Solved Patched.b.gen.trojan, quarantined but not removed

hrabbit · Jun 30, 2012

Hello! I've been using ESET for years and never had a major problem with a virus before. Today however I noticed that the patched.B.gen.trojan had been spotted by my anti virus, but it was unable to delete and it's just sitting quarantined right now. Through google searches, I've come to find out that this is quite a serious virus and I have no idea how to get rid of it! I'm running on windows 7 and any help with my problem would be appreciated.

Broni · Jun 30, 2012

Welcome aboard

Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running tools or applying updates other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

hrabbit · Jul 1, 2012

Alright, so I ran all of the scans requested. Everything ran smoothly and the computer is still running great besides the constant messages from ESET telling me it can't delete the trojan. Also I'm posting the gmer, but it looks strange with all the question marks. Is it supposed to look like that?
-Thank you for the help
[CENTER] [/CENTER]
[CENTER] [/CENTER]
[CENTER]----------------------------------DDS SCAN--------------------------------[/CENTER]

[LEFT]DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_31
Run by Hrabbit at 22:20:51 on 2012-06-30
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4087.2452 [GMT -7:00]
.
AV: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\nvvsvc.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\windows\system32\nvvsvc.exe
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe
C:\windows\SysWOW64\PnkBstrA.exe
c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Hanna\Local Settings\Apps\F.lux\flux.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Lenovo\OnekeyDM\OnekeyDM.exe
C:\Program Files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe
C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Common Files\Steam\SteamService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGService.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\vssvc.exe
C:\windows\System32\svchost.exe -k swprv
C:\windows\system32\DllHost.exe
C:\windows\system32\DllHost.exe
C:\windows\SysWOW64\cmd.exe
C:\windows\system32\conhost.exe
C:\windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://www.lenovo.com
mStart Page = hxxp://lenovo.live.com/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=userinit.exe,
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
BHO: FlashFXP Helper for Internet Explorer: {e5a1691b-d188-4419-ad02-90002030b8ee} - C:\PROGRA~2\FlashFXP\IEFlash.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [F.lux] "C:\Users\Hanna\Local Settings\Apps\F.lux\flux.exe" /noshow
uRun: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
mRun: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go

\5.0"
mRun: [OnekeyDM] C:\Program Files (x86)\Lenovo\OnekeyDM\OnekeyDM.exe
mRun: [IdeaNotesUser] C:\Program Files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
mRun: [<NO NAME>]
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{10C01644-AD88-49B4-B76C-A73B3D3CFD18} : DhcpNameServer = 192.168.6.1 64.134.255.2 64.134.255.10
TCP: Interfaces\{C98408E1-5DF1-417B-88CE-5E5167F6DDE7} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{C98408E1-5DF1-417B-88CE-5E5167F6DDE7}\2656C6B696E6E2638363 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{C98408E1-5DF1-417B-88CE-5E5167F6DDE7}\9402D414445402944512 : DhcpNameServer = 192.168.254.254 192.168.254.254
TCP: Interfaces\{C98408E1-5DF1-417B-88CE-5E5167F6DDE7}\A516D6F62716 : DhcpNameServer = 192.168.254.254 192.168.254.254
TCP: Interfaces\{C98408E1-5DF1-417B-88CE-5E5167F6DDE7}\A516D6F6271623 : DhcpNameServer = 192.168.254.254 192.168.254.254
TCP: Interfaces\{C98408E1-5DF1-417B-88CE-5E5167F6DDE7}\C65736B697 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{C98408E1-5DF1-417B-88CE-5E5167F6DDE7}\C696E6B6379737 : DhcpNameServer = 75.75.75.75 75.75.76.76
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-X64: 0x1 - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-X64: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: Google Gears Helper: {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
BHO-X64: Google Gears Helper - No File
BHO-X64: FlashFXP Helper for Internet Explorer: {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~2\FlashFXP\IEFlash.dll
BHO-X64: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: SmartSelect - No File
TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
mRun-x64: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink

\Power2Go\5.0"
mRun-x64: [OnekeyDM] C:\Program Files (x86)\Lenovo\OnekeyDM\OnekeyDM.exe
mRun-x64: [IdeaNotesUser] C:\Program Files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe
mRun-x64: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
mRun-x64: [(Default)]
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Hanna\AppData\Roaming\Mozilla\Firefox\Profiles\tybajjr6.default\
FF - prefs.js: browser.search.selectedEngine - Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.sitfy.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=bJ2hy9lp&q=
FF - component: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn\components\WCFirefox3Extn.dll
FF - component: C:\Program Files (x86)\Google\Google Gears\Firefox\lib\ff36\gears.dll
FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordlegacyext.dll
FF - plugin: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
---- FIREFOX POLICIES ----
.
FF - user.js: browser.search.selectedEngine - Search
FF - user.js: keyword.URL - hxxp://www.sitfy.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=bJ2hy9lp&q=
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
============= SERVICES / DRIVERS ===============
.
R1 funfrm;funfrm;C:\windows\system32\drivers\funfrm.sys --> C:\windows\system32\drivers\funfrm.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]
R2 DDNIMSGService;DDNIMSGService;C:\Program Files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGService.exe [2009-6-23 172720]
R2 eamonm;eamonm;C:\windows\system32\DRIVERS\eamonm.sys --> C:\windows\system32\DRIVERS\eamonm.sys [?]
R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-9-22 974944]
R2 IGRS;IGRS;C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [2009-7-14 38152]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-6-30 654408]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\windows\system32\DRIVERS\AcpiVpc.sys --> C:\windows\system32\DRIVERS\AcpiVpc.sys [?]
R3 enecir;ENE CIR Receiver;C:\windows\system32\DRIVERS\enecir.sys --> C:\windows\system32\DRIVERS\enecir.sys [?]
R3 enecirhid;ENE CIR HID Receiver;C:\windows\system32\DRIVERS\enecirhid.sys --> C:\windows\system32\DRIVERS\enecirhid.sys [?]
R3 enecirhidma;ENE CIR HIDmini Filter;C:\windows\system32\DRIVERS\enecirhidma.sys --> C:\windows\system32\DRIVERS\enecirhidma.sys [?]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;C:\windows\system32\DRIVERS\k57nd60a.sys --> C:\windows\system32\DRIVERS\k57nd60a.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\windows\system32\drivers\mbam.sys --> C:\windows\system32\drivers\mbam.sys [?]
R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\windows\system32\DRIVERS\NETw5s64.sys --> C:\windows\system32\DRIVERS\NETw5s64.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\windows\system32\drivers\nvhda64v.sys --> C:\windows\system32\drivers\nvhda64v.sys [?]
R3 usbsmi;Lenovo EasyCamera;C:\windows\system32\DRIVERS\SMIksdrv.sys --> C:\windows\system32\DRIVERS\SMIksdrv.sys [?]
R3 wdmirror;wdmirror;C:\windows\system32\DRIVERS\WDMirror.sys --> C:\windows\system32\DRIVERS\WDMirror.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 epfwwfpr;epfwwfpr;C:\windows\system32\DRIVERS\epfwwfpr.sys --> C:\windows\system32\DRIVERS\epfwwfpr.sys [?]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-5 135664]
S2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;C:\windows\System32\IgrsSvcs.exe -k IgrsSvcs --> C:\windows\System32\IgrsSvcs.exe -k IgrsSvcs [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-6-30 257224]
S3 Bridge0;Bridge0;C:\windows\system32\drivers\WDBridge.sys --> C:\windows\system32\drivers\WDBridge.sys [?]
S3 fssfltr;fssfltr;C:\windows\system32\DRIVERS\fssfltr.sys --> C:\windows\system32\DRIVERS\fssfltr.sys [?]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-5 135664]
S3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [2009-12-28 414984]
S3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [2009-12-28 472328]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-26 113120]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\windows\system32\DRIVERS\netw5v64.sys --> C:\windows\system32\DRIVERS\netw5v64.sys [?]
S3 PS_MDP;ReadyComm Presentation Space Helper Service;C:\windows\System32\IgrsSvcs.exe -k IgrsSvcs --> C:\windows\System32\IgrsSvcs.exe -k IgrsSvcs [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUStor.sys --> C:\windows\system32\Drivers\RtsUStor.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\system32\Drivers\usbaapl64.sys --> C:\windows\system32\Drivers\usbaapl64.sys [?]
S3 UsbGps;LGE Mobile USB GPS NMEA Port;C:\windows\system32\DRIVERS\lgx64gps.sys --> C:\windows\system32\DRIVERS\lgx64gps.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]
S3 wsvd;wsvd;C:\windows\system32\DRIVERS\wsvd.sys --> C:\windows\system32\DRIVERS\wsvd.sys [?]
.
=============== Created Last 30 ================
.
2012-07-01 02:51:02 -------- d-----w- C:\Users\Hanna\AppData\Roaming\Malwarebytes
2012-07-01 02:50:51 -------- d-----w- C:\ProgramData\Malwarebytes
2012-07-01 02:50:49 24904 ----a-w- C:\windows\System32\drivers\mbam.sys
2012-07-01 02:50:49 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-07-01 01:23:56 -------- d-sh--w- C:\windows\System32\%APPDATA%
2012-07-01 01:20:39 426184 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe
2012-07-01 00:55:12 9013136 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{CA1020A6-83A0-4E2D-B29D-5AC24A458C9F}\mpengine.dll
2012-06-19 18:40:44 -------- d-----w- C:\Users\Hanna\AppData\Roaming\local
2012-06-13 17:24:55 140288 ----a-w- C:\windows\System32\cryptnet.dll
2012-06-13 17:24:53 103936 ----a-w- C:\windows\SysWow64\cryptnet.dll
2012-06-07 05:01:45 770384 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-07 05:01:45 421200 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp100.dll
2012-06-05 19:57:58 274432 ----a-w- C:\windows\TLCUninstall.exe
2012-06-04 17:44:29 -------- d-----w- C:\Program Files\OT2
.
==================== Find3M ====================
.
2012-07-01 01:20:39 70344 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
============= FINISH: 22:21:37.69 ===============
[/LEFT]

