:04 PM | Computer Name = Workhorse | Source = DCOM | ID = 10010
Description =

Error - 1/9/2012 4:22:35 PM | Computer Name = Workhorse | Source = Service Control Manager | ID = 7022
Description =

Error - 1/9/2012 4:34:03 PM | Computer Name = Workhorse | Source = Service Control Manager | ID = 7023
Description =

Error - 1/9/2012 5:36:22 PM | Computer Name = Workhorse | Source = Service Control Manager | ID = 7030
Description =

Error - 1/9/2012 5:41:45 PM | Computer Name = Workhorse | Source = Service Control Manager | ID = 7023
Description =

Error - 1/9/2012 5:43:26 PM | Computer Name = Workhorse | Source = Service Control Manager | ID = 7030
Description =

Error - 1/9/2012 5:55:22 PM | Computer Name = Workhorse | Source = Service Control Manager | ID = 7030
Description =

Error - 1/9/2012 6:02:03 PM | Computer Name = Workhorse | Source = Service Control Manager | ID = 7030
Description =

< End of report >

Broni · Jan 9, 2012

I can't proceed.
You didn't answer my question:

How is computer doing?

nNeedofHelp · Jan 9, 2012

Sorry. During the whole process I wasn't using the computer.

I have tried several google searches and have not been redirected.
Should I go back to normal use?

Thanks for all your help and quick responses.

Broni · Jan 9, 2012

Good news

Yes, operate from normal mode.

I'll check your OTL logs now.

Broni · Jan 9, 2012

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
SRV - File not found [Auto | Stopped] -- -- (0060281189143824mcinstcleanup) McAfee Application Installer Cleanup (0060281189143824)
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:33440
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:33440
O2 - BHO: (no name) - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - No CLSID value found.
O15 - HKU\S-1-5-21-2408829221-1492129756-583714143-1000\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
O16 - DPF: Web-Based Email Tools http://email01.secureserver.net/Download.CAB (Reg Error: Key error.)
O18 - Protocol\Handler\bw+0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw+0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw-0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw00 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw00s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw-0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw10 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw10s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw20 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw20s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw30 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw30s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw40 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw40s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw50 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw50s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw60 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw60s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw70 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw70s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw80 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw80s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw90 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw90s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwa0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwa0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwb0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwb0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwc0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwc0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwd0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwd0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwe0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwe0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwf0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwf0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwg0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwg0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwh0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwh0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwi0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwi0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwj0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwj0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwk0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwk0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwl0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwl0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwm0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwm0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwn0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwn0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwo0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwo0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwp0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwp0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwq0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwq0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwr0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwr0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bws0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bws0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwt0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwt0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwu0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwu0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwv0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwv0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bww0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bww0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwx0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwx0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwy0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwy0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwz0 {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwz0s {11a19727-b155-4c53-bfc8-7a0b22195f50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\offline-8876480 {11A19727-B155-4C53-BFC8-7A0B22195F50} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
[2011/12/19 08:26:47 | 000,014,088 | -HS- | M] () -- C:\Users\Chris\AppData\Local\s8ta14g2pp4nrg
[2011/12/19 08:26:47 | 000,014,088 | -HS- | M] () -- C:\ProgramData\s8ta14g2pp4nrg
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:CB0AACC9
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:27AAAD97


:Services

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" =-

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

==============================================================

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Do NOT post JavaRa log.

===============================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

3. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

4. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Tick the box next to YES, I accept the Terms of Use
Click Start
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click on List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

nNeedofHelp · Jan 9, 2012

All processes killed
========== OTL ==========
Error: No service named 0060281189143824mcinstcleanup) McAfee Application Installer Cleanup (0060281189143824 was found to stop!
Service\Driver key 0060281189143824mcinstcleanup) McAfee Application Installer Cleanup (0060281189143824 not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3C7195F6-D788-4D50-BA72-2EE212EDAC78}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3C7195F6-D788-4D50-BA72-2EE212EDAC78}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{2C0A5F28-48D8-408B-9172-9C6121025BCE} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C0A5F28-48D8-408B-9172-9C6121025BCE}\ not found.
Registry value HKEY_USERS\S-1-5-21-2408829221-1492129756-583714143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\GD\\http deleted successfully.
Starting removal of ActiveX control {E06E2E99-0AA1-11D4-ABA6-0060082AA75C}
C:\ProgramData\webex\ieatgpc.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ not found.
Starting removal of ActiveX control Web-Based Email Tools
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Web-Based Email Tools\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Web-Based Email Tools\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Web-Based Email Tools\ not found.
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw+0\ deleted successfully.
Invalid CLSID key: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw+0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw-0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw00\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw00s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw-0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw10\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw10s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw20\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw20s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw30\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw30s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw40\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw40s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw50\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw50s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw60\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw60s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw70\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw70s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw80\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw80s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw90\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bw90s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwa0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwa0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwb0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwb0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwc0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwc0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwd0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwd0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwe0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwe0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwf0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwf0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwfile-8876480\ deleted successfully.
Invalid CLSID key: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwg0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwg0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwh0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwh0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwi0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwi0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwj0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwj0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwk0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwk0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwl0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwl0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwm0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwm0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwn0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwn0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwo0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwo0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwp0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwp0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwq0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwq0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwr0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwr0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bws0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bws0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwt0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwt0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwu0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwu0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwv0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwv0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bww0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bww0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwx0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwx0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwy0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwy0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwz0\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\bwz0s\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\offline-8876480\ deleted successfully.
File C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll not found.
C:\Users\Chris\AppData\Local\s8ta14g2pp4nrg moved successfully.
C:\ProgramData\s8ta14g2pp4nrg moved successfully.
ADS C:\ProgramData\TEMP:CB0AACC9 deleted successfully.
ADS C:\ProgramData\TEMP:27AAAD97 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware\\DisableMonitoring deleted successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Angi
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 46579073 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 195449 bytes

