Solved Infected with sirefef.B Y and W

[Geremy Walker]

So after looking through the threads here, it seems I've got the same issue as many others with a sirefef/fake flash install virus. It came up asking me to install flash, to which I said NO multiple times, and I thought it was odd that it kept forcing itself..

Anyway, I've read through a few threads on the topic, and I have performed the first few steps/reports already. Posting of the contents follows.

Scan result of Farbar Recovery Scan Tool Version: 03-07-2012 01
Ran by Geremy at 03-07-2012 22:09:32
Running from F:\
Service Pack 1 (X64) OS Language: English(US)
Attention: Could not load system hive.ERROR: The process cannot access the file because it is being used by another process.
ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNTION PROPERLY.

============ One Month Created Files and Folders ==============
2012-07-03 22:05 - 2012-07-03 22:05 - 00050392 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\zxcahoyv.sys
2012-07-03 22:04 - 2012-07-03 22:09 - 00000000 ____D C:\FRST
2012-07-03 21:42 - 2012-07-03 21:42 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.055BF01D61730CA8
2012-07-03 21:39 - 2012-07-03 21:39 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.AA897737214FB219
2012-07-03 21:39 - 2012-07-03 21:39 - 00050392 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndzhiclp.sys
2012-07-03 21:36 - 2012-07-03 21:36 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.7650BBB7848E48AB
2012-07-03 21:34 - 2012-07-03 21:34 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.FC49998995B969C2
2012-07-03 21:28 - 2012-07-03 21:28 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.79FE9C5165055EC3
2012-07-03 21:25 - 2012-07-03 21:25 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.66BBA8088936891B
2012-07-03 21:21 - 2012-07-03 21:21 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.3F2CD0B82DBC534F
2012-07-03 21:10 - 2012-07-03 21:10 - 00000000 ____D C:\Program Files\Microsoft Security Client
2012-07-03 21:10 - 2012-07-03 21:10 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2012-07-03 21:07 - 2012-07-03 21:08 - 12621696 ____A (Microsoft Corporation) C:\Users\Geremy\Downloads\mseinstall.exe
2012-07-03 20:54 - 2012-07-03 20:54 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2012-07-03 20:52 - 2012-07-03 20:52 - 00007597 ____A C:\Users\Geremy\AppData\Local\Resmon.ResmonCfg
2012-07-03 19:39 - 2012-07-03 19:39 - 00000000 __SHD C:\Windows\System32\%APPDATA%
2012-07-03 02:01 - 2012-07-03 02:01 - 00000000 ____D C:\Users\Geremy\AppData\Local\{92192416-5FE4-4C6A-BFEB-14956D31EA06}
2012-07-03 02:00 - 2012-07-03 02:01 - 00000000 ____D C:\Users\Geremy\AppData\Local\{B958EE0C-8769-47CC-8A7A-977FCD0592D8}
2012-07-02 14:00 - 2012-07-02 14:00 - 00000000 ____D C:\Users\Geremy\AppData\Local\{B9840E06-A25A-4276-A36D-50B8E6D90108}
2012-07-02 13:59 - 2012-07-02 14:00 - 00000000 ____D C:\Users\Geremy\AppData\Local\{1B7FB947-6B40-440A-99F2-48BC06BA4953}
2012-06-30 00:50 - 2012-06-30 00:50 - 00000000 ____D C:\Users\Geremy\AppData\Local\{5E34E0E6-92BB-42EF-9641-52D7000979BC}
2012-06-30 00:49 - 2012-06-30 00:50 - 00000000 ____D C:\Users\Geremy\AppData\Local\{5E082280-2A43-4F81-8DF0-E20A4975BA1A}
2012-06-28 18:16 - 2012-06-28 18:16 - 00033939 ____A C:\Users\Geremy\.recently-used.xbel
2012-06-28 17:03 - 2012-06-28 17:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{65F1A6B0-A98E-44AC-B794-04A531830FB6}
2012-06-28 17:03 - 2012-06-28 17:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{0AAA81A1-A307-44A2-AC5C-C3E1B98318D5}
2012-06-27 15:55 - 2012-07-02 13:54 - 00000000 ____D C:\Users\Geremy\Desktop\INVOICE
2012-06-27 15:39 - 2012-06-27 15:39 - 00000000 ____D C:\Users\Geremy\AppData\Local\{BA52C587-F055-4F70-9240-8162AE36672F}
2012-06-27 15:38 - 2012-06-27 15:39 - 00000000 ____D C:\Users\Geremy\AppData\Local\{DCF3C70D-06B9-4311-B25E-C9578688371D}
2012-06-26 15:32 - 2012-06-26 15:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{9953C31F-9209-4CBD-BC80-BEFFCE08F805}
2012-06-26 15:31 - 2012-06-26 15:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{35AAADBD-DF4D-4D81-828E-AEE29DAAD7F3}
2012-06-26 03:31 - 2012-06-26 03:31 - 00000000 ____D C:\Users\Geremy\AppData\Local\{F7DB33B9-AD2C-491E-A483-0925C6A82AEB}
2012-06-26 03:30 - 2012-06-26 03:31 - 00000000 ____D C:\Users\Geremy\AppData\Local\{BB392046-C479-4E70-B31F-8DD55C267523}
2012-06-25 15:30 - 2012-06-25 15:30 - 00000000 ____D C:\Users\Geremy\AppData\Local\{52BDA77A-1712-4E2E-B9AC-A2B945A12531}
2012-06-25 15:30 - 2012-06-25 15:30 - 00000000 ____D C:\Users\Geremy\AppData\Local\{4076F621-C0CA-404B-8C67-DF04C02B7819}
2012-06-24 16:59 - 2012-06-24 16:59 - 00000000 ____D C:\Users\Geremy\AppData\Local\{7E94472B-8468-4499-837F-2038AD9708D7}
2012-06-24 16:58 - 2012-06-24 16:59 - 00000000 ____D C:\Users\Geremy\AppData\Local\{FFAB4195-C70E-4034-B2D9-3EAEE6F4D94A}
2012-06-24 04:57 - 2012-06-24 04:58 - 00000000 ____D C:\Users\Geremy\AppData\Local\{33D07FA2-81E9-4928-8B64-BC902825E1AA}
2012-06-24 04:57 - 2012-06-24 04:57 - 00000000 ____D C:\Users\Geremy\AppData\Local\{6112897A-4EA7-4D01-88BC-61BF2366E03E}
2012-06-23 19:05 - 2012-06-23 19:05 - 00008929 ____A C:\Users\Geremy\Desktop\CBS_EP02_SCRIPT_V02.rtf
2012-06-23 16:56 - 2012-06-23 16:57 - 00000000 ____D C:\Users\Geremy\AppData\Local\{D27590C7-1033-4602-BE66-1BE9CA35BBB7}
2012-06-23 16:56 - 2012-06-23 16:56 - 00000000 ____D C:\Users\Geremy\AppData\Local\{0DF7F726-D872-4215-9FE0-36AC304B3B9D}
2012-06-23 03:33 - 2012-06-23 03:33 - 00000000 ____D C:\Users\Geremy\AppData\Local\{D729755C-1642-4E14-AB72-A5012474F1EA}
2012-06-23 03:33 - 2012-06-23 03:33 - 00000000 ____D C:\Users\Geremy\AppData\Local\{D48BF521-094C-4C96-8C73-00A29816C6EE}
2012-06-22 19:25 - 2012-06-23 05:17 - 01827840 ____A C:\Users\Geremy\Desktop\Sal.fla
2012-06-22 16:48 - 2012-06-22 16:48 - 00078304 ____A C:\Users\Geremy\Downloads\PQA.psd
2012-06-22 15:32 - 2012-06-22 15:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{330AE8A4-AADC-4F36-A90E-87D780C8012C}
2012-06-22 15:32 - 2012-06-22 15:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{149B6F4E-47CB-430D-8CB8-C642DBE282C8}
2012-06-21 23:08 - 2012-06-21 23:08 - 00000096 ____A C:\Users\Geremy\.gtk-bookmarks
2012-06-21 16:51 - 2012-06-21 16:51 - 00000000 ____D C:\Users\Geremy\AppData\Local\{361D62CD-B1AE-4558-80B1-17765F205A67}
2012-06-21 16:50 - 2012-06-21 16:51 - 00000000 ____D C:\Users\Geremy\AppData\Local\{ADF83F54-E58A-4974-AFB5-59990AE0DF74}
2012-06-21 14:18 - 2012-06-02 19:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-21 14:18 - 2012-06-02 19:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-21 14:18 - 2012-06-02 19:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-21 14:18 - 2012-06-02 19:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-21 14:18 - 2012-06-02 19:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-21 14:18 - 2012-06-02 19:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-21 14:18 - 2012-06-02 19:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-21 14:18 - 2012-06-02 15:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-21 14:18 - 2012-06-02 15:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-21 02:32 - 2012-06-21 02:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{9C90918B-E3C7-4AEC-B5AD-05339D157616}
2012-06-21 02:32 - 2012-06-21 02:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{7F938E0F-8F43-48EE-BBA8-0DE6F5238C8D}
2012-06-20 13:25 - 2012-06-20 13:25 - 00000000 ____D C:\Users\Geremy\AppData\Local\{A20DE781-FA0A-4D09-AA1B-9E91043F0A48}
2012-06-20 13:24 - 2012-06-20 13:25 - 00000000 ____D C:\Users\Geremy\AppData\Local\{414D82B2-8FAA-4366-968A-C79AA13AD4DB}
2012-06-20 13:21 - 2012-06-20 13:21 - 00000000 ____D C:\Windows\en
2012-06-20 13:19 - 2012-06-20 13:19 - 00000000 ____D C:\Users\Geremy\AppData\Local\{638CB385-4E3C-4DDF-A04C-B06110B95ACC}
2012-06-20 13:18 - 2012-06-20 13:19 - 00000000 ____D C:\Users\Geremy\AppData\Local\{EC93710E-5F45-4A88-B825-2F361EBC36A4}
2012-06-19 15:50 - 2012-06-19 15:51 - 00000000 ____D C:\Users\Geremy\AppData\Local\{9E69DE35-C9D7-4674-AD70-2273844957B5}
2012-06-19 15:50 - 2012-06-19 15:50 - 00000000 ____D C:\Users\Geremy\AppData\Local\{25DD17FC-824D-49C9-8465-3C1253552915}
2012-06-18 15:28 - 2012-06-18 15:28 - 00000000 ____D C:\Users\Geremy\AppData\Local\{3B3ED46F-EBCF-4D84-AC05-7B59375ED611}
2012-06-17 22:24 - 2012-06-17 22:24 - 00000000 ____D C:\Users\Geremy\AppData\Local\{4E32EF7C-80F1-466E-A0EB-F8B3DE014EAF}
2012-06-16 18:57 - 2012-06-16 18:58 - 00000000 ____D C:\Users\Geremy\AppData\Local\{D6B81E3B-A225-47ED-AE2B-77569FCA1180}
2012-06-14 20:12 - 2012-06-14 20:13 - 00000000 ____D C:\Users\Geremy\AppData\Local\{03DED491-F596-45B7-83E3-008E603BA87C}
2012-06-14 20:12 - 2012-06-14 20:12 - 00000000 ____D C:\Users\Geremy\AppData\Local\{257C78DF-5A1A-4EE3-B390-4693C989DCCE}
2012-06-14 02:24 - 2012-06-14 02:24 - 00000000 ____D C:\Users\Geremy\AppData\Local\{257EAE8E-4ADB-4608-8722-9D63A4EC32F9}
2012-06-14 02:23 - 2012-06-14 02:24 - 00000000 ____D C:\Users\Geremy\AppData\Local\{F4032FCE-8B5D-4A85-AA1D-810D06B467A0}
2012-06-13 13:05 - 2012-06-13 13:06 - 00000000 ____D C:\Users\Geremy\AppData\Local\{660C9A8E-F4A6-4A79-BAA4-CC21A4E3926D}
2012-06-13 13:05 - 2012-06-13 13:05 - 00000000 ____D C:\Users\Geremy\AppData\Local\{9658A3DB-5832-49B3-9731-F0DB896BD980}
2012-06-13 02:43 - 2012-06-13 02:43 - 00002204 ____A C:\Users\Public\Desktop\NVIDIA FX Composer 2.5.lnk
2012-06-13 02:40 - 2012-06-13 02:40 - 00000000 ____D C:\Users\Geremy\Documents\FX Composer 2
2012-06-13 02:40 - 2012-06-13 02:40 - 00000000 ____D C:\Users\Geremy\AppData\Local\NVIDIA Corporation
2012-06-13 02:39 - 2012-06-13 02:39 - 00000000 ____D C:\Python24
2012-06-13 02:38 - 2012-06-13 02:42 - 00151552 ____A C:\Windows\SysWOW64\nvRegDev.dll
2012-06-13 00:38 - 2012-05-15 01:01 - 01188864 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-13 00:38 - 2012-05-15 00:59 - 00064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-13 00:38 - 2012-05-15 00:03 - 00981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-06-13 00:38 - 2012-04-20 02:42 - 12297216 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-13 00:38 - 2012-04-20 02:42 - 09059840 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-13 00:38 - 2012-04-20 02:42 - 02454528 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-13 00:38 - 2012-04-20 02:42 - 01494016 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-13 00:38 - 2012-04-20 02:42 - 00735744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-06-13 00:38 - 2012-04-20 02:42 - 00247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-13 00:38 - 2012-04-20 02:42 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-13 00:38 - 2012-04-20 02:00 - 01231360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-06-13 00:38 - 2012-04-20 01:57 - 06027776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-06-13 00:38 - 2012-04-20 01:57 - 00627712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-06-13 00:38 - 2012-04-20 01:57 - 00067584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-06-13 00:38 - 2012-04-20 01:56 - 11020800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-06-13 00:38 - 2012-04-20 01:56 - 02073600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-06-13 00:38 - 2012-04-20 01:56 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-06-13 00:37 - 2012-05-15 00:00 - 00048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-06-13 00:37 - 2012-04-20 02:42 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-13 00:37 - 2012-04-20 02:00 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-06-13 00:37 - 2012-04-20 00:45 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-13 00:37 - 2012-04-20 00:16 - 01638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-06-13 00:36 - 2012-05-14 22:32 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-13 00:36 - 2012-05-04 08:06 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-06-13 00:36 - 2012-05-04 07:03 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-06-13 00:36 - 2012-05-04 07:03 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-06-13 00:36 - 2012-04-26 02:41 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-06-13 00:36 - 2012-04-26 02:41 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-06-13 00:36 - 2012-04-26 02:34 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-06-13 00:35 - 2012-04-28 00:55 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-06-12 23:36 - 2012-06-12 23:36 - 00284408 ____A C:\Windows\Minidump\061212-24648-01.dmp
2012-06-12 20:01 - 2012-06-12 20:01 - 00000000 ____D C:\Users\Geremy\AppData\Local\{96E0E45F-9012-4A99-9262-1AADC2D48367}
2012-06-12 20:01 - 2012-06-12 20:01 - 00000000 ____D C:\Users\Geremy\AppData\Local\{64571201-6773-4E1B-91B7-535FFF475157}
2012-06-12 18:50 - 2012-06-12 19:08 - 187408302 ____A (InstallShield Software Corporation) C:\Users\Geremy\Downloads\FX_Composer2_Shader_Debugger_Bundle_2.53.0524.1905.exe
2012-06-11 21:15 - 2012-06-11 21:15 - 00000000 ____D C:\Users\Geremy\AppData\Local\{F4777474-C6C4-48A7-A1BB-5BBD542BEEEC}
2012-06-11 21:15 - 2012-06-11 21:15 - 00000000 ____D C:\Users\Geremy\AppData\Local\{325BE52B-08F5-4B20-9BAD-57911A251349}
2012-06-10 12:03 - 2012-06-10 12:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{E92691E0-D411-4F25-AA90-4CC147F951C3}
2012-06-10 12:02 - 2012-06-10 12:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{5C36DA0F-C4A1-4444-843E-FC48BB6E5859}
2012-06-09 19:07 - 2012-06-09 19:07 - 00000000 ____D C:\Users\Geremy\AppData\Local\{DC23FC4B-80A2-4387-B6F3-810114A6B012}
2012-06-09 19:07 - 2012-06-09 19:07 - 00000000 ____D C:\Users\Geremy\AppData\Local\{CBBFB753-B711-469C-8AFF-D72157CE963B}
2012-06-08 23:13 - 2012-06-08 23:13 - 00000000 ____D C:\Users\Geremy\AppData\Local\{96F70C3E-B94B-46B5-9D6E-91D7D000836B}
2012-06-08 23:13 - 2012-06-08 23:13 - 00000000 ____D C:\Users\Geremy\AppData\Local\{4BAA9FBE-EE21-4033-A1FB-EF0F99B1AE46}
2012-06-07 20:03 - 2012-06-07 20:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{D85E649C-6738-4DCB-885B-8182DC02C4C5}
2012-06-07 20:03 - 2012-06-07 20:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{34B38445-F731-4CE9-B788-067F94033EE6}
2012-06-05 19:22 - 2012-06-05 19:23 - 00000000 ____D C:\Users\Geremy\AppData\Local\{8E651E0C-5A15-4073-98DD-FB8157C76917}
2012-06-05 19:22 - 2012-06-05 19:22 - 00000000 ____D C:\Users\Geremy\AppData\Local\{57FD4A32-A41F-4A9A-82FF-A0ADF632DF24}
2012-06-04 18:25 - 2012-06-04 18:25 - 00000000 ____D C:\Users\Geremy\AppData\Local\{ADD7099E-4BA3-490C-B07E-6E73BDE4A4F4}
2012-06-04 18:25 - 2012-06-04 18:25 - 00000000 ____D C:\Users\Geremy\AppData\Local\{5260D42D-095F-433F-ACAC-8534992E36F5}
2012-06-03 12:30 - 2012-06-03 12:30 - 00000000 ____D C:\Users\Geremy\AppData\Local\{5B06A04C-26AC-4232-9E3A-D7D9D9981588}
2012-06-03 12:30 - 2012-06-03 12:30 - 00000000 ____D C:\Users\Geremy\AppData\Local\{434978B2-9973-42C5-84FB-4A6229C845E2}