[CENTER]--------------------------------------mmbam Scan-----------------------------[/CENTER]

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.07.01.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514

Protection: Enabled

6/30/2012 7:51:58 PM
mbam-log-2012-06-30 (19-51-58).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 227136
Time elapsed: 12 minute(s), 4 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Windows\Installer\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6}\U\800000cb.@ (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\Users\Hanna\AppData\Local\Temp\.exe (Trojan.Agent) -> Quarantined and deleted successfully.

(end)

hrabbit · Jul 1, 2012

[CENTER]-------------------------- GMER Scan ------------------------[/CENTER]

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-06-30 22:10:30
Windows 6.1.7601 Service Pack 1
Running: 2o2j7ox9.exe

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind ??????(?????????????????Ro??????45??????????????er??????????Microsoft???????????????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????6.1.7600.16385?.?.??? ?????????????????????0????????.???????????????????????????????????????? ?????????????????????0????????????????????@nettun.inf,%msft%;Microsoft?.????`??????????????????????/??????????*6to4mp??.??? ?????????????????????0????????????????????? ?????????????????????0?????????????????????????????????????/???/???????????/???/??*6to4mp??/??? ?????????????????????0????????????????????? ?????????????????????0?????????????????????????????????????/???/???????????/???/??? ?????????????????????0????????????&????????????????????/??? ?????????????????????0????????????????????????????? ?????????????????????0????????~????????????????????????????0???0????~??????0???0??nettun.inf:Microsoft.NTamd64:6to4mp.ndi:6.1.7600.16385:*6to4mp?0?0???????????D??????????dr??????????? ?????????ter??????????????????????????????? ???????@?????????????
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export ????????? ???????}????????????????????,?V?????????????????????????????????$?????? ???????????????????I??????????dl??Microsoft????????????????o??? ???????s??????????????int??????????????u????????????????????????N?????????????????system32\DRIVERS\asyncmac.sys????????????????????????B???????????????????f???e??nettun.inf??????Siren Digital Audio Player??????????????Microsoft???????????????????????{023D4B6F-3E0D-4C25-B4B5-6A7DF97FAEC9}??39???????????????????B??Tc??STORAGE\VolumeSnapshot??????Net?e????????????????????????????????????-??5A??????????DataTraveler 2.0?0??10??6-21-2006????$???????6??????????????????????t????????%%?????6to4mp.ndi?7}????????????o??????il???d???????????????????????????????S????h??5??????????????????????84??????????? ???????d???????????????????????2??????????????????????????????nettun.inf:Microsoft.NTamd64:6to4mp.ndi:6.1.7600.16385:*6to4mp??????tunnel?T\*??? .?????????????????Microsoft 6to4 Adapter??????????????????????????????????????????????0c??? ?????????????????????0???????????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\2c8158b638fc
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Bind ?????n???????????l?k????.NTAMD64?D??? ???????j?????k?????j?????????????? ????????????????k??????????????? ???????k???????????z??????????N????????????d?f?j?I?j?k?h???????????????????????????????????????????????2???5???e??????????????????Microsoft??????k?&???j?k????????????System???b???????????????????5??????????????????????????ll????X?????? ???????????????????????????????l?l?2???????????????????k?k?k????X??????T???0??????????????????????CT???????????3???????????????????3???????????????4???????????????????????U?k?k?k?k?k?????l?l?l??ROOT\RDP_MOU????????\0??? ^??????O??????? ??WmBEnum?????PEAUTH?4?&??? P??k???????????????????????4?????s?4??????????????????????s???? ???k???e?????Res??UMB?????????????????????????????e????k?k?k??????????????????????????????????????? ???????j?????k?????j?????????????????????C?????????????"???????"??? ???????k???????????h??????????Z??????????????????????????sde?????????????????k?&?????????????????s??????????????N??k???4????D?????LegacyDriver?3???????????s??????Volume?????????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Route ?????????????????s??????????????? ???????s???????????n????????4????? ???????????????????????t????????s???s??System32\DRIVERS\netbt.sys???????s??????????? ???????n?????s????????????????V????????V????6??s?????????e?????????u??system32\drivers\ndis.sys???????26??????????????????????????????????????????.NT?o??????s?????s??????????????????????t???????26???s?s?s?s?s?s?s????????????????e?????*6to4mp??d??????????NDIS Usermode I/O Protocol??????system32\DRIVERS\netbios.sys?????????????????????????????????????????????7??t???1.00????? ???????s???????????m????????&????? ???????????????????????????????* ??? ???????n?????s?? ??s????????$?????????c???"%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe"????????? ????????????????s?????????n??????,??s?????????????????s????@%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193???????????????t???t??????s?????s??@%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundati
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Export ?????{???h?h?h??? ???j???r?????1?1??STORAGE\Volume???????????????4?e?????h??????????????? ???j??????????????????????{00000000-0000-0000-ffff-ffffffffffff}?0?????????????????????????h????????r?????? ???????h????????????????????????????????????s000??? ???????h???????????????????????????????f??? ???????h?????h???????0??L????????? ??????????????h???h???h????? ??? ???????h?????h???????0????????????&????????????????????a??? ???????h?????h???????0????????????????????? ???????h???????????h?0????????`?????????????????????????????`??h??????????@system32\drivers\pci.sys,#1536;PCI HOST Bridge????????h????? ???????h?????h???????0????????????&???????????????????????NO_DRV??????? ???????h?????h???????0????????????????????? ???????h???????????h?0?????????????????????????????????????????h??????????machine.inf:INTEL_SYS.NTamd64:NO_DRV:6.1.7601.17514