User: Chris
->Temp folder emptied: 1126 bytes
->Temporary Internet Files folder emptied: 1014750715 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 2650 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 3431318 bytes
->Flash cache emptied: 660 bytes

User: Hooper
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 338658891 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 161999 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 37172697 bytes
RecycleBin emptied: 283 bytes

Total Files Cleaned = 1,374.00 mb

[EMPTYFLASH]

User: All Users

User: Angi
->Flash cache emptied: 0 bytes

User: Chris
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Guest
->Flash cache emptied: 0 bytes

User: Hooper
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 01092012_172110

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\WebEx\Log\19\atashost.log scheduled to be moved on reboot.
C:\Windows\temp\etilqs_8rI5I8WfJpiSqt881TJr moved successfully.
C:\Windows\temp\etilqs_agmT5mmltg1Cd7HsnkKI moved successfully.
C:\Windows\temp\etilqs_LQ0owiCSXMjud5p9YRNu moved successfully.
C:\Windows\temp\etilqs_mIOSljlsJF6WoHx3kc6l moved successfully.
C:\Windows\temp\etilqs_UKp0gVpoP1N8E3excuD7 moved successfully.
C:\Windows\temp\etilqs_v0pKpqV7XdSwRVdN0Fh5 moved successfully.

Registry entries deleted on Reboot...

nNeedofHelp · Jan 9, 2012

Results of screen317's Security Check version 0.99.24
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 8 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
McAfee SecurityCenter
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Java(TM) 6 Update 30
Java(TM) SE Runtime Environment 6
````````````````````````````````
Process Check:
objlist.exe by Laurent
``````````End of Log````````````

nNeedofHelp · Jan 9, 2012

Farbar Service Scanner
Ran by Chris (administrator) on 09-01-2012 at 19:06:28
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.

Windows Firewall:
=============
MpsSvc Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open MpsSvc registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open MpsSvc registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open MpsSvc registry key. The service key does not exist.
Checking LEGACY_MpsSvc: Attention! Unable to open LEGACY_MpsSvc\0000 registry key. The key does not exist.

mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.

Firewall Disabled Policy:
==================

System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.
Checking LEGACY_SDRSVC: Attention! Unable to open LEGACY_SDRSVC\0000 registry key. The key does not exist.

VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.

System Restore Disabled Policy:
========================

Security Center:
============

Windows Update:
===========

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll
[2009-09-10 16:35] - [2009-04-10 22:28] - 0061440 ____A (Microsoft Corporation) 1CA6C40261DDC0425987980D0CD2AAAB

C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll
[2009-09-10 16:36] - [2009-04-10 22:28] - 0758784 ____A (Microsoft Corporation) 93952506C6D67330367F7E7934B6A02F

C:\Windows\system32\es.dll
[2009-09-10 16:36] - [2009-04-10 22:28] - 0268800 ____A (Microsoft Corporation) 67058C46504BC12D821F38CF99B7B28F

C:\Windows\system32\cryptsvc.dll
[2009-09-10 16:35] - [2009-04-10 22:28] - 0129024 ____A (Microsoft Corporation) FB27772BEAF8E1D28CCD825C09DA939B

C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

Broni · Jan 9, 2012

...and Eset....

Solved Google redirect

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 23 +0

Posts: 23 +0

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 23 +0

Posts: 23 +0

Posts: 56,041 +516

Posts: 23 +0

Posts: 56,041 +516

Posts: 56,041 +516

Posts: 23 +0

Posts: 23 +0

Posts: 23 +0

Posts: 56,041 +516

Similar threads