============ 3 Months Modified Files ========================
2012-07-03 22:09 - 2009-07-14 02:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-03 22:09 - 2009-07-14 01:51 - 00238315 ____A C:\Windows\setupact.log
2012-07-03 22:05 - 2012-07-03 22:05 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.BAE6D825FC2B802B
2012-07-03 22:05 - 2012-07-03 22:05 - 00050392 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\zxcahoyv.sys
2012-07-03 21:42 - 2012-07-03 21:42 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.055BF01D61730CA8
2012-07-03 21:39 - 2012-07-03 21:39 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.AA897737214FB219
2012-07-03 21:39 - 2012-07-03 21:39 - 00050392 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndzhiclp.sys
2012-07-03 21:36 - 2012-07-03 21:36 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.7650BBB7848E48AB
2012-07-03 21:34 - 2012-07-03 21:34 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.FC49998995B969C2
2012-07-03 21:31 - 2009-07-13 20:19 - 00328704 ____A C:\Windows\System32\services.exe
2012-07-03 21:28 - 2012-07-03 21:28 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.79FE9C5165055EC3
2012-07-03 21:25 - 2012-07-03 21:25 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.66BBA8088936891B
2012-07-03 21:22 - 2009-07-14 02:13 - 00782528 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-03 21:21 - 2012-07-03 21:21 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.3F2CD0B82DBC534F
2012-07-03 21:12 - 2009-07-14 01:45 - 00014832 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-03 21:12 - 2009-07-14 01:45 - 00014832 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-03 21:11 - 2011-02-01 02:16 - 00001945 ____A C:\Windows\epplauncher.mif
2012-07-03 21:11 - 2010-10-15 23:37 - 01511428 ____A C:\Windows\WindowsUpdate.log
2012-07-03 21:10 - 2011-02-01 02:16 - 00789382 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2012-07-03 21:08 - 2012-07-03 21:07 - 12621696 ____A (Microsoft Corporation) C:\Users\Geremy\Downloads\mseinstall.exe
2012-07-03 20:52 - 2012-07-03 20:52 - 00007597 ____A C:\Users\Geremy\AppData\Local\Resmon.ResmonCfg
2012-07-03 19:37 - 2012-04-02 22:36 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-07-03 19:37 - 2011-05-14 15:24 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-07-03 18:09 - 2010-10-17 15:24 - 00000052 ____A C:\Users\Geremy\AppData\default.pls
2012-06-28 18:16 - 2012-06-28 18:16 - 00033939 ____A C:\Users\Geremy\.recently-used.xbel
2012-06-23 19:05 - 2012-06-23 19:05 - 00008929 ____A C:\Users\Geremy\Desktop\CBS_EP02_SCRIPT_V02.rtf
2012-06-23 05:17 - 2012-06-22 19:25 - 01827840 ____A C:\Users\Geremy\Desktop\Sal.fla
2012-06-22 16:48 - 2012-06-22 16:48 - 00078304 ____A C:\Users\Geremy\Downloads\PQA.psd
2012-06-21 23:08 - 2012-06-21 23:08 - 00000096 ____A C:\Users\Geremy\.gtk-bookmarks
2012-06-20 23:56 - 2012-03-06 00:50 - 00004096 ____A C:\Users\Geremy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-06-20 13:19 - 2010-10-12 14:41 - 00453638 ____A C:\Windows\DirectX.log
2012-06-16 02:51 - 2012-02-06 01:52 - 00000900 ____A C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2012-06-13 13:02 - 2009-07-14 01:45 - 04888992 ____A C:\Windows\System32\FNTCACHE.DAT
2012-06-13 03:05 - 2010-08-04 18:37 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-06-13 02:43 - 2012-06-13 02:43 - 00002204 ____A C:\Users\Public\Desktop\NVIDIA FX Composer 2.5.lnk
2012-06-13 02:42 - 2012-06-13 02:38 - 00151552 ____A C:\Windows\SysWOW64\nvRegDev.dll
2012-06-13 02:17 - 2010-10-15 19:45 - 00079376 ____A C:\Users\Geremy\AppData\Local\GDIPFONTCACHEV1.DAT
2012-06-12 23:36 - 2012-06-12 23:36 - 00284408 ____A C:\Windows\Minidump\061212-24648-01.dmp
2012-06-12 23:36 - 2010-12-13 00:29 - 432553323 ____A C:\Windows\MEMORY.DMP
2012-06-12 20:00 - 2010-10-16 17:56 - 00001114 ___AH C:\IPH.PH
2012-06-12 19:08 - 2012-06-12 18:50 - 187408302 ____A (InstallShield Software Corporation) C:\Users\Geremy\Downloads\FX_Composer2_Shader_Debugger_Bundle_2.53.0524.1905.exe
2012-06-02 19:19 - 2012-06-21 14:18 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 19:19 - 2012-06-21 14:18 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 19:19 - 2012-06-21 14:18 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 19:19 - 2012-06-21 14:18 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 19:19 - 2012-06-21 14:18 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 19:15 - 2012-06-21 14:18 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 19:15 - 2012-06-21 14:18 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 15:19 - 2012-06-21 14:18 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-02 15:15 - 2012-06-21 14:18 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-05-15 01:01 - 2012-06-13 00:38 - 01188864 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-05-15 00:59 - 2012-06-13 00:38 - 00064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-05-15 00:03 - 2012-06-13 00:38 - 00981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-05-15 00:00 - 2012-06-13 00:37 - 00048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-05-14 22:32 - 2012-06-13 00:36 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-05-05 03:38 - 2012-04-02 22:38 - 08744608 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2012-05-04 08:06 - 2012-06-13 00:36 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-05-04 07:03 - 2012-06-13 00:36 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-05-04 07:03 - 2012-06-13 00:36 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-05-01 17:57 - 2012-05-01 17:57 - 00001662 ____A C:\Users\Public\Desktop\TERA-Launcher.lnk
2012-04-28 00:55 - 2012-06-13 00:35 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-26 19:42 - 2012-04-26 19:37 - 36149065 ____A C:\Users\Geremy\Downloads\pz_0_1_5d.1.zip
2012-04-26 02:41 - 2012-06-13 00:36 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-26 02:41 - 2012-06-13 00:36 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-26 02:34 - 2012-06-13 00:36 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-22 00:15 - 2011-06-27 20:19 - 00157472 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe
2012-04-22 00:15 - 2011-06-27 20:19 - 00149280 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe
2012-04-22 00:15 - 2011-06-27 20:19 - 00149280 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe
2012-04-22 00:15 - 2011-01-12 16:41 - 00472808 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll
2012-04-20 02:42 - 2012-06-13 00:38 - 12297216 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-04-20 02:42 - 2012-06-13 00:38 - 09059840 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-04-20 02:42 - 2012-06-13 00:38 - 02454528 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-04-20 02:42 - 2012-06-13 00:38 - 01494016 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-04-20 02:42 - 2012-06-13 00:38 - 00735744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-04-20 02:42 - 2012-06-13 00:38 - 00247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-04-20 02:42 - 2012-06-13 00:38 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-04-20 02:42 - 2012-06-13 00:37 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-04-20 02:00 - 2012-06-13 00:38 - 01231360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-04-20 02:00 - 2012-06-13 00:37 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-04-20 01:57 - 2012-06-13 00:38 - 06027776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-04-20 01:57 - 2012-06-13 00:38 - 00627712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-04-20 01:57 - 2012-06-13 00:38 - 00067584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-04-20 01:56 - 2012-06-13 00:38 - 11020800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-04-20 01:56 - 2012-06-13 00:38 - 02073600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-04-20 01:56 - 2012-06-13 00:38 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-04-20 00:45 - 2012-06-13 00:37 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-04-20 00:16 - 2012-06-13 00:37 - 01638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-04-11 23:14 - 2012-04-11 23:14 - 00001973 ____A C:\Users\Geremy\Desktop\Legend of Grimrock.lnk
2012-04-11 22:41 - 2012-04-11 21:52 - 483918688 ____A C:\Users\Geremy\Downloads\grimrock-rc6-1.1.3-installer.zip
2012-04-10 02:32 - 2011-05-20 20:25 - 00000734 ____A C:\Users\Geremy\Documents\(TerrariaEinhander).xpadderprofile

ZeroAccess:
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\@
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\L
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\n
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\U
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\U\00000001.@
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\U\800000cb.@
ZeroAccess:
C:\Users\Geremy\AppData\Local\{4308a726-4453-1462-f29a-c04da33cd417}
C:\Users\Geremy\AppData\Local\{4308a726-4453-1462-f29a-c04da33cd417}\@
C:\Users\Geremy\AppData\Local\{4308a726-4453-1462-f29a-c04da33cd417}\L
C:\Users\Geremy\AppData\Local\{4308a726-4453-1462-f29a-c04da33cd417}\U
========================= Bamital & volsnap Check ============
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2009-07-13 20:19] - [2012-07-03 21:31] - 0328704 ____A () D41D8CD98F00B204E9800998ECF8427E
C:\Windows\System32\services.exe IS INFECTED. <===== ATTENTION!
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
========================= Memory info ======================
Percentage of memory in use: 17%
Total physical RAM: 8190.18 MB
Available physical RAM: 6782.64 MB
Total Pagefile: 16378.54 MB
Available Pagefile: 14923.87 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB
======================= Partitions =========================
1 Drive c: (SystemDisk) (Fixed) (Total:1863.01 GB) (Free:1658.72 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive f: (GB_BATTERY) (Removable) (Total:7.45 GB) (Free:0.18 GB) FAT32
DiskPart has encountered an error: The RPC server is unavailable.
See the System Event Log for more information.

==========================================================
Last Boot: 2012-06-28 00:58
======================= End Of Log ==========================


I also performed the search for "Services.exe". Results follow.


Farbar Recovery Scan Tool Version: 03-07-2012 01
Ran by Geremy at 2012-07-03 22:20:33
Running from F:\
================== Search: "services.exe" ===================
C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 20:19] - [2009-07-13 22:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB
C:\Windows\System32\services.exe
[2009-07-13 20:19] - [2012-07-03 21:31] - 0328704 ____A () D41D8CD98F00B204E9800998ECF8427E
====== End Of Search ======



Thanks in advance. I work at home from my PC so this is potentially devastating to me. I will stand by until instructed.

 

[Broni]

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

===============================================

You didn't run Farbar tool correctly:

ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNTION PROPERLY.

For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

• • 
    Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt
• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

 

[Geremy Walker]

When I use F8 on startup, I do not see the Repair option come up. The only choice I see available is which drive to boot from. I can select Safe Mode with Command Prompt from the delete menu, but I don't know if that's the right option either. I have a windows CD but it's not the OEM one keyed to my PC (I don't have my own anymore). What should I do?

 

[Geremy Walker]

Alright, I got ahold of a standard Windows 7 disk, and I followed the instructions, running frst64 from the command prompt. Here is the report as it was generated.