ci\ven_8086&dev_2c81????h?h???????h????? ???????h?????h???????0?????????????????????h?h????????? ???????h???????????h?0?????????????????????????????????????????h?????????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Bind ??????????$??n??????p????????? ?????tunnel?.?/???????????e??????????????????????11??????%SystemRoot%\system32\srvsvc.dll?????????4???????l??X/???k??????????????HidUsb??HD???k??? ???????j?????k?????k????????????.??????????0???????k???????e???k?l????? ???????k???????????z??????????P????????????????????????????????p?p?q??Net????????k?&??User Mode Driver Frameworks Platform Driver?? ???????k??????s????????I???8??????Microsoft???? z??k???????????????????????5??????? ??{8ECC055D-047F-11D1-A537-0000F8753ED1}???????l?los???k??????ta???k???l?l????? ???????j?????k?????j????????????/??????????0????X??k???????????k??? ???????k???????????z??????????P??????????????????????????s?????k??WUDFRd?????????k?&??{4d36e972-e325-11ce-bfc1-08002be10318}\0002?? ???????Z????????????????h??l?????g????{00000000-0000-0000-0000-000000000000}????????^??n???+?????e?+???k??? ???????j?????k?????k????????????D? ???????R??????k?&???????????9???9???????k??????? ??.NTAMD64??????N??k?????????D????WUDFRd???????k???????????????????l?l?????????4???%?
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Route ????a???????TA??????????????????6-21-2006???????????????????PCI_DRV????????z?????z???z??????????????v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=17|Profile=Domain|Profile=Public|LPort=3702|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=fdphost|Name=@FirewallAPI.dll,-32785|Desc=@FirewallAPI.dll,-32788|EmbedCtxt=@FirewallAPI.dll,-32752|??????v2.10|Action=Allow|Active=FALSE|Dir=Out|Protocol=17|Profile=Domain|Profile=Public|RPort=3702|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=fdphost|Name=@FirewallAPI.dll,-32789|Desc=@FirewallAPI.dll,-32792|EmbedCtxt=@FirewallAPI.dll,-32752|?????v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=17|Profile=Domain|Profile=Public|LPort=5355|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=dnscache|Name=@FirewallAPI.dll,-32801|Desc=@FirewallAPI.dll,-32804|EmbedCtxt=@FirewallAPI.dll,-32752|?????v2.10|Action=Allow|Active=FALSE|Dir=Out|Protocol=17|Profile=Domain|Profile=Public|RPort=5355|RA4=LocalSubne
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export ????????????????????????????e?????N??g????????D??????????.??????s???volsnap??N???$???d????????????????????????????N??f?????????D????System??????vwififlt?1??ms_ndiswanip????????????????????*6to4mp??A???????????f?f??????N??g?????????D????Windows Modules Installer????????????3????????X??g??????????Microsoft????????`?????????e?A??Wlansvc?????? *??`??????????e???Wireless Lan Service?????`?`?`???????`??????????Logoff??????ACYEREUE IDE Controller?iv???f?fos??t????????????????8??????????????????tunnel?8?8??????????????????????????{745a17a0-74d3-11d0-b6fe-00a0c90f57da}?0?????????????????????f?f????2&daba3ff&3???????N??????9????D1-5??Net??????????:??????????*6to4mp??????????????4???0???????z???I?k?k???`???????????????????????????????????A???????????b?f?????`??2be8bdbb-be09-499d-9a4b-4637e09ae00b?????f?f?????`???????????????????????????????????????????????????????????????? ??????????? ??????????????????????????????s???`???`?`?????`???`??????????????? ???????`???????????`????????>???????????e????????????????????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage@Bind ????????????????? P??????????????????????.??@oem6.inf,%customcollection%;HID-compliant device???Type?????????????????????????????????????8??????"????????????I???h???0?n?{?n?~?n?v??????????STORAGE\Volume??02???????l???`?`?h?e???s?z??????????????????!???????????????{6????????N??????c?????D49??@input.inf,%hid_device%;HID-compliant device????? ???????I??????????????????????HI???`?`?~?s???t?z??????????? ???????8?????U?U??USB??????????e??????????? ???????|?????????????0?????????????????????????W???c??????*6to4mp??6???????????????????????????n??????????????????????@nettun.inf,%msft%;Microsoft????ROOT\*6TO4MP\0021???{745a17a0-74d3-11d0-b6fe-00a0c90f57da}\0062?VI???????4??????@oem36.inf,%nvidia.devicedesc%;NVIDIA High Definition Audio? Definition Audio Device????tunnel??????Microsoft???*6to4mp??????????????????????:?????????d????????????????????????0????I?I????{4d36e96f-e325-11ce-bfc1-08002be10318}\0005? m??????????? p?????????????????????????? ???????E?????9-A??????????????????os?????????????@?????????D?????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage@Route ??????????????????????X??????f???t??????????????????????????????????????????????????????{4d36e97d-e325-11ce-bfc1-08002be10318}\0027?3b??tunnel???????????????4???????s????N??????E????D}????@machine.inf,%intel_mfg%;Intel??????{4d36e97d-e325-11ce-bfc1-08002be10318}\0041??????????d???????e??*6to4mp??l??????????ROOT\*6TO4MP\0049???tunnel???????????????5???5??????? P??????7?????7?7??? p??????.?????.?.??????41??????????????????????????55??????85??6-21-2006?@??&???????????????????????????????p?4?|?p????????????????6to4mp.ndi??????@machine.inf,%intel_mfg%;Intel??????@nettun.inf,%msft%;Microsoft?0??? ???3???.?????09f???????????????????????????????????????????????d???????????????????4????????????N??????3?????D4A????????????????????????????:?p?????????@??&???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????0??????E3????N??????0????D?????text?{????$??????_???????????????????????????????????????????????????????????????????????????????????????????b?
Reg HKLM\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage@Export ???t???????????????????????????????????????????????g???????r???r???r???s???s???s???s????? ???????s??????????????????????????????????????? ???????s?????s?????r???????? ?????????????? ???????s???????????????????? ?d???????????? ???????n?????s??????????????$???????????????n?????NetworkProvider?????????????????4???@%systemroot%\system32\wkssvc.dll,-100????????h??s????????h?????%SystemRoot%\System32\svchost.exe -k NetworkService???????????????????????????????N??s?????????n????@%systemroot%\system32\wkssvc.dll,-101??????? 8??s????????????????0????????????e?????????????????????????+??NT AUTHORITY\NetworkService??????????????????????????????d???.??s???????????????t??????? ????????????????????????????????????????s??????p????????}????<??s???????????e??Bowser?MRxSmb10?MRxSmb20?NSI??????????????????????????^???????????h??????s????,?????????????????.NT?????????????Plugplay????? ???????s???????????4???????????????????e????N??????T????D00???PnP Filter???????????????????????????????????????f?f?????????t?????????????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\NetBT\Linkage@Bind ????????nettun.inf?53???6to4mp.ndi?4?4??????????????????? ???????U???????????=?,????????$?^?<????????????????????????????????4????X??????T??????0???????????tunnel??????? ?????? ????????????=?,????????z??????4?4??????#????????????e???????????0??????????? ??t????E??????xS???????????4??0}??? ???????Z?????????????0????????????&???????????????????????? ?????????????????????0??????*?6??? ???????in??????e????0????????????6??????4??da??Local Area Connection* 101???????????????????????????????m??? ???????Z?????????????0????????????&???????????????????????? ?????????????????????0??????*?4??? ???????????Local Area Connection* 99?????????????4Local Area Connection* 101???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????4Microsoft 6to4 Adapter #93????????????????????????????????????????????????????????????????????????????????????????????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\NetBT\Linkage@Route ????????Type????? ???????7?????7?7????????????????????(??????t???t??*6to4mp??????????????????????7?????e?7???????t??????s?????????????????????8?????????????16??????????*6to4mp?10????????`?????????????????????????????????????? p??????9?????302????????????????????X?????????????????????????? ???????????????????????y??????? ???????5?????5?5??{4d36e972-e325-11ce-bfc1-08002be10318}?oso??{4d36e972-e325-11ce-bfc1-08002be10318}\0268?????Microsoft 6to4 Adapter #253??2??@nettun.inf,%msft%;Microsoft?????????4??int??????????????????????????????*??????????????@nettun.inf,%6to4mp.displayname%;Microsoft 6to4 Adapter?????{4d36e972-e325-11ce-bfc1-08002be10318}\0264?????????????????????11??????????????????????????????Microsoft 6to4 Adapter Driver?????N??????B?????DAE???? ?????????????????????????s???????????*6to4mp?????@nettun.inf,%6to4mp.displayname%;Microsoft 6to4 Adapter?EF??{00000000-0000-0000-FFFF-FFFFFFFFFFFF}?C9D??{4d36e972-e325-11ce-bfc1-08002be10318}?E-4??{4d36e972-e325-11ce-bfc1-08002be10318}\0269?? ??Microsoft 6to4
Reg HKLM\SYSTEM\CurrentControlSet\services\NetBT\Linkage@Export ?????????????/??????????????????????????????????????????{4d36e97d-e325-11ce-bfc1-08002be10318}\0005?ve????N??????1?????D4-??4-??????????????????????????.NT?_N???????e??wpdbusenum\fs???????????????????{4d36e97d-e325-11ce-bfc1-08002be10318}\0019?????1???5?????????????N??????d??????????? ???`???l???????????????;???D??s????????_???D???e???????????????W???????5??????????Microsoft????????????9??????23??????? ???????????????????????????????????????f??? ?????????????????????0??L????????? ???????????? ?????????????????????0????????????&???????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????volsnap.inf:MSFT.NTamd64:volume_snapshot_install:6.1.7600.16385:storage\volumesnapshot??????????????????????????????????????????????? ?????????????????????0???????????????????????????????????????????????????U???l???n????????????? ???s???????????????????????????????????????I??ll??????? ?????????????????????0??L????????? ???????????? ?????????????????????0????????????&??????????
Reg HKLM\SYSTEM\CurrentControlSet\services\Smb\Linkage@Bind ????????????7.??6to4mp.ndi?u?????????????????????????????????t???.??re??????????????????????6-21-2006???????????????????????????????@nettun.inf,%msft%;Microsoft?????????????????????B????N???????????D???????????N??????d??????????{4d36e97d-e325-11ce-bfc1-08002be10318}\0066??????????????s??????C9???????????????p???????????????????/???/??*6to4mp??????????????????????????????7??????????????????????????????????{4d36e972-e325-11ce-bfc1-08002be10318}?5?5??? p????????????80B??????????? ?????????????????????0????????~???????????nettun.inf:Microsoft.NTamd64:6to4mp.ndi:6.1.7600.16385:*6to4mp??????? ?????????????????????0????????????&???????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????.???????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????????????? ?????????
Reg HKLM\SYSTEM\CurrentControlSet\services\Smb\Linkage@Route ?????????????????B???e????L????????g????????????????? ??????????????????{00000000-0000-0000-FFFF-FFFFFFFFFFFF}???????7???????????B??? ????????????????????????"?????p?]???????????X??????1????????N???????????D?????{4d36e972-e325-11ce-bfc1-08002be10318}??????????????????s???? ??????????????????? ????????????????????????????$?N?k?????????{4d36e972-e325-11ce-bfc1-08002be10318}\0107???????????????????????????N?????????????????{8F632B7B-3D73-47E9-82FF-A8B9C7E225E0}???????????????y??????????????????????????? ???????d????????????????????????????????????????3?????????? ?????????????????????0????????????&???????????????????????? ???????????????????{?0??????*?6??? ????????????????????????????l??????????????????f????I????????????6??????r??ri??Local Area Connection* 102??????????????????????????????b?????????????????$?????????????????ROOT\*6TO4MP\0093??????????????????d????????????????????????? ??????????????????????????????<???????????????????? ???????????????????????????????????????????8??? ??\???????????x?????6????????
Reg HKLM\SYSTEM\CurrentControlSet\services\Smb\Linkage@Export ????????????????????D1??????????? ?????????????????????0??????????????????????????????????7CCA??? ?????????????????????0????????????????????????????????????Type????Type????????????????????? ???????? ????????????0????????????&????????????????????V??? ?????????????????????0????????????????????????????? ?????????????????????0???????????????????????????????????s????????????FssFltr?????????????????????? ?????????????????????0????????????????????????????????????????????? ?????????????????????0????????????????????????????????????????????????????????????????? ?????????????????????0????????????????????????el??????Net?????????????????? ?????????????????????0????????????????????????????????????????????????????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????????????HID_Inst????Net??z??????????????????????text????????????? ?????????????????????0????????????????????? ?????????????????????0?????????????????????????????;???????????????????????????e??*6to4mp????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x84 0xBE 0x43 0xDF ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x31 0x66 0xAD 0x4B ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x05 0x2F 0xF9 0xA4 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Linkage@Bind ????????Generic volume shadow copy??????? ?????????????????????0????????????&????????????????????n??? ?????????????????????0????????~????????????????????????????0??&d????~??????s??_1???????????????e??????????????????? ?????????????????????0????????F????????????????????????????A??op???????????r??????? ?????????????????????0????????????????????? ?????????????????????0????????D???????????? ?????????????????????0?????????????????????????????a??????op??? ?????????????????????0????????????????????6.1.7600.16385?.NT??Microsoft 6to4 Adapter??????????????????? ?????????????????????0?????????????????????????????v??????????????? ?????????????????????0????????????????????? ?????????????????????0????????F???????????? ????????????????????????????????????????????s?????????????????? ?????????????????????0????????????????????? ?????????????????????0????????D???????????? ??????????????????????????????"??? ??????de0??1???????????????????????? ?????????????????????0????????????????????? ?????????????????????0???????????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Linkage@Route ????c4??????????????????????? ?????????????????????0????????????&????????????????????}??? ?????????????????????0??????????????????????????????N??????T??????????Local Area Connection* 129?er???.NT?5A????????????$??????I??????????????\o???????????????????????????????t??????????????? ????????????????????????????????????????????s?????ndis5_ip6_tunnel????? ???????????????????????????????????????f??*6to4mp??g??? ?????????????????????0??L????????? ???????????????????????????????? ?????????????????????0????????????&???????????????????????? ?????????????????????0????????????????????????????? ???????????????????{?0????????????????????? ???????????????????}?????????? ????????~??????????? ???????????? ???????????c?????????????????????????????????????? ?????????????????????0????????????????????*6to4mp?t???? ???????????????????{?0??????????????????????@??????????????e??????????tunnel??????????????? ?????????????????????0??????????????????????????????????_DRV??? ???????????????????{?0????????????????????Adobe Flash Player