Scan result of Farbar Recovery Scan Tool Version: 03-07-2012 01
Ran by SYSTEM at 04-07-2012 02:12:02
Running from E:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001
========================== Registry (Whitelisted) =============
HKLM\...\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe" [1860496 2011-04-13] (Microsoft Corporation)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [1680976 2010-10-28] (Logitech, Inc.)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1271168 2012-03-26] (Microsoft Corporation)
HKLM-x32\...\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r [3037808 2011-05-12] (VIA)
HKLM-x32\...\Run: [TaskTray] [x]
HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2011-04-14] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start [1996200 2012-06-27] (LogMeIn Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
==================== Services (Whitelisted) ======
4 Desura Install Service; C:\Program Files (x86)\Common Files\Desura\desura_service.exe [131912 2012-02-19] (Desura Pty Ltd)
2 Hamachi2Svc; "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s [2369960 2012-06-27] (LogMeIn Inc.)
2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [12600 2012-03-26] (Microsoft Corporation)
4 Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [877864 2008-06-10] (Nero AG)
4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)
2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.)
4 S3DSvc32; C:\Program Files (x86)\iZ3D Driver\Win32\S3DCService.exe [360960 2010-10-24] (iZ3D Inc.)
4 S3DSvc64; C:\Program Files (x86)\iZ3D Driver\Win64\S3DCService.exe [480768 2010-10-24] (iZ3D Inc.)
2 VIAKaraokeService; C:\Windows\System32\viakaraokesrv.exe [27760 2011-05-09] (VIA Technologies, Inc.)
2 Akamai; C:\program files (x86)\common files\akamai\netsession_win_d76cf65.dll [x]
========================== Drivers (Whitelisted) =============
3 hamachi; C:\Windows\System32\Drivers\hamachi.sys [33856 2009-03-18] (LogMeIn, Inc.)
1 iZ3DInjectionDriver; \??\C:\Program Files (x86)\iZ3D Driver\Win64\S3DInjectionDriver.sys [43704 2010-10-06] ()
3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
3 NVENETFD; C:\Windows\System32\DRIVERS\nvm62x64.sys [408960 2009-06-10] (NVIDIA Corporation)
0 sptd; C:\Windows\System32\Drivers\sptd.sys [513080 2011-02-12] (Duplex Secure Ltd.)
3 SysInfo; \??\C:\Windows\system32\drivers\SysInfo.sys [x]
========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============
2012-07-03 17:10 - 2012-07-03 17:10 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.EB9F662A144DD241
2012-07-03 17:10 - 2012-07-03 17:10 - 00050392 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\utpqmqor.sys
2012-07-03 17:05 - 2012-07-03 17:05 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.BAE6D825FC2B802B
2012-07-03 17:05 - 2012-07-03 17:05 - 00050392 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\zxcahoyv.sys
2012-07-03 17:04 - 2012-07-03 17:09 - 00000000 ____D C:\FRST
2012-07-03 16:42 - 2012-07-03 16:42 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.055BF01D61730CA8
2012-07-03 16:39 - 2012-07-03 16:39 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.AA897737214FB219
2012-07-03 16:39 - 2012-07-03 16:39 - 00050392 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndzhiclp.sys
2012-07-03 16:36 - 2012-07-03 16:36 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.7650BBB7848E48AB
2012-07-03 16:34 - 2012-07-03 16:34 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.FC49998995B969C2
2012-07-03 16:28 - 2012-07-03 16:28 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.79FE9C5165055EC3
2012-07-03 16:25 - 2012-07-03 16:25 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.66BBA8088936891B
2012-07-03 16:21 - 2012-07-03 16:21 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.3F2CD0B82DBC534F
2012-07-03 16:10 - 2012-07-03 16:10 - 00000000 ____D C:\Program Files\Microsoft Security Client
2012-07-03 16:10 - 2012-07-03 16:10 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2012-07-03 16:07 - 2012-07-03 16:08 - 12621696 ____A (Microsoft Corporation) C:\Users\Geremy\Downloads\mseinstall.exe
2012-07-03 15:54 - 2012-07-03 15:54 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2012-07-03 15:52 - 2012-07-03 15:52 - 00007597 ____A C:\Users\Geremy\AppData\Local\Resmon.ResmonCfg
2012-07-03 14:39 - 2012-07-03 14:39 - 00000000 __SHD C:\Windows\System32\%APPDATA%
2012-07-02 21:01 - 2012-07-02 21:01 - 00000000 ____D C:\Users\Geremy\AppData\Local\{92192416-5FE4-4C6A-BFEB-14956D31EA06}
2012-07-02 21:00 - 2012-07-02 21:01 - 00000000 ____D C:\Users\Geremy\AppData\Local\{B958EE0C-8769-47CC-8A7A-977FCD0592D8}
2012-07-02 09:00 - 2012-07-02 09:00 - 00000000 ____D C:\Users\Geremy\AppData\Local\{B9840E06-A25A-4276-A36D-50B8E6D90108}
2012-07-02 08:59 - 2012-07-02 09:00 - 00000000 ____D C:\Users\Geremy\AppData\Local\{1B7FB947-6B40-440A-99F2-48BC06BA4953}
2012-06-29 19:50 - 2012-06-29 19:50 - 00000000 ____D C:\Users\Geremy\AppData\Local\{5E34E0E6-92BB-42EF-9641-52D7000979BC}
2012-06-29 19:49 - 2012-06-29 19:50 - 00000000 ____D C:\Users\Geremy\AppData\Local\{5E082280-2A43-4F81-8DF0-E20A4975BA1A}
2012-06-28 13:16 - 2012-06-28 13:16 - 00033939 ____A C:\Users\Geremy\.recently-used.xbel
2012-06-28 12:03 - 2012-06-28 12:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{65F1A6B0-A98E-44AC-B794-04A531830FB6}
2012-06-28 12:03 - 2012-06-28 12:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{0AAA81A1-A307-44A2-AC5C-C3E1B98318D5}
2012-06-27 10:55 - 2012-07-02 08:54 - 00000000 ____D C:\Users\Geremy\Desktop\INVOICE
2012-06-27 10:39 - 2012-06-27 10:39 - 00000000 ____D C:\Users\Geremy\AppData\Local\{BA52C587-F055-4F70-9240-8162AE36672F}
2012-06-27 10:38 - 2012-06-27 10:39 - 00000000 ____D C:\Users\Geremy\AppData\Local\{DCF3C70D-06B9-4311-B25E-C9578688371D}
2012-06-26 10:32 - 2012-06-26 10:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{9953C31F-9209-4CBD-BC80-BEFFCE08F805}
2012-06-26 10:31 - 2012-06-26 10:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{35AAADBD-DF4D-4D81-828E-AEE29DAAD7F3}
2012-06-25 22:31 - 2012-06-25 22:31 - 00000000 ____D C:\Users\Geremy\AppData\Local\{F7DB33B9-AD2C-491E-A483-0925C6A82AEB}
2012-06-25 22:30 - 2012-06-25 22:31 - 00000000 ____D C:\Users\Geremy\AppData\Local\{BB392046-C479-4E70-B31F-8DD55C267523}
2012-06-25 10:30 - 2012-06-25 10:30 - 00000000 ____D C:\Users\Geremy\AppData\Local\{52BDA77A-1712-4E2E-B9AC-A2B945A12531}
2012-06-25 10:30 - 2012-06-25 10:30 - 00000000 ____D C:\Users\Geremy\AppData\Local\{4076F621-C0CA-404B-8C67-DF04C02B7819}
2012-06-24 11:59 - 2012-06-24 11:59 - 00000000 ____D C:\Users\Geremy\AppData\Local\{7E94472B-8468-4499-837F-2038AD9708D7}
2012-06-24 11:58 - 2012-06-24 11:59 - 00000000 ____D C:\Users\Geremy\AppData\Local\{FFAB4195-C70E-4034-B2D9-3EAEE6F4D94A}
2012-06-23 23:57 - 2012-06-23 23:58 - 00000000 ____D C:\Users\Geremy\AppData\Local\{33D07FA2-81E9-4928-8B64-BC902825E1AA}
2012-06-23 23:57 - 2012-06-23 23:57 - 00000000 ____D C:\Users\Geremy\AppData\Local\{6112897A-4EA7-4D01-88BC-61BF2366E03E}
2012-06-23 14:05 - 2012-06-23 14:05 - 00008929 ____A C:\Users\Geremy\Desktop\CBS_EP02_SCRIPT_V02.rtf
2012-06-23 11:56 - 2012-06-23 11:57 - 00000000 ____D C:\Users\Geremy\AppData\Local\{D27590C7-1033-4602-BE66-1BE9CA35BBB7}
2012-06-23 11:56 - 2012-06-23 11:56 - 00000000 ____D C:\Users\Geremy\AppData\Local\{0DF7F726-D872-4215-9FE0-36AC304B3B9D}
2012-06-22 22:33 - 2012-06-22 22:33 - 00000000 ____D C:\Users\Geremy\AppData\Local\{D729755C-1642-4E14-AB72-A5012474F1EA}
2012-06-22 22:33 - 2012-06-22 22:33 - 00000000 ____D C:\Users\Geremy\AppData\Local\{D48BF521-094C-4C96-8C73-00A29816C6EE}
2012-06-22 14:25 - 2012-06-23 00:17 - 01827840 ____A C:\Users\Geremy\Desktop\Sal.fla
2012-06-22 11:48 - 2012-06-22 11:48 - 00078304 ____A C:\Users\Geremy\Downloads\PQA.psd
2012-06-22 10:32 - 2012-06-22 10:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{330AE8A4-AADC-4F36-A90E-87D780C8012C}
2012-06-22 10:32 - 2012-06-22 10:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{149B6F4E-47CB-430D-8CB8-C642DBE282C8}
2012-06-21 18:08 - 2012-06-21 18:08 - 00000096 ____A C:\Users\Geremy\.gtk-bookmarks
2012-06-21 11:51 - 2012-06-21 11:51 - 00000000 ____D C:\Users\Geremy\AppData\Local\{361D62CD-B1AE-4558-80B1-17765F205A67}
2012-06-21 11:50 - 2012-06-21 11:51 - 00000000 ____D C:\Users\Geremy\AppData\Local\{ADF83F54-E58A-4974-AFB5-59990AE0DF74}
2012-06-21 09:18 - 2012-06-02 14:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-21 09:18 - 2012-06-02 14:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-21 09:18 - 2012-06-02 14:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-21 09:18 - 2012-06-02 14:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-21 09:18 - 2012-06-02 14:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-21 09:18 - 2012-06-02 14:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-21 09:18 - 2012-06-02 14:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-21 09:18 - 2012-06-02 10:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-21 09:18 - 2012-06-02 10:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-20 21:32 - 2012-06-20 21:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{9C90918B-E3C7-4AEC-B5AD-05339D157616}
2012-06-20 21:32 - 2012-06-20 21:32 - 00000000 ____D C:\Users\Geremy\AppData\Local\{7F938E0F-8F43-48EE-BBA8-0DE6F5238C8D}
2012-06-20 08:25 - 2012-06-20 08:25 - 00000000 ____D C:\Users\Geremy\AppData\Local\{A20DE781-FA0A-4D09-AA1B-9E91043F0A48}
2012-06-20 08:24 - 2012-06-20 08:25 - 00000000 ____D C:\Users\Geremy\AppData\Local\{414D82B2-8FAA-4366-968A-C79AA13AD4DB}
2012-06-20 08:21 - 2012-06-20 08:21 - 00000000 ____D C:\Windows\en
2012-06-20 08:19 - 2012-06-20 08:19 - 00000000 ____D C:\Users\Geremy\AppData\Local\{638CB385-4E3C-4DDF-A04C-B06110B95ACC}
2012-06-20 08:18 - 2012-06-20 08:19 - 00000000 ____D C:\Users\Geremy\AppData\Local\{EC93710E-5F45-4A88-B825-2F361EBC36A4}
2012-06-19 10:50 - 2012-06-19 10:51 - 00000000 ____D C:\Users\Geremy\AppData\Local\{9E69DE35-C9D7-4674-AD70-2273844957B5}
2012-06-19 10:50 - 2012-06-19 10:50 - 00000000 ____D C:\Users\Geremy\AppData\Local\{25DD17FC-824D-49C9-8465-3C1253552915}
2012-06-18 10:28 - 2012-06-18 10:28 - 00000000 ____D C:\Users\Geremy\AppData\Local\{3B3ED46F-EBCF-4D84-AC05-7B59375ED611}
2012-06-17 17:24 - 2012-06-17 17:24 - 00000000 ____D C:\Users\Geremy\AppData\Local\{4E32EF7C-80F1-466E-A0EB-F8B3DE014EAF}
2012-06-16 13:57 - 2012-06-16 13:58 - 00000000 ____D C:\Users\Geremy\AppData\Local\{D6B81E3B-A225-47ED-AE2B-77569FCA1180}
2012-06-14 15:12 - 2012-06-14 15:13 - 00000000 ____D C:\Users\Geremy\AppData\Local\{03DED491-F596-45B7-83E3-008E603BA87C}
2012-06-14 15:12 - 2012-06-14 15:12 - 00000000 ____D C:\Users\Geremy\AppData\Local\{257C78DF-5A1A-4EE3-B390-4693C989DCCE}
2012-06-13 21:24 - 2012-06-13 21:24 - 00000000 ____D C:\Users\Geremy\AppData\Local\{257EAE8E-4ADB-4608-8722-9D63A4EC32F9}
2012-06-13 21:23 - 2012-06-13 21:24 - 00000000 ____D C:\Users\Geremy\AppData\Local\{F4032FCE-8B5D-4A85-AA1D-810D06B467A0}
2012-06-13 08:05 - 2012-06-13 08:06 - 00000000 ____D C:\Users\Geremy\AppData\Local\{660C9A8E-F4A6-4A79-BAA4-CC21A4E3926D}
2012-06-13 08:05 - 2012-06-13 08:05 - 00000000 ____D C:\Users\Geremy\AppData\Local\{9658A3DB-5832-49B3-9731-F0DB896BD980}
2012-06-12 21:43 - 2012-06-12 21:43 - 00002204 ____A C:\Users\Public\Desktop\NVIDIA FX Composer 2.5.lnk
2012-06-12 21:40 - 2012-06-12 21:40 - 00000000 ____D C:\Users\Geremy\Documents\FX Composer 2
2012-06-12 21:40 - 2012-06-12 21:40 - 00000000 ____D C:\Users\Geremy\AppData\Local\NVIDIA Corporation
2012-06-12 21:39 - 2012-06-12 21:39 - 00000000 ____D C:\Python24
2012-06-12 21:38 - 2012-06-12 21:42 - 00151552 ____A C:\Windows\SysWOW64\nvRegDev.dll
2012-06-12 19:38 - 2012-05-14 20:01 - 01188864 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-12 19:38 - 2012-05-14 19:59 - 00064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-12 19:38 - 2012-05-14 19:03 - 00981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-06-12 19:38 - 2012-04-19 21:42 - 12297216 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-12 19:38 - 2012-04-19 21:42 - 09059840 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-12 19:38 - 2012-04-19 21:42 - 02454528 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-12 19:38 - 2012-04-19 21:42 - 01494016 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-12 19:38 - 2012-04-19 21:42 - 00735744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-06-12 19:38 - 2012-04-19 21:42 - 00247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-12 19:38 - 2012-04-19 21:42 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-12 19:38 - 2012-04-19 21:00 - 01231360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-06-12 19:38 - 2012-04-19 20:57 - 06027776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-06-12 19:38 - 2012-04-19 20:57 - 00627712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-06-12 19:38 - 2012-04-19 20:57 - 00067584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-06-12 19:38 - 2012-04-19 20:56 - 11020800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-06-12 19:38 - 2012-04-19 20:56 - 02073600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-06-12 19:38 - 2012-04-19 20:56 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-06-12 19:37 - 2012-05-14 19:00 - 00048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-06-12 19:37 - 2012-04-19 21:42 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-12 19:37 - 2012-04-19 21:00 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-06-12 19:37 - 2012-04-19 19:45 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-12 19:37 - 2012-04-19 19:16 - 01638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-06-12 19:36 - 2012-05-14 17:32 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-12 19:36 - 2012-05-04 03:06 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-06-12 19:36 - 2012-05-04 02:03 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-06-12 19:36 - 2012-05-04 02:03 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-06-12 19:36 - 2012-04-25 21:41 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-06-12 19:36 - 2012-04-25 21:41 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-06-12 19:36 - 2012-04-25 21:34 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-06-12 19:35 - 2012-04-27 19:55 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-06-12 18:36 - 2012-06-12 18:36 - 00284408 ____A C:\Windows\Minidump\061212-24648-01.dmp
2012-06-12 15:01 - 2012-06-12 15:01 - 00000000 ____D C:\Users\Geremy\AppData\Local\{96E0E45F-9012-4A99-9262-1AADC2D48367}
2012-06-12 15:01 - 2012-06-12 15:01 - 00000000 ____D C:\Users\Geremy\AppData\Local\{64571201-6773-4E1B-91B7-535FFF475157}
2012-06-12 13:50 - 2012-06-12 14:08 - 187408302 ____A (InstallShield Software Corporation) C:\Users\Geremy\Downloads\FX_Composer2_Shader_Debugger_Bundle_2.53.0524.1905.exe
2012-06-11 16:15 - 2012-06-11 16:15 - 00000000 ____D C:\Users\Geremy\AppData\Local\{F4777474-C6C4-48A7-A1BB-5BBD542BEEEC}
2012-06-11 16:15 - 2012-06-11 16:15 - 00000000 ____D C:\Users\Geremy\AppData\Local\{325BE52B-08F5-4B20-9BAD-57911A251349}
2012-06-10 07:03 - 2012-06-10 07:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{E92691E0-D411-4F25-AA90-4CC147F951C3}
2012-06-10 07:02 - 2012-06-10 07:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{5C36DA0F-C4A1-4444-843E-FC48BB6E5859}
2012-06-09 14:07 - 2012-06-09 14:07 - 00000000 ____D C:\Users\Geremy\AppData\Local\{DC23FC4B-80A2-4387-B6F3-810114A6B012}
2012-06-09 14:07 - 2012-06-09 14:07 - 00000000 ____D C:\Users\Geremy\AppData\Local\{CBBFB753-B711-469C-8AFF-D72157CE963B}
2012-06-08 18:13 - 2012-06-08 18:13 - 00000000 ____D C:\Users\Geremy\AppData\Local\{96F70C3E-B94B-46B5-9D6E-91D7D000836B}
2012-06-08 18:13 - 2012-06-08 18:13 - 00000000 ____D C:\Users\Geremy\AppData\Local\{4BAA9FBE-EE21-4033-A1FB-EF0F99B1AE46}
2012-06-07 15:03 - 2012-06-07 15:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{D85E649C-6738-4DCB-885B-8182DC02C4C5}
2012-06-07 15:03 - 2012-06-07 15:03 - 00000000 ____D C:\Users\Geremy\AppData\Local\{34B38445-F731-4CE9-B788-067F94033EE6}
2012-06-05 14:22 - 2012-06-05 14:23 - 00000000 ____D C:\Users\Geremy\AppData\Local\{8E651E0C-5A15-4073-98DD-FB8157C76917}
2012-06-05 14:22 - 2012-06-05 14:22 - 00000000 ____D C:\Users\Geremy\AppData\Local\{57FD4A32-A41F-4A9A-82FF-A0ADF632DF24}
2012-06-04 13:25 - 2012-06-04 13:25 - 00000000 ____D C:\Users\Geremy\AppData\Local\{ADD7099E-4BA3-490C-B07E-6E73BDE4A4F4}
2012-06-04 13:25 - 2012-06-04 13:25 - 00000000 ____D C:\Users\Geremy\AppData\Local\{5260D42D-095F-433F-ACAC-8534992E36F5}