Reg HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Linkage@Export ????????tunnel???t???????????I??????\\?\USB#VID_05AC&PID_1281#CPID:8930_CPRV:20_CPFM:03_SCEP:01_BDID:08_ECID:0000018C6106BDCC_IBFL:01_SRNM:[CCQDTC90DCP9]#{a5dcbf10-6530-11d2-901f-00c04fb951ed}?s??{4d36e972-e325-11ce-bfc1-08002be10318}\0284?e=????X??????5?????????????????????????????ngr??????????????????????????????????????????????????????????????@nettun.inf,%isatap.displayname%;Microsoft ISATAP Adapter?????N?????? ?????D A??????AT???????2??6-21-2006???????????????????????text????????us??????????{00000000-0000-0000-FFFF-FFFFFFFFFFFF}??????{4d36e972-e325-11ce-bfc1-08002be10318}???????????????????????????????????????????????x?????s????*6to4mp?????? ???????T??????????{4d36e972-e325-11ce-bfc1-08002be10318}\0287?? ????8?????????????M ???4???????????????????????????????????????????????????????????????????????????????????????????????????`??Microsoft ISATAP Adapter #3?6???@nettun.inf,%msft%;Microsoft?C??? t??????6?????383????N??????d??????????????????? ????????????*??????c?????????nmd???????????????????????????????d?
Reg HKLM\SYSTEM\ControlSet002\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind ???-??????X??-???e???????d??rtsustor.inf_amd64_neutral_2263b5bc30748305?-f??System32\Drivers\RtsUStor.sys?tsUStor.sys???? ???????1?????EV_?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????-????? ??????? ???????????-?6????????X???????????????4?????N??-????????D?????{36FC9E60-C465-11CF-8056-444553540000}?-?????????-???????e??RSUSBSTOR????-?-?-????X??-???????????d??rtsustor.inf_amd64_neutral_2263b5bc30748305?\P??? ??????? ???????????-?6????????X???????????????50????N??-???f????Dff}??{36FC9E60-C465-11CF-8056-444553540000}???????????-???5???e??RSUSBSTOR????-?-?-????X??-???}???????d??????????????????????????????Realtek Semiconductor Corp.??????#?%?%?%?&?& M???????????v???a??brmfcsto.inf_amd64_neutral_2d7208355536945e?_6???????????D?????sol???????-??? ??s6????H??????n???????d???????????1?????????????CPI???????!?!?n???2?2?d???????????1??????79??.NT?????? ??????? ???????????&?6????????T????????????????????-????N??-????????D127??{4D36E96A-E325-11CE-BFC
Reg HKLM\SYSTEM\ControlSet002\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export ???+???????? ???????????????HIDClass????? ???????????????????-?0????????(???*??????????????????????86&??????????CI???????????C??60???-?-?-????(??-???_??04??20091002193401277???60??{00000000-0000-0000-ffff-ffffffffffff}??{0??{4d36e97d-e325-11ce-bfc1-08002be10318}???.??? ???????,???????????-??????????N???????????Wdf01000?e???????????c???f???????????0?????s?-???????-???-??????LegacyDriver???????-?????-????N??-????????D?????? L??-???????????????-?-?-?-?-?-?3?? ???? ???????-?????.????????????????????(???????????????????????? ??????? ???????????-?6????????X???????????????? ????N??-????????D?????{4D36E96A-E325-11CE-BFC1-08002BE10318}??ri??msahci???-???-?-?-????X??-???s???????d??ibexahci.inf_amd64_neutral_6f34ba52659bc3bc?fu????N??-???0????D)?????????-???e????????????????????????????????????,??.????????????s??????????????????????????-???;???????????????-???-???e????N?????????????????e????????????9??28???4???8???U??????V_??? ???????-?????.????????????????????(???????????????????????{8ECC055D-047F-11D1-A537-0000F8753E
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\2c8158b638fc (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Bind ???n?????????????????????????????????????t?t?t??*6to4mp??e??system32\DRIVERS\disk.sys????n??????????????t????????????????????????????;???1?????????????????g????????t????????&????????????????????????????????????????4??n????????h??????????p?????????n????int?el???n??????????????????????????????? ???????n???????n???????t??@%systemroot%\system32\drivers\discache.sys,-102?????????????n????????????????????N??????5????D2E9??system32\DRIVERS\mrxsmb.sys?????system32\DRIVERS\enecirhidma.sys?irhidma.sys?n??????????????????????FAT12/16/32 File System Driver???????????t???n??tunnel?4?4???y??os??t????????a??????????%SystemRoot%\system32\wevtapi.dll???? ???n??????????e?????\??n??????????%SystemRoot%\system32\winevt\Logs\System.evtx????q?q?n???q???z??26???n??System???????e???z?z26???}?}?}???n???n????D??n???????????e??? ??????????????D???*6to4mp?????? ???????q?????????????6??????????$???????doce???????????|???????????????? ??????????????????o??????????? ???g???6???????????????????????n???????????????????????e??????s???????-C?
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Route ???o????? ???????n???????????n??????????R??????????????p?????????????ox?? F??o????????????P?%SystemRoot%\System32\iphlpsvc.dll??????????????????????????????? ???????s????????????????????????????????(????o???o???o???o????Keyboard Class Driver???? ???????n???????????n??????????R???????????Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0?????(??o?????????e????????????????t??????????????g????????26??? ???@??????????????????????????????usb.inf?\?????0??p?????????e????????????????????????????g???????23??ehdrv???? ???????o?????o?????o?????????????? ????????????????????????e????????????5????????????????????????o?????o????????????????????????????????????????N??o????????h?????\SystemRoot\system32\DRIVERS\amdk8.sys????????0??o?????????e????AMD K8 Processor Driver??????????o??????p???Extended Base????o?o?o?o?o?o?o????N??o???????????d??cpu.inf_amd64_neutral_ae5de2e1bf2793c3??????? ???????n???????????o??????????P???????????????????????t?????????????????????????????????????????P??o????????h?????\SystemRoot\system32\DRIVER
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Export ???s?p??11???????????{???p??LocalSystem?????? ???????p???????????o????????,?F??? ???????????? F??p??????????????%SystemRoot%\system32\cryptsvc.dll????????"??p?????????n????CryptServiceMain????????????????????????????? ???????p???????????p???????????????????????????p??????????? ???????n?????p??????????????????W???????r?????? ???????p???????????????????????????????g??? ???????n?????p?????p?*??????$???X? ?????????????$??p?????????e????@oleres.dll,-5012?????&??p??????????COM Infrastructure????????`??p????????h?????%SystemRoot%\system32\svchost.exe -k DcomLaunch???????$??p?????????n????@oleres.dll,-5013???winmgmt?????? ???p??????????????LocalSystem?????????????????????????????????????????????????????t??????? ????????????????????????????????????p???????????????????p???????????????????p?p?p?p?p?p?p?p?p?p?p??? ???????p???????????p??????????@??? ???????????? @??p???????????????????p?????????????p???p?????p???p??????????????SeAssignPrimaryTokenPrivilege?SeAuditPrivilege?SeChangeNotifyPrivilege?SeCreateGlobalPrivilege?
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Bind ???o?????????????n???c???n???n???c??????????????????????t????????????????????????f??????????????????????? ???????f?????n???????????????????????B????? ????????0????????????????????????????Bl_??????????????t??????????????????j????? ???????j?????n?? ???????"???*????? ????????????????????????????????t????X?????????????Microsoft???????????@%systemroot%\system32\browser.dll,-102??????????????????????????n???:???:??ODiag????n??????????????????????????????t?????????????????????????????????????????N??n????????h?????\SystemRoot\system32\drivers\atapi.sys?dul???????n??????p???SCSI Miniport?????R??n???????????d??mshdc.inf_amd64_neutral_a69a58a4286f0b22????????????????t???????!??????g?????????????????m??????????NDIS??????????????????????????4??n?????????e??????????????????????????4??n????????h???????0??n?????????e????@%systemroot%\system32\srvsvc.dll,-104???????????y???????????????????`???????????????0??? ??sT??fc????????????????????????????????????????P???????????h?????Microsoft???????????? ???????n???????????k?????????

hrabbit · Jul 1, 2012

[CENTER] -----------------------GMER part 2 Scan ------------------[/CENTER]

Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Route ???p?????????????ox?? F??o????????????P?%SystemRoot%\System32\iphlpsvc.dll??????????????????????????????? ???????s????????????????????????????????(????o???o???o???o????Keyboard Class Driver???? ???????n???????????n??????????R???????????Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0?????(??o?????????e????????????????t??????????????g????????26??? ???@??????????????????????????????usb.inf?\?????0??p?????????e????????????????????????????g???????23??ehdrv???? ???????o?????o?????o?????????????? ????????????????????????e????????????5????????????????????????o?????o????????????????????????????????????????N??o????????h?????\SystemRoot\system32\DRIVERS\amdk8.sys????????0??o?????????e????AMD K8 Processor Driver??????????o??????p???Extended Base????o?o?o?o?o?o?o????N??o???????????d??cpu.inf_amd64_neutral_ae5de2e1bf2793c3??????? ???????n???????????o??????????P???????????????????????t?????????????????????????????????????????P??o????????h?????\SystemRoot\system32\DRIVERS\amdppm.sys???????*??o?????????e????AMD Processor D
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Export ???s?????p?p?p?r?r?p?p?????? ????????????????n???????????e????,???????????????????????????????????????`??r??????????????????SeChangeNotifyPrivilege?SeImpersonatePrivilege???????n?n?s?s?s?s????? ???????r???????????r????????,?:??? ???????????? :??r??????????????%systemroot%\system32\es.dll????????????????????????????? ???????n???????????r??????????2?u?????t?????2??r?????????e????exFAT File System Driver??????"??r??????????Boot File System??????2??r?????????n????exFAT File System Driver?????????????????????????r???r?r?r??????????????t????????????????????r?r?r?r?r?r????? ???????n????????????????????????v??????t??????????????????????????????????t??????????????????????g?????????t???????????????????????????????u???????&????Z??s?????????n?????????????????????????0???????????????????????????????????????8???e???}??????????????????????????????????????? ?????????????????????????????U?T?U?e?n?o?q?j?j?j???????????????.??6-21-2006?????P??r?????????e???????r?????r???r??????????????? ???????n?????r??????????????$???w????x???
Reg HKLM\SYSTEM\ControlSet002\services\NetBIOS\Linkage@Bind ???k?n???????k???4???????k??sw\{97ebaacc-95bd-11d0-a3ea-00a0c9223196}????????????????????????k??????????Microsoft????????????????????????????????????????????????????????k???k?l?4???????k??????????ksfilter.inf?????????????????????????k??????????.NT??????k??MSPCLOCK?????????????????????????k????????????????????????????T??k???????????k?k????? ??????????????????????????????????????????????????? ???????j?????k?????j???????????????????????O?????????????????? ???? ???????k???????????I??????????b????????????????????5???????????????n???????????????????k?k????? ???????k???????????z??????????\??????????????k?&????N??k???r????D?r???????????base?0???????????????????k???????n??Ndi-Mp-Ip????k??Volume?????????????????????????????????????????????????????????????????k?&??? ???????j?????k?????j?????????????? ???????R???LegacyDriver?s???k??? ???????k???????????k??????????b???????????LegacyDriver?????k???????z??TCP/IP Registry Compatibility????k?????????????????????????????k?&?????k?&????????????????????X?????????????????????{8E
Reg HKLM\SYSTEM\ControlSet002\services\NetBIOS\Linkage@Route ???k????? ?????????????????????,??????????9?&????????????????????&??????????????s???????1???????????????? ??1???????????????? ?????????????????????0????????\??? ??????????????????????H???????????????????? ?????????????????~??????I???e??SysClass.Dll,CriticalDeviceCoInstaller???????A?A?A?A?A?A?A?A?A?A?A?A?A?A?????A??wpd_ci.dll,CoDeviceInstall??ow??? ???????U???????????8?,????????N???Q?????????????????????????????????????????}???????<???????????h???????R????????????n????????? ???????????????????8?,??????????????#?????????$???4????? ??????? ??????????????????????????????????????????????????????? ??????????? ??????????? ??????????????? ???%????&??HJ???????????????????????????????1???????????????1???????????????????????1???????????1?????????????????? ????,???,?????????? ??????????? ????????????,????????$???4????? ??????? ??????????????????????????????????????????????????????? ??????????? ??????????? ??????????????? ???&???????HJ???&???????????????m???m???????????????????????????m????????z??????????????m???????????
Reg HKLM\SYSTEM\ControlSet002\services\NetBIOS\Linkage@Export ????????????????????????????????????????????????????????????????? ?????????????????????,????????z???????????6-21-2006???????? ???????j????????????????????????&?????????????? ???????????????????I??????????N???????_1??\\?\Root#*6TO4MP#0138#{ad498944-762f-11d0-8dcb-00c04fc3358c}\{BB114134-ED8C-4141-B6C0-AC056DFD1BE1}???????????????????????????????$?????????????????????????????????Root\*6TO4MP\0138????????????????????????????????????&??? ???????j????????????????????????(??????????4??Root\*6TO4MP\0138???????? ???????????????????I??????????N???????????? ???????:?????????????:????????????&???????????????????????? ???????????????????????????e?????e?????????????9??????????????3E??????????????t????????? ??y???6??????????????????? ???????s???????????o?????????????????????aws??????s\???????&@??o?o?o?o?o?o?o?o?o?o?o?o????????? ?????????????????????0????????????&???????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????~???????????nettun.inf:Microsoft.NTamd64:6to4mp.ndi:6.1.7600.16
Reg HKLM\SYSTEM\ControlSet002\services\NetBT\Linkage@Bind ???8?s??volume_snapshot_install??I???????;???????????????5???????-???????/??Video????5????.??6???????????????????????????5???4??????????\\?\STORAGE#Volume#{f837c589-f416-11de-a99e-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}???? ???????5?????????????????????????????????????4?4???????5???5???????????????????5???????????????????????????????????????5?????6???6????? ???????/???????????-?,??????(???7??????????????????????s??????????????STORAGE\Volume???????????5???9??????? ???????/?????6??????????????????X???????????0?????? ???????5???????????????????????????????????5??????????{00000000-0000-0000-0000-000000000000}?#00???5???5??? ???????5????????????????????????????????????s??????9?9?9??input.inf???? ???????5????????????????????????????????????s000??? ???????.?????5?????5?,??????????9?q?????????????????????????????????????????????????????????}***??? ???????5???????????5?,??????????????#?{0??? ???????5????????????????????????????????????s??5???9?9?????5???5???5???5??Base????? ???????.?????
Reg HKLM\SYSTEM\ControlSet002\services\NetBT\Linkage@Route ????????????????????????????????????tunnel??0-???????????????????????I???O??????????????????STORAGE\Volume?? A?????? A???????-??????????????$???4????? ??????? ??????????????????????????????????????????????????????? ??????????? ??????????? ??????????????? ???&???? ??HJ???h???????????????6???6??????????????????? ???????6????????q??????????????6?????????????????????????? ??????????????????? ??????????? ?????????????????Service for NVIDIA High Definition Audio Driver?????system32\DRIVERS\nvlddmkm.sys????k?k?n?k????e6??????????????t???Boot Bus Extender??????????????g?????l?m?s?s?s?u?s??ab????2???????????h?????System32\drivers\pcw.sys???????????????????????????????????????????4fc???????????s??n?????????????????????????????.??????????????????????????s???????????????????????????????????1??11???????k???~???~???????????????????0??4????????????????????9????????????6??????r??ri??TCPIP6TUNNEL?Tcpip6??A????6?????????{9???????????????T??????????????????????????nettun.inf??13???????????????????n?p?????I??77?????????????????