============ 3 Months Modified Files ========================
2012-07-03 21:05 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-03 21:05 - 2009-07-13 20:51 - 00238539 ____A C:\Windows\setupact.log
2012-07-03 17:27 - 2012-07-03 17:27 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.898AA2B40165D61B
2012-07-03 17:27 - 2009-07-13 21:13 - 00782528 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-03 17:10 - 2012-07-03 17:10 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.EB9F662A144DD241
2012-07-03 17:10 - 2012-07-03 17:10 - 00050392 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\utpqmqor.sys
2012-07-03 17:05 - 2012-07-03 17:05 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.BAE6D825FC2B802B
2012-07-03 17:05 - 2012-07-03 17:05 - 00050392 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\zxcahoyv.sys
2012-07-03 16:42 - 2012-07-03 16:42 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.055BF01D61730CA8
2012-07-03 16:39 - 2012-07-03 16:39 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.AA897737214FB219
2012-07-03 16:39 - 2012-07-03 16:39 - 00050392 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndzhiclp.sys
2012-07-03 16:36 - 2012-07-03 16:36 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.7650BBB7848E48AB
2012-07-03 16:34 - 2012-07-03 16:34 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.FC49998995B969C2
2012-07-03 16:28 - 2012-07-03 16:28 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.79FE9C5165055EC3
2012-07-03 16:25 - 2012-07-03 16:25 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.66BBA8088936891B
2012-07-03 16:21 - 2012-07-03 16:21 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.3F2CD0B82DBC534F
2012-07-03 16:12 - 2009-07-13 20:45 - 00014832 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-03 16:12 - 2009-07-13 20:45 - 00014832 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-03 16:11 - 2011-01-31 21:16 - 00001945 ____A C:\Windows\epplauncher.mif
2012-07-03 16:11 - 2010-10-15 18:37 - 01511428 ____A C:\Windows\WindowsUpdate.log
2012-07-03 16:10 - 2011-01-31 21:16 - 00789382 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2012-07-03 16:08 - 2012-07-03 16:07 - 12621696 ____A (Microsoft Corporation) C:\Users\Geremy\Downloads\mseinstall.exe
2012-07-03 15:52 - 2012-07-03 15:52 - 00007597 ____A C:\Users\Geremy\AppData\Local\Resmon.ResmonCfg
2012-07-03 14:37 - 2012-04-02 17:36 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-07-03 14:37 - 2011-05-14 10:24 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-07-03 13:09 - 2010-10-17 10:24 - 00000052 ____A C:\Users\Geremy\AppData\default.pls
2012-06-28 13:16 - 2012-06-28 13:16 - 00033939 ____A C:\Users\Geremy\.recently-used.xbel
2012-06-23 14:05 - 2012-06-23 14:05 - 00008929 ____A C:\Users\Geremy\Desktop\CBS_EP02_SCRIPT_V02.rtf
2012-06-23 00:17 - 2012-06-22 14:25 - 01827840 ____A C:\Users\Geremy\Desktop\Sal.fla
2012-06-22 11:48 - 2012-06-22 11:48 - 00078304 ____A C:\Users\Geremy\Downloads\PQA.psd
2012-06-21 18:08 - 2012-06-21 18:08 - 00000096 ____A C:\Users\Geremy\.gtk-bookmarks
2012-06-20 18:56 - 2012-03-05 19:50 - 00004096 ____A C:\Users\Geremy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-06-20 08:19 - 2010-10-12 09:41 - 00453638 ____A C:\Windows\DirectX.log
2012-06-15 21:51 - 2012-02-05 20:52 - 00000900 ____A C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2012-06-13 08:02 - 2009-07-13 20:45 - 04888992 ____A C:\Windows\System32\FNTCACHE.DAT
2012-06-12 22:05 - 2010-08-04 13:37 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-06-12 21:43 - 2012-06-12 21:43 - 00002204 ____A C:\Users\Public\Desktop\NVIDIA FX Composer 2.5.lnk
2012-06-12 21:42 - 2012-06-12 21:38 - 00151552 ____A C:\Windows\SysWOW64\nvRegDev.dll
2012-06-12 21:17 - 2010-10-15 14:45 - 00079376 ____A C:\Users\Geremy\AppData\Local\GDIPFONTCACHEV1.DAT
2012-06-12 18:36 - 2012-06-12 18:36 - 00284408 ____A C:\Windows\Minidump\061212-24648-01.dmp
2012-06-12 18:36 - 2010-12-12 19:29 - 432553323 ____A C:\Windows\MEMORY.DMP
2012-06-12 15:00 - 2010-10-16 12:56 - 00001114 ___AH C:\IPH.PH
2012-06-12 14:08 - 2012-06-12 13:50 - 187408302 ____A (InstallShield Software Corporation) C:\Users\Geremy\Downloads\FX_Composer2_Shader_Debugger_Bundle_2.53.0524.1905.exe
2012-06-02 14:19 - 2012-06-21 09:18 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-21 09:18 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-21 09:18 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-21 09:18 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-21 09:18 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:15 - 2012-06-21 09:18 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:15 - 2012-06-21 09:18 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 10:19 - 2012-06-21 09:18 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-02 10:15 - 2012-06-21 09:18 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-05-14 20:01 - 2012-06-12 19:38 - 01188864 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-05-14 19:59 - 2012-06-12 19:38 - 00064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-05-14 19:03 - 2012-06-12 19:38 - 00981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-05-14 19:00 - 2012-06-12 19:37 - 00048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-05-14 17:32 - 2012-06-12 19:36 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-05-04 22:38 - 2012-04-02 17:38 - 08744608 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2012-05-04 03:06 - 2012-06-12 19:36 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-05-04 02:03 - 2012-06-12 19:36 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-05-04 02:03 - 2012-06-12 19:36 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-05-01 12:57 - 2012-05-01 12:57 - 00001662 ____A C:\Users\Public\Desktop\TERA-Launcher.lnk
2012-04-27 19:55 - 2012-06-12 19:35 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-26 14:42 - 2012-04-26 14:37 - 36149065 ____A C:\Users\Geremy\Downloads\pz_0_1_5d.1.zip
2012-04-25 21:41 - 2012-06-12 19:36 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-25 21:41 - 2012-06-12 19:36 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-25 21:34 - 2012-06-12 19:36 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-21 19:15 - 2011-06-27 15:19 - 00157472 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe
2012-04-21 19:15 - 2011-06-27 15:19 - 00149280 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe
2012-04-21 19:15 - 2011-06-27 15:19 - 00149280 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe
2012-04-21 19:15 - 2011-01-12 11:41 - 00472808 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll
2012-04-19 21:42 - 2012-06-12 19:38 - 12297216 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-04-19 21:42 - 2012-06-12 19:38 - 09059840 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-04-19 21:42 - 2012-06-12 19:38 - 02454528 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-04-19 21:42 - 2012-06-12 19:38 - 01494016 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-04-19 21:42 - 2012-06-12 19:38 - 00735744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-04-19 21:42 - 2012-06-12 19:38 - 00247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-04-19 21:42 - 2012-06-12 19:38 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-04-19 21:42 - 2012-06-12 19:37 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-04-19 21:00 - 2012-06-12 19:38 - 01231360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-04-19 21:00 - 2012-06-12 19:37 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-04-19 20:57 - 2012-06-12 19:38 - 06027776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-04-19 20:57 - 2012-06-12 19:38 - 00627712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-04-19 20:57 - 2012-06-12 19:38 - 00067584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-04-19 20:56 - 2012-06-12 19:38 - 11020800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-04-19 20:56 - 2012-06-12 19:38 - 02073600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-04-19 20:56 - 2012-06-12 19:38 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-04-19 19:45 - 2012-06-12 19:37 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-04-19 19:16 - 2012-06-12 19:37 - 01638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-04-11 18:14 - 2012-04-11 18:14 - 00001973 ____A C:\Users\Geremy\Desktop\Legend of Grimrock.lnk
2012-04-11 17:41 - 2012-04-11 16:52 - 483918688 ____A C:\Users\Geremy\Downloads\grimrock-rc6-1.1.3-installer.zip
2012-04-09 21:32 - 2011-05-20 15:25 - 00000734 ____A C:\Users\Geremy\Documents\(TerrariaEinhander).xpadderprofile

ZeroAccess:
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\@
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\L
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\n
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\U
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\U\00000001.@
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417}\U\800000cb.@
ZeroAccess:
C:\Users\Geremy\AppData\Local\{4308a726-4453-1462-f29a-c04da33cd417}
C:\Users\Geremy\AppData\Local\{4308a726-4453-1462-f29a-c04da33cd417}\@
C:\Users\Geremy\AppData\Local\{4308a726-4453-1462-f29a-c04da33cd417}\L
C:\Users\Geremy\AppData\Local\{4308a726-4453-1462-f29a-c04da33cd417}\U
========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
========================= Memory info ======================
Percentage of memory in use: 10%
Total physical RAM: 8190.18 MB
Available physical RAM: 7360.95 MB
Total Pagefile: 8188.32 MB
Available Pagefile: 7351.92 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB
======================= Partitions =========================
1 Drive c: (SystemDisk) (Fixed) (Total:1863.01 GB) (Free:1658.47 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive d: (GRMCHPXFREO_EN_DVD) (CDROM) (Total:3 GB) (Free:0 GB) UDF
3 Drive e: (GB_BATTERY) (Removable) (Total:7.45 GB) (Free:0.18 GB) FAT32
4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 1863 GB 0 B
Disk 1 Online 7643 MB 0 B
Partitions of Disk 0:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 1863 GB 1024 KB
==================================================================================
Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C SystemDisk NTFS Partition 1863 GB Healthy
==================================================================================
Partitions of Disk 1:
===============
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 7643 MB 31 KB
==================================================================================
Disk: 1
Partition 1
Type : 0B
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 E GB_BATTERY FAT32 Removable 7643 MB Healthy
==================================================================================
==========================================================
Last Boot: 2012-06-27 19:58
======================= End Of Log ==========================


I hope I've done it right this time. Awaiting further instructions.

 

[Broni]

Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Next...

Restart normally.

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
• Close any open browsers.
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
• Double click on combofix.exe & follow the prompts.

• 
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.

• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe

• Double-click on the Rkill icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

 

[Geremy Walker]

Alright, done both steps. FRST64 fixlog follows.

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 03-07-2012 01
Ran by SYSTEM at 2012-07-04 13:06:00 Run:1
Running from E:\

==============================================

HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows Value was restored successfully .
C:\Windows\System32\consrv.dll not found.
HKEY_LOCAL_MACHINE\software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\TaskTray Value deleted successfully.
C:\Windows\System32\services.exe.EB9F662A144DD241 moved successfully.
C:\Windows\System32\Drivers\utpqmqor.sys moved successfully.
C:\Windows\System32\services.exe.BAE6D825FC2B802B moved successfully.
C:\Windows\System32\Drivers\zxcahoyv.sys moved successfully.
C:\Windows\System32\services.exe.055BF01D61730CA8 moved successfully.
C:\Windows\System32\services.exe.AA897737214FB219 moved successfully.
C:\Windows\System32\Drivers\ndzhiclp.sys moved successfully.
C:\Windows\System32\services.exe.7650BBB7848E48AB moved successfully.
C:\Windows\System32\services.exe.FC49998995B969C2 moved successfully.
C:\Windows\System32\services.exe.79FE9C5165055EC3 moved successfully.
C:\Windows\System32\services.exe.66BBA8088936891B moved successfully.
C:\Windows\System32\services.exe.3F2CD0B82DBC534F moved successfully.
C:\Windows\Installer\{4308a726-4453-1462-f29a-c04da33cd417} moved successfully.
C:\Users\Geremy\AppData\Local\{4308a726-4453-1462-f29a-c04da33cd417} moved successfully.

==== End of Fixlog ====

 

[Geremy Walker]

And now the Combofix Log.

ComboFix 12-07-04.03 - Geremy 04/07/2012 13:16:20.1.6 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.8190.6553 [GMT -3:00]
Running from: c:\users\Geremy\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\users\Geremy\AppData\Local\Microsoft\Windows\Temporary Internet Files\EdgeFuzz.zip
c:\users\Geremy\AppData\Local\Microsoft\Windows\Temporary Internet Files\post_bloom.zip
c:\users\Geremy\AppData\Local\Microsoft\Windows\Temporary Internet Files\post_glow_screenSize.zip
c:\users\Geremy\AppData\Local\Microsoft\Windows\Temporary Internet Files\post_tiles.zip
c:\users\Geremy\g2mdlhlpx.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-06-04 to 2012-07-04 )))))))))))))))))))))))))))))))
.
.
2012-07-04 01:27 . 2012-07-04 01:27 328704 ----a-w- c:\windows\system32\services.exe.898AA2B40165D61B
2012-07-04 01:04 . 2012-07-04 01:09 -------- d-----w- C:\FRST
2012-07-04 00:20 . 2012-02-09 17:17 927800 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7A22B790-D7E9-4B1F-982E-7E7A0EFEFFC1}\gapaengine.dll
2012-07-04 00:19 . 2012-06-18 06:12 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0D908999-8ED9-4728-AE7D-E1C59C66DA25}\mpengine.dll
2012-07-04 00:10 . 2012-07-04 00:10 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2012-07-04 00:10 . 2012-07-04 00:10 -------- d-----w- c:\program files\Microsoft Security Client
2012-07-03 23:54 . 2012-07-03 23:54 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2012-07-03 22:39 . 2012-07-03 22:39 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-06-21 17:18 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-21 17:18 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-21 17:18 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-21 17:18 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-21 17:18 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-21 17:18 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-21 17:18 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-21 17:18 . 2012-06-02 18:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-21 17:18 . 2012-06-02 18:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-20 16:21 . 2012-06-20 16:21 -------- d-----w- c:\windows\en
2012-06-20 16:19 . 2012-06-20 16:19 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\7e2d13091cd4f0001\DSETUP.dll
2012-06-20 16:19 . 2012-06-20 16:19 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\7e2d13091cd4f0001\DXSETUP.exe
2012-06-20 16:19 . 2012-06-20 16:19 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\7e2d13091cd4f0001\dsetup32.dll
2012-06-13 05:42 . 2012-06-13 05:42 -------- d-----w- c:\program files (x86)\Common Files\NVIDIA Corporation
2012-06-13 05:40 . 2012-06-13 05:40 -------- d-----w- c:\users\Geremy\AppData\Local\NVIDIA Corporation
2012-06-13 05:39 . 2012-06-13 05:39 -------- d-----w- C:\Python24
2012-06-13 05:38 . 2012-06-13 05:42 151552 ----a-w- c:\windows\SysWow64\nvRegDev.dll
2012-06-13 03:37 . 2012-04-20 03:45 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2012-06-13 03:37 . 2012-04-20 03:16 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-06-13 03:36 . 2012-04-26 05:41 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-13 03:36 . 2012-04-26 05:41 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-13 03:36 . 2012-04-26 05:34 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-13 03:36 . 2012-05-04 11:06 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-06-13 03:36 . 2012-05-04 10:03 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-06-13 03:36 . 2012-05-04 10:03 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-06-13 03:36 . 2012-05-15 01:32 3146752 ----a-w- c:\windows\system32\win32k.sys
2012-06-13 03:35 . 2012-04-28 03:55 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-12 23:00 . 2012-06-12 23:00 -------- d-----w- c:\program files (x86)\Common Files\Software Update Utility
2012-06-07 23:59 . 2012-06-07 23:59 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-07 23:59 . 2012-06-07 23:59 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-03 22:37 . 2012-04-03 01:36 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-03 22:37 . 2011-05-14 18:24 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-05 06:38 . 2012-04-03 01:38 8744608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-22 03:15 . 2011-01-12 19:41 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2011-05-13 3037808]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-04-14 113288]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-06-27 1996200]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-07 160944]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-17 113120]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 SysInfo;SysInfo;c:\windows\system32\drivers\SysInfo.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-08-04 1255736]
R4 Desura Install Service;Desura Install Service;c:\program files (x86)\Common Files\Desura\desura_service.exe [2012-02-19 131912]
R4 S3DSvc32;S3D Service (Win32);c:\program files (x86)\iZ3D Driver\Win32\S3DCService.exe [2010-10-25 360960]
R4 S3DSvc64;S3D Service (Win64);c:\program files (x86)\iZ3D Driver\Win64\S3DCService.exe [2010-10-25 480768]
R4 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 iZ3DInjectionDriver;Driver inject our D3D and OGL wrappers;c:\program files (x86)\iZ3D Driver\Win64\S3DInjectionDriver.sys [2010-10-06 43704]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-06-27 2369960]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-21 378472]
S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2010-11-15 5716848]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe [2011-05-09 27760]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [2010-08-24 74320]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [2010-08-24 13392]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2011-04-13 87552]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2011-04-13 207872]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2011-05-25 174184]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-05-17 533096]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2010-12-16 47232]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2011-05-09 2158704]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2010-11-02 13312]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-04-13 1860496]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\users\Geremy\AppData\Roaming\Mozilla\Firefox\Profiles\nbbnkq55.default\
FF - prefs.js: browser.startup.homepage - hxxp://8bitfunding.com/index.php|http://townseed.blogspot.ca/|http:/...w.facebook.com/pages/Townseed/277630045646316
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-UnityWebPlayer - c:\users\Geremy\AppData\Local\Unity\WebPlayer\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3766927083-367389019-4167597906-1000\Software\SecuROM\License information*]
"datasecu"=hex:6a,78,2c,fa,b8,38,1a,aa,7c,db,05,73,03,f0,29,0f,99,d3,52,4d,eb,
33,9b,73,3a,fa,93,aa,1b,7a,f4,46,a5,be,cb,e3,87,f4,c5,5e,33,88,34,d3,45,89,\
"rkeysecu"=hex:64,b6,bd,e1,3e,80,9e,c4,40,b4,90,83,87,8e,33,49
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
c:\windows\SysWOW64\IoctlSvc.exe
.
**************************************************************************
.
Completion time: 2012-07-04 13:31:43 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-04 16:31
.
Pre-Run: 1,780,631,355,392 bytes free
Post-Run: 1,781,080,854,528 bytes free
.
- - End Of File - - 4CDD331803A7E79051F84BEA64B1C55E

 

[Geremy Walker]

Computer appears to be working properly at this point. Standing by for instructions.

 

[Broni]

Cool

1. Please open Notepad (Start>All Programs>Accessories>Notepad).

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\windows\system32\services.exe.898AA2B40165D61B

ClearJavaCache::

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt

 

[Geremy Walker]

Alright, I've done as directed. Here is the log.

ComboFix 12-07-04.04 - Geremy 04/07/2012 14:10:51.2.6 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.8190.6619 [GMT -3:00]
Running from: c:\users\Geremy\Desktop\ComboFix.exe
Command switches used :: c:\users\Geremy\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\windows\system32\services.exe.898AA2B40165D61B"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\services.exe.898AA2B40165D61B
.
.
((((((((((((((((((((((((( Files Created from 2012-06-04 to 2012-07-04 )))))))))))))))))))))))))))))))
.
.
2012-07-04 17:18 . 2012-07-04 17:18 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-07-04 17:18 . 2012-07-04 17:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-04 16:49 . 2012-06-18 06:12 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{49F83A36-A6A5-4348-B456-89BDE6E24872}\mpengine.dll
2012-07-04 01:04 . 2012-07-04 01:09 -------- d-----w- C:\FRST
2012-07-04 00:20 . 2012-02-09 17:17 927800 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7A22B790-D7E9-4B1F-982E-7E7A0EFEFFC1}\gapaengine.dll
2012-07-04 00:10 . 2012-07-04 00:10 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2012-07-04 00:10 . 2012-07-04 00:10 -------- d-----w- c:\program files\Microsoft Security Client
2012-07-03 23:54 . 2012-07-03 23:54 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2012-07-03 22:39 . 2012-07-03 22:39 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-06-21 17:18 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-21 17:18 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-21 17:18 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-21 17:18 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-21 17:18 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-21 17:18 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-21 17:18 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-21 17:18 . 2012-06-02 18:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-21 17:18 . 2012-06-02 18:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-20 16:21 . 2012-06-20 16:21 -------- d-----w- c:\windows\en
2012-06-20 16:19 . 2012-06-20 16:19 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\7e2d13091cd4f0001\DSETUP.dll
2012-06-20 16:19 . 2012-06-20 16:19 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\7e2d13091cd4f0001\DXSETUP.exe
2012-06-20 16:19 . 2012-06-20 16:19 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\7e2d13091cd4f0001\dsetup32.dll
2012-06-13 05:42 . 2012-06-13 05:42 -------- d-----w- c:\program files (x86)\Common Files\NVIDIA Corporation
2012-06-13 05:40 . 2012-06-13 05:40 -------- d-----w- c:\users\Geremy\AppData\Local\NVIDIA Corporation
2012-06-13 05:39 . 2012-06-13 05:39 -------- d-----w- C:\Python24
2012-06-13 05:38 . 2012-06-13 05:42 151552 ----a-w- c:\windows\SysWow64\nvRegDev.dll
2012-06-13 03:37 . 2012-04-20 03:45 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2012-06-13 03:37 . 2012-04-20 03:16 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-06-13 03:36 . 2012-04-26 05:41 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-13 03:36 . 2012-04-26 05:41 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-13 03:36 . 2012-04-26 05:34 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-13 03:36 . 2012-05-04 11:06 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-06-13 03:36 . 2012-05-04 10:03 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-06-13 03:36 . 2012-05-04 10:03 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-06-13 03:36 . 2012-05-15 01:32 3146752 ----a-w- c:\windows\system32\win32k.sys
2012-06-13 03:35 . 2012-04-28 03:55 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-12 23:00 . 2012-06-12 23:00 -------- d-----w- c:\program files (x86)\Common Files\Software Update Utility
2012-06-07 23:59 . 2012-06-07 23:59 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-07 23:59 . 2012-06-07 23:59 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-03 22:37 . 2012-04-03 01:36 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-03 22:37 . 2011-05-14 18:24 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-05 06:38 . 2012-04-03 01:38 8744608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-22 03:15 . 2011-01-12 19:41 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-07-04_16.27.01 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-08-04 22:01 . 2012-07-04 16:37 37488 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-07-04 16:37 36048 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-10-15 22:41 . 2012-07-04 17:21 15818 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3766927083-367389019-4167597906-1000_UserData.bin
- 2010-10-12 18:12 . 2012-07-04 16:13 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-12 18:12 . 2012-07-04 17:07 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-10-12 18:12 . 2012-07-04 17:07 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-10-12 18:12 . 2012-07-04 16:13 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2012-07-04 16:26 . 2012-07-04 16:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-07-04 17:19 . 2012-07-04 17:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-07-04 17:19 . 2012-07-04 17:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-07-04 16:26 . 2012-07-04 16:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2012-07-04 16:14 669062 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-07-04 16:39 669062 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-07-04 16:39 127738 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-07-04 16:14 127738 c:\windows\system32\perfc009.dat
- 2009-07-14 05:01 . 2012-07-04 16:24 387600 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-07-04 17:18 387600 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-10-16 04:45 . 2012-07-04 17:18 29004008 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3766927083-367389019-4167597906-1000-8192.dat
- 2010-10-16 04:45 . 2012-07-04 16:24 29004008 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3766927083-367389019-4167597906-1000-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2011-05-13 3037808]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-04-14 113288]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-06-27 1996200]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-07 160944]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-17 113120]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 SysInfo;SysInfo;c:\windows\system32\drivers\SysInfo.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-08-04 1255736]
R4 Desura Install Service;Desura Install Service;c:\program files (x86)\Common Files\Desura\desura_service.exe [2012-02-19 131912]
R4 S3DSvc32;S3D Service (Win32);c:\program files (x86)\iZ3D Driver\Win32\S3DCService.exe [2010-10-25 360960]
R4 S3DSvc64;S3D Service (Win64);c:\program files (x86)\iZ3D Driver\Win64\S3DCService.exe [2010-10-25 480768]
R4 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 iZ3DInjectionDriver;Driver inject our D3D and OGL wrappers;c:\program files (x86)\iZ3D Driver\Win64\S3DInjectionDriver.sys [2010-10-06 43704]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-06-27 2369960]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-25 2214504]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-21 378472]
S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2010-11-15 5716848]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe [2011-05-09 27760]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [2010-08-24 74320]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [2010-08-24 13392]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2011-04-13 87552]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2011-04-13 207872]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2011-05-25 174184]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-05-17 533096]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2010-12-16 47232]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2011-05-09 2158704]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2010-11-02 13312]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Geremy\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-04-13 1860496]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\Geremy\AppData\Roaming\Mozilla\Firefox\Profiles\nbbnkq55.default\
FF - prefs.js: browser.startup.homepage - hxxp://8bitfunding.com/index.php|http://townseed.blogspot.ca/|http:/...w.facebook.com/pages/Townseed/277630045646316
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3766927083-367389019-4167597906-1000\Software\SecuROM\License information*]
"datasecu"=hex:6a,78,2c,fa,b8,38,1a,aa,7c,db,05,73,03,f0,29,0f,99,d3,52,4d,eb,
33,9b,73,3a,fa,93,aa,1b,7a,f4,46,a5,be,cb,e3,87,f4,c5,5e,33,88,34,d3,45,89,\
"rkeysecu"=hex:64,b6,bd,e1,3e,80,9e,c4,40,b4,90,83,87,8e,33,49
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
c:\windows\SysWOW64\IoctlSvc.exe
.
**************************************************************************
.
Completion time: 2012-07-04 14:24:17 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-04 17:24
ComboFix2.txt 2012-07-04 16:31
.
Pre-Run: 1,780,991,963,136 bytes free
Post-Run: 1,780,927,164,416 bytes free
.
- - End Of File - - 5A32DF61713D60FACE3ADD5186902F3A