Reg HKLM\SYSTEM\ControlSet002\services\NetBT\Linkage@Export ?????????????????????????????????????t??????\????????p??????????????????????????????????????????????????????????????????? ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????C?????????????????????????????????n????????????????????????????????????????????????????????????$?????????????20060907512102010????????s???????????????????????????t??????#??????????????????????????e????????????????????????????USB2.0-CRW???????????s?????????????????????????????????????t????Compact Flash????? ??r?????????????n?????????t?????????????????????????????????????t????SM/xD-Picture????????t?????????????t?????? ??s?????????????n?????????t???????????????????????t?????????????t?????????????? ??s?????????????n???????
Reg HKLM\SYSTEM\ControlSet002\services\Smb\Linkage@Bind ????????????????????????????????????P????????????????????????????????:?????? ?????????????B????????????e????Security Processor Loader Driver????????????????????????srv2????????????????t????????????????????????????(???????????.???????????????.??t0???????????_???????????????????1??????Network???????4??????5????h?6t??System32\Drivers\sptd.sys?????$??????c??p8??Boot Bus Extender?????????????????????N????????????e????@%systemroot%\system32\srvsvc.dll,-102??????????????????p?????2???????????h?????System32\DRIVERS\srv.sys?????:?t?t??? ??????????????????????????????*?W?&??????????????????????????????????????l????? *?????????????????EventLog-Application?????????????????????d???????????????????d???????????????????????????????????,??? ?????????????????????????????? ?K?&????????????????????????????????????d?????????????????l????? ?????????????????EventLog-System??????????????????????d???????????????????????????????d???????????????????????????????????????????????????????,??? ???????????????????????????? ?N?Y????????????
Reg HKLM\SYSTEM\ControlSet002\services\Smb\Linkage@Route ????P????????????????????????????????:?????? ?????????????B????????????e????Security Processor Loader Driver????????????????????????srv2????????????????t????????????????????????????(???????????.???????????????.??t0???????????_???????????????????1??????Network???????4??????5????h?6t??System32\Drivers\sptd.sys?????$??????c??p8??Boot Bus Extender?????????????????????N????????????e????@%systemroot%\system32\srvsvc.dll,-102??????????????????p?????2???????????h?????System32\DRIVERS\srv.sys?????:?t?t??? ??????????????????????????????*?W?&??????????????????????????????????????l????? *?????????????????EventLog-Application?????????????????????d???????????????????d???????????????????????????????????,??? ?????????????????????????????? ?K?&????????????????????????????????????d?????????????????l????? ?????????????????EventLog-System??????????????????????d???????????????????????????????d???????????????????????????????????????????????????????,??? ???????????????????????????? ?N?Y???????????????????????N?????????????????{e5
Reg HKLM\SYSTEM\ControlSet002\services\Smb\Linkage@Export ???? ?????????????B????????????e????Security Processor Loader Driver????????????????????????srv2????????????????t????????????????????????????(???????????.???????????????.??t0???????????_???????????????????1??????Network???????4??????5????h?6t??System32\Drivers\sptd.sys?????$??????c??p8??Boot Bus Extender?????????????????????N????????????e????@%systemroot%\system32\srvsvc.dll,-102??????????????????p?????2???????????h?????System32\DRIVERS\srv.sys?????:?t?t??? ??????????????????????????????*?W?&??????????????????????????????????????l????? *?????????????????EventLog-Application?????????????????????d???????????????????d???????????????????????????????????,??? ?????????????????????????????? ?K?&????????????????????????????????????d?????????????????l????? ?????????????????EventLog-System??????????????????????d???????????????????????????????d???????????????????????????????????????????????????????,??? ???????????????????????????? ?N?Y???????????????????????N?????????????????{e595f735-b42a-494b-afcd-b68666945cd3}?????
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x84 0xBE 0x43 0xDF ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x31 0x66 0xAD 0x4B ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x05 0x2F 0xF9 0xA4 ...
Reg HKLM\SYSTEM\ControlSet002\services\TCPIP6\Linkage@Bind ???:????????e?????????????????????<??:?????????e????TCP/IP Registry Compatibility?????\??;???p???????:??Root\SYSTEM\0000?????????????h?????s0???? ??????????????s???Net??????????????:??? ?????????????????????9??L????????? ???????????????????????????????????????????????????????????????????????????????????????????????{1AEE01FB-C089-42CB-AE1A-84C0202866D1}??????? ???????n??????? ??????????????????????????????Root\MS_PPTPMINIPORT\0000???Root\MS_SSTPMINIPORT\0000?????"??:??????????????? ????????????????????N??h??????????????? n??h???????????3??Net?????????????????????? ???j???????????????????????????????????????????????????:???:???????????????:???????;???D???????&????0??:???????s??2????????????????????????????:???:???????;???????????????:??ACPI\PNP0A03?*PNP0A03??D?????????4???????h???:?????5?&???:?????9???:???:???:???:???:????????? ???????:???????????:?0????????????????????? ???????8?????:???????0????????????????????? ???????:???????????:?0????????????????????????????????????????????????????????t??????????????????
Reg HKLM\SYSTEM\ControlSet002\services\TCPIP6\Linkage@Route ???t?-???????????.??????????????????????????????s???s???11??????????????????????????????????????????os??t????????|???6???h?????t?????t??????????????? ???????t???????????t????????(??????????????????????????????'???????????'??? ???????t???????????t????????F????? ???????????? ??????????????g????#?????????????????????????c??????????????????????????c????????????????????????????????t???t?????!??<?????????????????????c????????????????????????????c????255.255.255.0??????????????????????????????????????????????????s?????????????'???????'???"??????????????????????????????????<???????????????????????192.168.2.120????????????!????????????????????????c?????????????????????????????????<????'???????????????'???"??????????????????????????????? ???????????????????????????????????'???????????????'???!??<?????????????????????c?????4304??????????????????????????c?????? ???????'???????????????????}??2p???0??????<????'???????????????c???t?t?t?t?t?t?t?t?t?t?t?t?t?t?t?t?t?t?t?t?t??? ???????n??????????????????????P???????????input.I
Reg HKLM\SYSTEM\ControlSet002\services\TCPIP6\Linkage@Export ???t?t????????????????p??????t?t?t?t?t?t?t?t?t?t?t?t?t?t?t??? ???????n??????????????????????????????????Fs_Rec??????????*6to4mp??z??tunnel???????????t???????t???????????t??? ???????n???????????t??????????d?????????f???????d??t?????????e????@%SystemRoot%\system32\drivers\mshidkmdf.sys,-100????? ??t??????p?????V??t????????h?????\SystemRoot\System32\drivers\mshidkmdf.sys????????d??t?????????n????@%SystemRoot%\system32\drivers\mshidkmdf.sys,-101??????t?????t??????????????????????????????????t????t?t?t?t?t?t?t??????????????????? ???????n???????????p??????????V???????????Charles?3S8LPAV???????D??t???????????????????????t???+???????????????????????????????????????S??ak???????n???????~??? ???????t?????t?????t????????*????? ???????????????????????????????s???? ???????t?????o??????????L?????????????????????????? ???????n?????t??????????????@??????????I??%systemroot%\system32\svchost.exe -k netsvcs????? ???t????????????????L??t?????????e????????????@%SystemRoot%\system32\iscsidsc.dll,-5001???LocalSystem????????????????