 

[Broni]

Good

Download Malwarebytes' Anti-Malware (MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
NOTE. If you already have MBAM installed, update it before running the scan.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

=========================================

Download OTL to your Desktop.

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click the Scan All Users checkbox.
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

 

[Geremy Walker]

Here is the MBAM log. Restarting my PC now to continue the OTL process.

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.07.04.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Geremy :: GALKA [administrator]

Protection: Enabled

04/07/2012 3:03:56 PM
mbam-log-2012-07-04 (15-03-56).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 230177
Time elapsed: 4 minute(s), 9 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

 

[Geremy Walker]

Here is the OTL report

OTL logfile created on: 7/4/2012 3:15:17 PM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Geremy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

8.00 Gb Total Physical Memory | 6.51 Gb Available Physical Memory | 81.37% Memory free
15.99 Gb Paging File | 14.49 Gb Available in Paging File | 90.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1863.01 Gb Total Space | 1658.67 Gb Free Space | 89.03% Space Free | Partition Type: NTFS
Drive F: | 7.45 Gb Total Space | 0.18 Gb Free Space | 2.35% Space Free | Partition Type: FAT32
Drive H: | 3.00 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: GALKA | User Name: Geremy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/04 15:13:31 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Geremy\Desktop\OTL.exe
PRC - [2012/06/27 12:29:26 | 001,996,200 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/04/04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011/05/25 04:25:28 | 002,214,504 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011/05/20 22:35:16 | 000,378,472 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011/04/14 18:17:18 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2006/12/19 14:30:26 | 000,081,920 | ---- | M] (Prolific Technology Inc.) -- C:\Windows\SysWOW64\IoctlSvc.exe


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2012/03/26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2012/03/26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2011/05/09 17:16:34 | 000,027,760 | ---- | M] (VIA Technologies, Inc.) [Auto | Running] -- C:\Windows\SysNative\ViakaraokeSrv.exe -- (VIAKaraokeService)
SRV:64bit: - [2010/11/15 16:08:10 | 005,716,848 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe -- (TabletServiceWacom)
SRV:64bit: - [2010/10/28 07:14:30 | 000,357,456 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV:64bit: - [2009/07/13 22:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/06/27 12:29:24 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012/06/19 03:20:13 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/06/16 23:07:04 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/06/07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/02/19 12:57:12 | 000,131,912 | ---- | M] (Desura Pty Ltd) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Desura\desura_service.exe -- (Desura Install Service)
SRV - [2011/05/25 04:25:28 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/05/20 22:35:16 | 000,378,472 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011/03/04 00:13:09 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/10/25 00:11:06 | 000,360,960 | ---- | M] (iZ3D Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\iZ3D Driver\Win32\S3DCService.exe -- (S3DSvc32) S3D Service (Win32)
SRV - [2010/10/25 00:09:04 | 000,480,768 | ---- | M] (iZ3D Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\iZ3D Driver\Win64\S3DCService.exe -- (S3DSvc64) S3D Service (Win64)
SRV - [2010/03/18 17:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/06/10 18:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2006/12/19 14:30:26 | 000,081,920 | ---- | M] (Prolific Technology Inc.) [Auto | Running] -- C:\Windows\SysWOW64\IoctlSvc.exe -- (PLFlash DeviceIoControl Service)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/04/04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012/03/20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012/03/01 03:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/05/25 04:25:48 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2011/05/16 22:55:28 | 000,533,096 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011/05/09 17:16:26 | 002,158,704 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV:64bit: - [2011/04/13 18:30:54 | 000,207,872 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2011/04/13 18:30:50 | 000,087,552 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2011/02/12 12:02:41 | 000,513,080 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010/12/16 00:06:46 | 000,047,232 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2010/11/20 10:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 10:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 10:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010/11/20 08:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/02 17:07:54 | 000,013,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV:64bit: - [2010/10/25 11:59:32 | 000,012,848 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV:64bit: - [2010/10/25 11:59:28 | 000,016,168 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacomvhid.sys -- (wacomvhid)
DRV:64bit: - [2010/09/08 15:42:16 | 000,295,272 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\VMM.sys -- (vmm)
DRV:64bit: - [2010/08/24 14:29:32 | 000,057,936 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2010/08/24 14:29:10 | 000,063,568 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2010/08/24 14:29:10 | 000,013,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2010/08/24 14:28:58 | 000,074,320 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2010/06/17 06:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2010/03/03 23:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\IaStor.sys -- (iaStor)
DRV:64bit: - [2009/07/16 11:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009/07/13 22:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 22:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 22:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 21:01:09 | 000,679,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xnacc.sys -- (xnacc)
DRV:64bit: - [2009/06/10 17:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009/06/10 17:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 17:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 17:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 17:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/04/08 14:28:46 | 000,068,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009/03/18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2010/10/06 18:04:02 | 000,043,704 | ---- | M] () [Kernel | System | Running] -- C:\Program Files (x86)\iZ3D Driver\Win64\S3DInjectionDriver.sys -- (iZ3DInjectionDriver)
DRV - [2009/07/13 22:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3766927083-367389019-4167597906-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-ca
IE - HKU\S-1-5-21-3766927083-367389019-4167597906-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C9 D6 74 DB 84 80 CC 01 [binary data]
IE - HKU\S-1-5-21-3766927083-367389019-4167597906-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3766927083-367389019-4167597906-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3766927083-367389019-4167597906-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3766927083-367389019-4167597906-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://8bitfunding.com/index.php|ht...w.facebook.com/pages/Townseed/277630045646316"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7280


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_257.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Geremy\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/16 23:07:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/01/21 17:37:36 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/16 23:07:04 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/01/21 17:37:36 | 000,000,000 | ---D | M]

[2010/10/15 20:10:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Geremy\AppData\Roaming\Mozilla\Extensions
[2012/05/19 16:36:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Geremy\AppData\Roaming\Mozilla\Firefox\Profiles\nbbnkq55.default\extensions
[2012/05/19 16:36:36 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Geremy\AppData\Roaming\Mozilla\Firefox\Profiles\nbbnkq55.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2012/04/26 18:11:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/04/14 17:59:08 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/06/16 23:07:04 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/22 00:15:47 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/04/26 18:11:42 | 000,001,525 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/02/13 18:56:18 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/04/26 18:11:42 | 000,000,935 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/04/26 18:11:42 | 000,001,166 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012/04/26 18:11:43 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
[2012/04/26 18:11:42 | 000,001,121 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2012/07/04 14:20:03 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [itype] c:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKU\S-1-5-21-3766927083-367389019-4167597906-1001..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3766927083-367389019-4167597906-1001..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3766927083-367389019-4167597906-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3766927083-367389019-4167597906-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3766927083-367389019-4167597906-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F64CB93D-F23F-4E57-A797-4E9CFD71C270}: DhcpNameServer = 192.168.2.1 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/07/14 06:29:38 | 000,000,122 | R--- | M] () - H:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/04 15:13:29 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Geremy\Desktop\OTL.exe
[2012/07/04 15:02:46 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Roaming\Malwarebytes
[2012/07/04 15:02:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/04 15:02:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/04 15:02:36 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/07/04 15:02:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/07/04 15:00:30 | 010,063,000 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Geremy\Desktop\mbam-setup-1.61.0.1400.exe
[2012/07/04 14:24:20 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/07/04 14:20:05 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012/07/04 13:14:49 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/07/04 13:14:49 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/07/04 13:14:49 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/07/04 13:14:44 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/07/04 13:14:27 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/07/04 13:11:23 | 004,571,247 | R--- | C] (Swearware) -- C:\Users\Geremy\Desktop\ComboFix.exe
[2012/07/03 22:04:35 | 000,000,000 | ---D | C] -- C:\FRST
[2012/07/03 21:10:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client
[2012/07/03 21:10:33 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012/07/03 21:09:48 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2012/07/03 20:54:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2012/07/03 20:54:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi
[2012/07/03 19:39:51 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2012/07/03 02:01:19 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{92192416-5FE4-4C6A-BFEB-14956D31EA06}
[2012/07/03 02:00:47 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{B958EE0C-8769-47CC-8A7A-977FCD0592D8}
[2012/07/02 14:00:22 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{B9840E06-A25A-4276-A36D-50B8E6D90108}
[2012/07/02 13:59:59 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{1B7FB947-6B40-440A-99F2-48BC06BA4953}
[2012/06/30 00:50:22 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{5E34E0E6-92BB-42EF-9641-52D7000979BC}
[2012/06/30 00:49:52 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{5E082280-2A43-4F81-8DF0-E20A4975BA1A}
[2012/06/28 17:03:28 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{0AAA81A1-A307-44A2-AC5C-C3E1B98318D5}
[2012/06/28 17:03:00 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{65F1A6B0-A98E-44AC-B794-04A531830FB6}
[2012/06/27 15:55:35 | 000,000,000 | ---D | C] -- C:\Users\Geremy\Desktop\INVOICE
[2012/06/27 15:39:10 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{BA52C587-F055-4F70-9240-8162AE36672F}
[2012/06/27 15:38:46 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{DCF3C70D-06B9-4311-B25E-C9578688371D}
[2012/06/26 15:32:12 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{9953C31F-9209-4CBD-BC80-BEFFCE08F805}
[2012/06/26 15:31:38 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{35AAADBD-DF4D-4D81-828E-AEE29DAAD7F3}
[2012/06/26 03:31:14 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{F7DB33B9-AD2C-491E-A483-0925C6A82AEB}
[2012/06/26 03:30:40 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{BB392046-C479-4E70-B31F-8DD55C267523}
[2012/06/25 15:30:28 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{52BDA77A-1712-4E2E-B9AC-A2B945A12531}
[2012/06/25 15:30:07 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{4076F621-C0CA-404B-8C67-DF04C02B7819}
[2012/06/24 16:59:31 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{7E94472B-8468-4499-837F-2038AD9708D7}
[2012/06/24 16:58:30 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{FFAB4195-C70E-4034-B2D9-3EAEE6F4D94A}
[2012/06/24 04:57:41 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{33D07FA2-81E9-4928-8B64-BC902825E1AA}
[2012/06/24 04:57:08 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{6112897A-4EA7-4D01-88BC-61BF2366E03E}
[2012/06/23 16:56:30 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{D27590C7-1033-4602-BE66-1BE9CA35BBB7}
[2012/06/23 16:56:09 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{0DF7F726-D872-4215-9FE0-36AC304B3B9D}
[2012/06/23 03:33:26 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{D729755C-1642-4E14-AB72-A5012474F1EA}
[2012/06/23 03:33:01 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{D48BF521-094C-4C96-8C73-00A29816C6EE}
[2012/06/22 15:32:36 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{330AE8A4-AADC-4F36-A90E-87D780C8012C}
[2012/06/22 15:32:13 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{149B6F4E-47CB-430D-8CB8-C642DBE282C8}
[2012/06/21 16:51:14 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{361D62CD-B1AE-4558-80B1-17765F205A67}
[2012/06/21 16:50:48 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{ADF83F54-E58A-4974-AFB5-59990AE0DF74}
[2012/06/21 02:32:44 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{9C90918B-E3C7-4AEC-B5AD-05339D157616}
[2012/06/21 02:32:21 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{7F938E0F-8F43-48EE-BBA8-0DE6F5238C8D}
[2012/06/20 13:25:22 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{A20DE781-FA0A-4D09-AA1B-9E91043F0A48}
[2012/06/20 13:24:49 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{414D82B2-8FAA-4366-968A-C79AA13AD4DB}
[2012/06/20 13:21:21 | 000,000,000 | ---D | C] -- C:\Windows\en
[2012/06/20 13:19:01 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{638CB385-4E3C-4DDF-A04C-B06110B95ACC}
[2012/06/20 13:18:27 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{EC93710E-5F45-4A88-B825-2F361EBC36A4}
[2012/06/19 15:50:56 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{9E69DE35-C9D7-4674-AD70-2273844957B5}
[2012/06/19 15:50:24 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{25DD17FC-824D-49C9-8465-3C1253552915}
[2012/06/18 15:28:18 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{3B3ED46F-EBCF-4D84-AC05-7B59375ED611}
[2012/06/17 22:24:13 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{4E32EF7C-80F1-466E-A0EB-F8B3DE014EAF}
[2012/06/16 18:57:38 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{D6B81E3B-A225-47ED-AE2B-77569FCA1180}
[2012/06/14 20:12:57 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{03DED491-F596-45B7-83E3-008E603BA87C}
[2012/06/14 20:12:33 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{257C78DF-5A1A-4EE3-B390-4693C989DCCE}
[2012/06/14 02:24:05 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{257EAE8E-4ADB-4608-8722-9D63A4EC32F9}
[2012/06/14 02:23:43 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{F4032FCE-8B5D-4A85-AA1D-810D06B467A0}
[2012/06/13 13:05:51 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{660C9A8E-F4A6-4A79-BAA4-CC21A4E3926D}
[2012/06/13 13:05:39 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{9658A3DB-5832-49B3-9731-F0DB896BD980}
[2012/06/13 02:42:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\NVIDIA Corporation
[2012/06/13 02:40:44 | 000,000,000 | ---D | C] -- C:\Users\Geremy\Documents\FX Composer 2
[2012/06/13 02:40:06 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\NVIDIA Corporation
[2012/06/13 02:39:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python 2.4
[2012/06/13 02:39:44 | 000,000,000 | ---D | C] -- C:\Python24
[2012/06/12 20:01:31 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{96E0E45F-9012-4A99-9262-1AADC2D48367}
[2012/06/12 20:01:10 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{64571201-6773-4E1B-91B7-535FFF475157}
[2012/06/12 20:00:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AIM
[2012/06/12 20:00:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Software Update Utility
[2012/06/11 21:15:40 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{325BE52B-08F5-4B20-9BAD-57911A251349}
[2012/06/11 21:15:18 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{F4777474-C6C4-48A7-A1BB-5BBD542BEEEC}
[2012/06/10 12:03:20 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{E92691E0-D411-4F25-AA90-4CC147F951C3}
[2012/06/10 12:02:59 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{5C36DA0F-C4A1-4444-843E-FC48BB6E5859}
[2012/06/09 19:07:46 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{DC23FC4B-80A2-4387-B6F3-810114A6B012}
[2012/06/09 19:07:25 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{CBBFB753-B711-469C-8AFF-D72157CE963B}
[2012/06/08 23:13:37 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{96F70C3E-B94B-46B5-9D6E-91D7D000836B}
[2012/06/08 23:13:12 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{4BAA9FBE-EE21-4033-A1FB-EF0F99B1AE46}
[2012/06/07 20:03:32 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{D85E649C-6738-4DCB-885B-8182DC02C4C5}
[2012/06/07 20:03:08 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{34B38445-F731-4CE9-B788-067F94033EE6}
[2012/06/05 19:22:59 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{8E651E0C-5A15-4073-98DD-FB8157C76917}
[2012/06/05 19:22:36 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{57FD4A32-A41F-4A9A-82FF-A0ADF632DF24}
[2012/06/04 18:25:43 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{ADD7099E-4BA3-490C-B07E-6E73BDE4A4F4}
[2012/06/04 18:25:21 | 000,000,000 | ---D | C] -- C:\Users\Geremy\AppData\Local\{5260D42D-095F-433F-ACAC-8534992E36F5}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/04 15:17:59 | 000,014,832 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/04 15:17:59 | 000,014,832 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/04 15:15:11 | 000,782,528 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/07/04 15:15:11 | 000,669,062 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/07/04 15:15:11 | 000,127,738 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/07/04 15:13:31 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Geremy\Desktop\OTL.exe
[2012/07/04 15:10:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/04 15:09:40 | 2146,045,951 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/04 15:01:53 | 010,063,000 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Geremy\Desktop\mbam-setup-1.61.0.1400.exe
[2012/07/04 14:20:03 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/07/04 14:09:33 | 004,571,247 | R--- | M] (Swearware) -- C:\Users\Geremy\Desktop\ComboFix.exe
[2012/07/03 21:11:11 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/07/03 21:10:38 | 000,789,382 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/07/03 20:52:50 | 000,007,597 | ---- | M] () -- C:\Users\Geremy\AppData\Local\Resmon.ResmonCfg
[2012/06/28 18:16:16 | 000,033,939 | ---- | M] () -- C:\Users\Geremy\.recently-used.xbel
[2012/06/23 19:05:17 | 000,008,929 | ---- | M] () -- C:\Users\Geremy\Desktop\CBS_EP02_SCRIPT_V02.rtf
[2012/06/23 05:17:41 | 001,827,840 | ---- | M] () -- C:\Users\Geremy\Desktop\Sal.fla
[2012/06/22 16:37:30 | 000,003,591 | ---- | M] () -- C:\Users\Geremy\Desktop\LovelyDeanna.jpg
[2012/06/21 23:08:17 | 000,000,096 | ---- | M] () -- C:\Users\Geremy\.gtk-bookmarks
[2012/06/20 23:56:37 | 000,004,096 | ---- | M] () -- C:\Users\Geremy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/06/16 02:51:52 | 000,000,900 | ---- | M] () -- C:\Users\Public\Desktop\Nexus Mod Manager.lnk
[2012/06/13 13:45:21 | 000,959,216 | ---- | M] () -- C:\Users\Geremy\Desktop\PQA_Scratch.mp3
[2012/06/13 13:02:07 | 004,888,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/13 02:43:18 | 000,002,204 | ---- | M] () -- C:\Users\Public\Desktop\NVIDIA FX Composer 2.5.lnk
[2012/06/13 02:42:22 | 000,151,552 | ---- | M] () -- C:\Windows\SysWow64\nvRegDev.dll
[2012/06/12 23:36:38 | 432,553,323 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/06/12 20:00:52 | 000,001,114 | -H-- | M] () -- C:\IPH.PH
[2012/06/12 20:00:49 | 000,001,945 | ---- | M] () -- C:\Users\Geremy\Application Data\Microsoft\Internet Explorer\Quick Launch\AIM.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/04 13:14:49 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/07/04 13:14:49 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/07/04 13:14:49 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/07/04 13:14:49 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/07/04 13:14:49 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/07/03 21:10:42 | 000,001,925 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012/07/03 20:52:50 | 000,007,597 | ---- | C] () -- C:\Users\Geremy\AppData\Local\Resmon.ResmonCfg
[2012/06/28 18:16:16 | 000,033,939 | ---- | C] () -- C:\Users\Geremy\.recently-used.xbel
[2012/06/23 19:05:14 | 000,008,929 | ---- | C] () -- C:\Users\Geremy\Desktop\CBS_EP02_SCRIPT_V02.rtf
[2012/06/22 19:25:11 | 001,827,840 | ---- | C] () -- C:\Users\Geremy\Desktop\Sal.fla
[2012/06/22 16:37:30 | 000,003,591 | ---- | C] () -- C:\Users\Geremy\Desktop\LovelyDeanna.jpg
[2012/06/21 23:08:17 | 000,000,096 | ---- | C] () -- C:\Users\Geremy\.gtk-bookmarks
[2012/06/13 13:45:18 | 000,959,216 | ---- | C] () -- C:\Users\Geremy\Desktop\PQA_Scratch.mp3
[2012/06/13 02:43:18 | 000,002,204 | ---- | C] () -- C:\Users\Public\Desktop\NVIDIA FX Composer 2.5.lnk
[2012/06/13 02:38:20 | 000,151,552 | ---- | C] () -- C:\Windows\SysWow64\nvRegDev.dll
[2012/03/06 00:50:35 | 000,004,096 | ---- | C] () -- C:\Users\Geremy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/19 13:40:09 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2011/12/19 02:32:34 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2011/11/06 01:57:35 | 000,000,600 | ---- | C] () -- C:\Users\Geremy\AppData\Local\PUTTY.RND
[2011/11/06 01:44:51 | 000,000,600 | ---- | C] () -- C:\Users\Geremy\AppData\Roaming\winscp.rnd
[2011/10/10 01:16:20 | 000,044,968 | ---- | C] () -- C:\Users\Geremy\BadElbows.jpg
[2011/05/20 22:35:28 | 000,304,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011/03/18 02:17:38 | 000,190,464 | ---- | C] () -- C:\Windows\SysWow64\PCGW32.DLL
[2011/02/01 02:16:06 | 000,789,382 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/10/22 21:34:22 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/10/12 14:31:23 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini

========== LOP Check ==========

[2011/02/04 04:16:00 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\.BitTornado
[2011/11/08 02:01:16 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\.minecraft
[2011/04/30 01:25:38 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\.Nitrous
[2010/10/19 23:55:50 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\acccore
[2011/01/04 22:03:24 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\Blender Foundation
[2012/03/05 23:09:54 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2010/12/16 22:17:37 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\crawl
[2011/02/12 12:09:39 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\DAEMON Tools Pro
[2012/07/03 21:36:24 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\Dropbox
[2011/09/11 20:29:38 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\FileZilla
[2012/06/25 21:34:08 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\gtk-2.0
[2012/01/27 17:53:01 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\HackSlashLoot
[2011/03/18 02:17:36 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\iZ3D Driver
[2011/06/21 23:07:32 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\Leadertech
[2012/02/16 22:26:12 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\MonoDevelop-2.8
[2011/03/01 17:15:45 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\NBOS
[2011/09/25 04:07:41 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\NetMedia Providers
[2011/01/12 16:57:35 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\OpenOffice.org
[2012/05/17 17:54:06 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\Publish Providers
[2011/01/09 20:48:34 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\runic games
[2011/09/25 04:07:40 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\Sony
[2011/01/24 06:44:23 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\SPORE
[2012/02/16 22:25:46 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\stetic
[2011/02/03 18:25:02 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\TGCStore
[2011/06/13 01:52:04 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\Unity
[2011/06/08 22:45:45 | 000,000,000 | ---D | M] -- C:\Users\Geremy\AppData\Roaming\ValuSoft
[2012/01/16 18:51:17 | 000,032,600 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >

 

[Geremy Walker]

And here is the Extras report from OTL

OTL Extras logfile created on: 7/4/2012 3:15:18 PM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Geremy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

8.00 Gb Total Physical Memory | 6.51 Gb Available Physical Memory | 81.37% Memory free
15.99 Gb Paging File | 14.49 Gb Available in Paging File | 90.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1863.01 Gb Total Space | 1658.67 Gb Free Space | 89.03% Space Free | Partition Type: NTFS
Drive F: | 7.45 Gb Total Space | 0.18 Gb Free Space | 2.35% Space Free | Partition Type: FAT32
Drive H: | 3.00 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: GALKA | User Name: Geremy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-3766927083-367389019-4167597906-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{0F7861E5-3B24-33CA-AECF-B5477194CEEB}" = Windows Phone Emulator x64 - ENU
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{26A24AE4-039D-4CA4-87B4-2F86416025FF}" = Java(TM) 6 Update 25 (64-bit)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{446EE0D9-1F6B-42BF-8278-8D0B172BA15D}" = Microsoft IntelliType Pro 8.1
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{5E11C972-1E76-45FE-8F92-14E0D1140B1B}" = iTunes
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{94D5B25E-194F-AF08-E444-F51FC2038DE5}" = ATI Catalyst Install Manager
"{94D70749-4281-39AC-AD90-B56A0E0A402E}" = Microsoft Visual C++ 2010 x64 Runtime - 10.0.30319
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}" = Microsoft Security Client
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 275.33
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 275.33
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 275.33
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 275.33
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.3.5
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.2.23.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BCA26999-EC22-3007-BB79-638913079C9A}" = Microsoft Visual Studio 2010 Express Prerequisites x64 - ENU
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}" = Microsoft SQL Server Compact 3.5 SP2 x64 ENU
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"6af12c54-643b-4752-87d0-8335503010de_is1" = Nexus Mod Manager
"73FD19362E6859FFE6809FB2DB7CE2C694F9BC75" = Windows Driver Package - libusb-win32 (libusb0) libusb-win32 devices (10/02/2010 1.2.2.0)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft IntelliType Pro 8.1" = Microsoft IntelliType Pro 8.1
"Microsoft Security Client" = Microsoft Security Essentials
"sp6" = Logitech SetPoint 6.20
"Wacom Tablet Driver" = Wacom Tablet
"WinRAR archiver" = WinRAR archiver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{01C79EF3-DE84-4B56-B638-8BEA0D507506}" = Microsoft XNA Game Studio 4.0 (XnaLiveProxy)
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{05855322-BE43-41FE-B583-D3AE0C326D58}" = Microsoft Silverlight 4 SDK
"{0666E46E-A860-4353-BE6D-13AA72FABB57}" = Microsoft XNA Game Studio Platform Tools
"{08C84CC6-E7FD-4B2D-BBF9-B02CC90EE031}" = Microsoft XNA Game Studio 4.0 (Shared Components)
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{09DF00E6-520C-49D5-B7E0-9612165CACA8}" = OpenOffice.org 3.2
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{0FCDA0F8-F3E5-402E-B9B6-13CB2B01182B}" = TERA
"{112C23F2-C036-4D40-BED4-0CB47BF5555C}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
"{14DD7530-CCD2-3798-B37D-3839ED6A441C}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1C997E1C-5CE9-4AF3-AAA9-DC65E6090827}" = Microsoft Expression Blend SDK for Silverlight 4
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FD86C78-3364-47BE-A380-A1F72ADF13AB}" = Extends
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2168245A-B5AD-40D8-A641-48E3E070B5B6}" = Adobe Flash CS4 STI-en
"{21D28067-524A-4D84-95BA-ACDCA8F3A7C8}" = Dark Basic Games
"{23D683DD-93C6-48E6-B84E-78B57778F126}" = Oblivion - Construction Set
"{256E7DAC-9BE8-494E-8DE7-7857BF96B774}" = Microsoft Expression Blend 3 SDK
"{26A24AE4-039D-4CA4-87B4-2F83216025F0}" = Java(TM) 6 Update 25
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{2A2F3AE8-246A-4252-BB26-1BEB45627074}" = Microsoft SQL Server System CLR Types
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2BD5C305-1B27-4D41-B690-7A61172D2FEB}" = Macromedia Flash 8
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2C3AB990-1F33-3D6B-9F34-8D5189FA04D3}" = Windows Phone 7 Add-in for Visual Studio 2010 - ENU
"{30BEF9F2-CD3F-4B13-9E5C-BFE2F9544572}_is1" = iZ3D Driver Remove
"{32939827-d8e5-470a-b126-870db3c69fdf}" = Python 2.7.1
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{33C61C53-2449-4C30-B8BB-E2FBAB0E25BE}" = Cartography Shop
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3C522702-5500-4043-8393-75995B3065D8}" = Dark AI Expansion Pack
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3DADD6A2-9D2C-4CE9-A54F-237713CD1056}" = Tree Magik
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{3F4EB5FE-B5BE-4069-A5A8-6D9262E1B379}" = Microsoft XNA Game Studio 4.0 Documentation
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{48413BF3-5934-4ED3-8F1B-49D250BBF5AC}" = Prison Tycoon 4
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C6D5779-A766-45DF-9938-D6F595A66F2B}" = Microsoft Expression Blend 4
"{4E968D9C-21A7-4915-B698-F7AEB913541D}" = Microsoft SQL Server 2008 R2 Management Objects
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{550B72C4-F404-4812-971F-947E835A877E}" = Gtk# for .Net 2.12.10
"{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}" = Macromedia Extension Manager
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{558358E5-E4F3-4374-BA1D-26FF39EF87D9}" = Microsoft Silverlight Tools for Visual Studio 2010
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{59F24743-2EA1-3A45-B8C2-6E0E1E078FA8}" = Microsoft Visual C# 2010 Express - ENU
"{5DDF31D2-63BB-4268-895B-FB05A82A1C00}" = Microsoft XNA Game Studio 4.0 Windows Phone Extensions
"{5EE6E987-1B79-4A93-832B-27472C7D1579}" = WPF Toolkit February 2010 (Version 3.5.50211.1)
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{60E2C8C9-6CF3-4B1A-9618-E304946C94E6}" = Python 2.4.4
"{6151cf20-0bd8-4023-a4a0-6a86dcfe58e5}" = Python 2.6.6
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63CEA2E4-4FE7-4F2C-B388-C1313D24157C}" = SPORE™ Galactic Adventures
"{65761BAE-11E8-48FE-B30F-1F01011AB906}" = The Sims™ 3 Create a World Tool - Beta
"{662CFD19-EA80-4EFE-A0D8-EE10EFEB3C83}" = Livestream Procaster
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68BD57D3-D606-411E-A7E0-3EB6EA5660F6}" = Microsoft XNA Game Studio 4.0 (Redists)
"{69E11501-75F7-4ACE-8103-52513DDCFE26}" = Microsoft Expression Blend SDK for Windows Phone 7
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A92A0EA-FAC4-41F6-941F-291D816A8380}" = Plant Life
"{6B6383FE-C0CE-479A-BDDF-BD34579B676A}" = NVIDIA FX Composer 2.5
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7184D1DD-C27C-4873-9A0A-96BB75607859}" = MonoDevelop 2.8.6.4
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73BE04D9-BA0E-4BAF-9C9D-677278BDB3DC}" = Microsoft XNA Game Studio 4.0 (ARP entry)
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{793D1D88-6141-43DE-BE58-59BCE31B4090}" = Adobe Flash CS4 Extension - Flash Lite STI en
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7FB413C8-3CAD-49F7-A67C-6EFEB4B04050}" = LogMeIn Hamachi
"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{86978C43-3277-4790-8EE4-228AE1078292}" = Styx
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}" = Macromedia Flash 8 Video Encoder
"{8C496FBF-DB4A-468D-A3A1-15E127382218}" = Microsoft XNA Game Studio 4.0 (Visual Studio)
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8EC28FBE-59C4-4FBC-B707-F8FDAE3CCAEE}" = Dark Physics Expansion Pack
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9607E1D7-1DCB-4BD1-A97E-4CC3AC03C2A4}" = Game Creator Store
"{969E11AA-8F3A-F162-1A5A-0965E216B6CE}" = Adobe Download Assistant
"{9769365A-CCB5-4E36-8803-042DA23C30CA}" = Dark Basic Professional
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B3A1C97-A361-463E-8817-444F9F88CDFE}" = Microsoft Expression Blend SDK for .NET 4
"{9B700657-676B-4A98-8B25-40A1BAC81033}" = Nero 8 Essentials
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{A29C5DD5-B21E-474F-AA96-6A7FC0B2B248}" = Microsoft Expression Blend 4 Add-in for Adobe FXG Import
"{A589DA26-51BD-475D-8C32-E19E34145842}" = Camtasia Studio 6
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.5
"{AC992524-6A93-43FE-9857-400BCCA8C98F}" = Dark Shader Runtime
"{B0121241-EE0F-462F-9E22-6A47EFA17309}" = Dark Lights Expansion Pack
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B4552068-73FD-406A-816B-2196F4DFCF75}" = NVIDIA FX Composer 2.5 Shader Debugger plugin
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B86149D3-18A2-41FD-A153-60AF944E47FE}" = Microsoft Windows Phone 7 Developer Resources
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C07F8D75-7A8D-400E-A8F9-A3F396B49BB1}" = SPORE™ Creepy & Cute Parts Pack
"{C28DD992-5B7B-D195-6841-4EC57DF512BD}" = Adobe Story
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C89DE306-8663-4EA3-8312-04A750AB48B6}" = DarkVOICES for DBPro
"{CB04D8E1-7B9C-4F35-B2E2-E87CBE520805}" = Adobe After Effects CS5.5
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFB91CB0-17D9-44EB-BFB2-5307AB7E7DDC}" = Microsoft Visual Studio 2010 Express for Windows Phone - ENU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D20EDBD1-05A4-49B5-AAD9-D8CFA22BB40E}" = DarkMATTER
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DC52AB52-E958-4734-826D-929413F31F73}" = Dark Physics Projects
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E5FCED12-3E77-4C0E-A305-5AEB38A52A70}" = AdobeColorCommonSetCMYK
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EED50C97-C79E-4149-BD82-7C5A22437708}" = Adobe Setup
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F20C1251-1D0A-4944-B2AE-678581B33B19}" = Neverwinter Nights 2
"{F2C4E6E0-EB78-4824-A212-6DF6AF0E8E82}" = FINAL FANTASY XIV
"{F6E08D2D-8CE0-4223-A76E-B25CAC5A4040}" = Dark Shader
"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FBCED1D8-E731-42B7-AD49-A291175BAA1B}" = ACID Pro 7.0
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_a68eec966ce913ddaa63251dc82ed31" = Adobe Flash CS4 Professional
"AIM_7" = AIM 7
"Akamai" = Akamai NetSession Interface
"BitTornado" = BitTornado 0.3.17
"Blend_4.0.20901.0" = Microsoft Expression Blend 4
"BlenderNIFScripts" = Blender NIF Scripts (remove only)
"BlueGUI 2" = BlueGUI 2
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.AdobeStory.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Story
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"Crawl" = Dungeon Crawl Stone Soup
"DAEMON Tools Pro" = DAEMON Tools Pro
"Desura" = Desura
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"DVS Guitar_is1" = DVS Guitar v1.04
"FileZilla Client" = FileZilla Client 3.5.1
"Fractal Mapper_is1" = Fractal Mapper v8.10f
"GoldWave v5.58" = GoldWave v5.58
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"KoolMoves Demo_is1" = KoolMoves Demo 8.0.0
"Legend of Grimrock" = Legend of Grimrock
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Microsoft Visual C# 2010 Express - ENU" = Microsoft Visual C# 2010 Express - ENU
"Microsoft Visual Studio 2010 Express for Windows Phone - ENU" = Microsoft Windows Phone Developer Tools - ENU
"Mozilla Firefox 13.0.1 (x86 en-GB)" = Mozilla Firefox 13.0.1 (x86 en-GB)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NifSkope" = NifSkope (remove only)
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Oblivion mod manager_is1" = Oblivion mod manager 1.1.12
"Origin" = Origin
"particleIllusionSE 2.0.5 full version_is1" = particleIllusion SE 2.0.5
"PuTTY_is1" = PuTTY version 0.61
"PyFFI" = PyFFI 2.1.8
"Raptureres" = Rapture Resource Manager
"Runic Games Torchlight" = Torchlight
"Sifteo-SDK-1_1_2" = Sifteo SDK 1.1.2
"Siftrunner" = Siftrunner 1.1.4
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Star Trek Online" = Star Trek Online
"Steam App 105600" = Terraria
"Steam App 107100" = Bastion
"Steam App 200900" = Cave Story+
"Steam App 202480" = Creation Kit
"Steam App 39250" = FINAL FANTASY XI: Ultimate Collection - Abyssea Edition
"Steam App 70300" = VVVVVV
"Steam App 72850" = The Elder Scrolls V: Skyrim
"VocoderGUI" = Zerius Vocoder (remove only)
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite" = Windows Live Essentials
"winscp3_is1" = WinSCP 4.3.2
"XNA Game Studio 4.0" = Microsoft XNA Game Studio 4.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3766927083-367389019-4167597906-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"87df300ab8d6247f" = TownseedAlpha
"Dropbox" = Dropbox
"GoToMeeting" = GoToMeeting 4.5.0.457

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 7/3/2012 8:34:03 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 8:34:03 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 8:34:04 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 8:34:04 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 8:34:05 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 8:34:05 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 8:34:05 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 8:34:06 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 8:34:06 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 8:34:07 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 8:34:07 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 8:34:11 PM | Computer Name = GALKA | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

[ System Events ]
Error - 7/4/2012 12:26:47 PM | Computer Name = GALKA | Source = Service Control Manager | ID = 7023
Description = The Windows Defender service terminated with the following error:
%%126

Error - 7/4/2012 12:35:25 PM | Computer Name = GALKA | Source = Service Control Manager | ID = 7023
Description = The Akamai NetSession Interface service terminated with the following
error: %%126

Error - 7/4/2012 1:16:05 PM | Computer Name = GALKA | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 7/4/2012 1:17:55 PM | Computer Name = GALKA | Source = Application Popup | ID = 1060
Description = \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility
with this system. Please contact your software vendor for a compatible version
of the driver.

Error - 7/4/2012 1:17:55 PM | Computer Name = GALKA | Source = Application Popup | ID = 1060
Description = \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility
with this system. Please contact your software vendor for a compatible version
of the driver.

Error - 7/4/2012 1:18:17 PM | Computer Name = GALKA | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 7/4/2012 1:19:55 PM | Computer Name = GALKA | Source = Service Control Manager | ID = 7023
Description = The Akamai NetSession Interface service terminated with the following
error: %%126

Error - 7/4/2012 1:19:56 PM | Computer Name = GALKA | Source = Service Control Manager | ID = 7023
Description = The Windows Defender service terminated with the following error:
%%126

Error - 7/4/2012 1:26:35 PM | Computer Name = GALKA | Source = Service Control Manager | ID = 7023
Description = The Akamai NetSession Interface service terminated with the following
error: %%126

Error - 7/4/2012 2:10:50 PM | Computer Name = GALKA | Source = Service Control Manager | ID = 7023
Description = The Akamai NetSession Interface service terminated with the following
error: %%126


< End of report >

 

[Broni]

OTL logs look good

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

• Double-click SecurityCheck.exe
• Follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  
  NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

3. Download Temp File Cleaner (TFC)

• Double click on TFC.exe to run the program.
• Click on Start button to begin cleaning process.
• TFC will close all running programs, and it may ask you to restart computer.

4. Please run a free online scan with the ESET Online Scanner

• Disable your antivirus program
• Tick the box next to YES, I accept the Terms of Use
• Click Start
• Accept any security warnings from your browser.
• Check Scan archives
• Click Start
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, click on List of found threats
• Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• NOTE. If Eset won't find any threats, it won't produce any log.

 

[Geremy Walker]

Security check report

Results of screen317's Security Check version 0.99.24
Windows 7 x64 (UAC is enabled)
Internet Explorer 8 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Java(TM) 6 Update 25
Java(TM) 6 Update 31
Out of date Java installed!
Adobe Flash Player 11.3.300.257
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
Microsoft Security Essentials msseces.exe
``````````End of Log````````````

 

[Geremy Walker]

Farbar Service Scanner report

Farbar Service Scanner Version: 02-07-2012
Ran by Geremy (administrator) on 04-07-2012 at 16:02:54
Running from "C:\Users\Geremy\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============
BITS Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to retrieve start type of BITS. The value does not exist.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

 

[Geremy Walker]

That last one took a really long time, but here is the report.

C:\FRST\Quarantine\{4308a726-4453-1462-f29a-c04da33cd417}\n Win64/Sirefef.W trojan cleaned by deleting - quarantined

 

[Broni]

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it.

• Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Do NOT post JavaRa log.

======================================

We have some issue with Windows updates due to a corrupted registry key.

Following steps involve registry editing. Please create new restore point before proceeding!!!
How to:
XP - http://support.microsoft.com/kb/948247
Vista and Seven - http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/

Download Seven.zip file from here: http://www.smartestcomputing.us.com/files/download/9-registry-network-keys/
Unzip the file.
You'll find several files inside.
Double click on bits.reg file and confirm the prompt.
Restart computer.
Post new FSS log.

 

[Geremy Walker]

I've completed the steps and run FSS a second time. Here is the log.

Farbar Service Scanner Version: 02-07-2012
Ran by Geremy (administrator) on 05-07-2012 at 04:03:39
Running from "C:\Users\Geremy\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

 

[Broni]

Registry keys are fine but we still have couple of services not running.

Download Windows Repair (all in one) from this site

Install the program then run

Go to step 2 and allow it to run Disc check

Once that is done then go to step 3 and allow it to run SFC

On the the Start Repairs tab click Start button.

Please ensure that items seen in the image below are ticked as indicated:

Click on box next to the Restart System when Finished. Then click on Start

Post new FSS log.

 

[Geremy Walker]

Steps completed with the all in one tool. FSS log three follows.

Farbar Service Scanner Version: 02-07-2012
Ran by Geremy (administrator) on 05-07-2012 at 16:50:12
Running from "C:\Users\Geremy\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv: "C:\Windows\system32\wuaueng.dll".


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

 

[Broni]

Good job

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

13. Please, let me know, how your computer is doing.

 

[Geremy Walker]

OTL log follows.

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Geremy
->Temp folder emptied: 107194 bytes
->Temporary Internet Files folder emptied: 33175 bytes
->Java cache emptied: 2027 bytes
->FireFox cache emptied: 72152404 bytes
->Flash cache emptied: 602 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 23748 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 69.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Geremy
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Geremy
->Java cache emptied: 0 bytes

User: Public

User: UpdatusUser

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.53.1 log created on 07052012_224747

Files\Folders moved on Reboot...
C:\Users\Geremy\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\Geremy\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...

Proceeding with the rest of the instructions now.

 

[Geremy Walker]

Everything seems to be running fine at this point. I am downloading the newest bundle from Windows Update and applying it now, but there doesn't seem to be any trace of the issue from before.