---- EOF - GMER 1.0.15 ----

Broni · Jul 1, 2012

Please disable "word wrap" in Notepad because some of your logs are hard to read.

For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt
Select Command Prompt
In the command window type in notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

hrabbit · Jul 2, 2012

Apologies about the wordwrap, I disabled it.

ESET just recently picked up on a win64 sirefef.AL Trojan and says it was "cleaned by deleting it -quarantined". I was redirected to another website once, but not since, so I believe ESET solved that problem. Just thought it was worth mentioning. Computer is still seems to be acting alright besides that.

Scan result of Farbar Recovery Scan Tool Version: 30-06-2012 04
Ran by SYSTEM at 02-07-2012 08:01:46
Running from G:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1810728 2009-07-30] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [8060960 2009-08-18] (Realtek Semiconductor)
HKLM\...\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4366704 2009-09-01] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [5825536 2009-08-18] (Lenovo (Beijing) Limited)
HKLM\...\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice [4035152 2011-09-22] (ESET)
HKLM-x32\...\Run: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0" [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [OnekeyDM] C:\Program Files (x86)\Lenovo\OnekeyDM\OnekeyDM.exe [468480 2009-03-27] ()
HKLM-x32\...\Run: [IdeaNotesUser] C:\Program Files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe [221872 2009-06-10] (Digital Delivery Networks, Inc.)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [815512 2012-04-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [] [x]
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-01-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [462408 2012-04-04] (Malwarebytes Corporation)
HKU\Hanna\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [3872080 2010-04-16] (Microsoft Corporation)
HKU\Hanna\...\Run: [F.lux] "C:\Users\Hanna\Local Settings\Apps\F.lux\flux.exe" /noshow [966656 2009-08-28] ()
HKU\Hanna\...\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent [1242448 2011-08-02] (Valve Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

==================== Services (Whitelisted) ======

2 BcmSqlStartupSvc; "C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe" [30312 2008-01-11] (Microsoft Corporation)
2 DDNIMSGService; "C:\Program Files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGService.exe" [172720 2009-06-23] (Digital Delivery Networks, Inc.)
2 ekrn; "C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe" [974944 2011-09-22] (ESET)
2 IGRS; "C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe" [38152 2009-07-14] (Lenovo Group Limited)
3 Lenovo ReadyComm AppSvc; "C:\Program Files\Lenovo\ReadyComm\AppSvc.exe" [414984 2009-07-28] (Lenovo Group Limited)
3 Lenovo ReadyComm ConnSvc; "C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe" [472328 2009-07-28] (Lenovo Group Limited)
2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [654408 2012-04-04] (Malwarebytes Corporation)
3 MSSQL$MSSMLBIZ; "C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ [29293408 2010-12-10] (Microsoft Corporation)
4 MSSQLServerADHelper; "C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqladhlp90.exe" [44384 2010-12-10] (Microsoft Corporation)
2 PnkBstrA; C:\windows\SysWow64\PnkBstrA.exe [75136 2011-12-01] ()
3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-15] (Lenovo Group Limited)
2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-14] (Lenovo Group Limited)

========================== Drivers (Whitelisted) =============

3 ACPIVPC; C:\Windows\System32\Drivers\ACPIVPC.sys [26128 2009-05-19] (Lenovo Corporation)
3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-15] (Lenovo)
2 eamonm; C:\Windows\System32\Drivers\eamonm.sys [202576 2011-08-09] (ESET)
1 ehdrv; C:\Windows\System32\Drivers\ehdrv.sys [146432 2011-08-04] (ESET)
3 enecirhid; C:\Windows\System32\Drivers\enecirhid.sys [14848 2009-05-19] (ENE TECHNOLOGY INC.)
3 enecirhidma; C:\Windows\System32\Drivers\enecirhidma.sys [6656 2008-04-24] (ENE TECHNOLOGY INC.)
2 epfwwfpr; C:\Windows\System32\Drivers\epfwwfpr.sys [137144 2011-08-04] (ESET)
1 funfrm; C:\Windows\System32\Drivers\funfrm.sys [58896 2009-12-28] ()
3 MBAMProtector; \??\C:\windows\system32\drivers\mbam.sys [24904 2012-04-04] (Malwarebytes Corporation)
0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-03-30] (Duplex Secure Ltd.)
3 UsbGps; C:\Windows\System32\DRIVERS\lgx64gps.sys [26624 2010-01-21] (LG Electronics Inc.)
3 usbsmi; C:\Windows\System32\DRIVERS\SMIksdrv.sys [197120 2009-08-21] (SMI)
3 VBoxNetAdp; C:\Windows\System32\Drivers\VBoxNetAdp.sys [145936 2010-03-25] (Sun Microsystems, Inc.)
3 wdmirror; C:\Windows\System32\Drivers\wdmirror.sys [11280 2009-07-16] (Lenovo)
3 wsvd; C:\Windows\System32\Drivers\wsvd.sys [121840 2009-07-21] (CyberLink)
3 btwaudio; C:\Windows\System32\drivers\btwaudio.sys [x]
3 btwavdt; C:\Windows\System32\drivers\btwavdt.sys [x]
3 btwl2cap; C:\Windows\System32\DRIVERS\btwl2cap.sys [x]
3 btwrchid; C:\Windows\System32\DRIVERS\btwrchid.sys [x]
3 RtsUIR; C:\Windows\System32\DRIVERS\Rts516xIR.sys [x]
3 USBCCID; C:\Windows\System32\DRIVERS\RtsUCcid.sys [x]
3 VBoxNetFlt; C:\Windows\System32\DRIVERS\VBoxNetFlt.sys [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-07-02 08:01 - 2012-07-02 08:01 - 00000000 ____D C:\FRST
2012-07-02 06:45 - 2012-07-02 06:45 - 01430427 ____A C:\Users\Hanna\Downloads\FRST64(1).exe
2012-06-30 21:40 - 2012-06-30 21:40 - 00000000 ____D C:\Users\Hanna\AppData\Local\Conduit
2012-06-30 21:22 - 2012-06-30 21:52 - 00020680 ____A C:\Users\Hanna\Desktop\DDS.txt
2012-06-30 21:22 - 2012-06-30 21:45 - 00010438 ____A C:\Users\Hanna\Desktop\Attach.txt
2012-06-30 21:14 - 2012-06-30 21:15 - 00607260 ____R (Swearware) C:\Users\Hanna\Downloads\dds.scr
2012-06-30 21:10 - 2012-06-30 21:10 - 00051305 ____A C:\Users\Hanna\Desktop\gmer.log
2012-06-30 19:14 - 2012-06-30 19:14 - 00302592 ____A C:\Users\Hanna\Downloads\2o2j7ox9.exe
2012-06-30 18:51 - 2012-06-30 18:51 - 00000000 ____D C:\Users\Hanna\AppData\Roaming\Malwarebytes
2012-06-30 18:50 - 2012-06-30 18:50 - 10063000 ____A (Malwarebytes Corporation ) C:\Users\Hanna\Downloads\mbam-setup-1.61.0.1400.exe
2012-06-30 18:50 - 2012-06-30 18:50 - 00001109 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-06-30 18:50 - 2012-06-30 18:50 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-06-30 18:50 - 2012-06-30 18:50 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-06-30 18:50 - 2012-04-04 14:56 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-06-30 17:59 - 2012-06-30 17:59 - 00001205 ____A C:\Users\Hanna\Downloads\FixNCR.reg
2012-06-30 17:57 - 2012-06-30 17:57 - 01428239 ____A C:\Users\Hanna\Downloads\FRST64.exe
2012-06-30 17:23 - 2012-06-30 17:23 - 00000000 __SHD C:\Windows\System32\%APPDATA%
2012-06-30 17:20 - 2012-07-02 06:57 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-06-30 17:20 - 2012-06-30 17:20 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-06-25 17:17 - 2012-06-25 17:17 - 00683117 ____A C:\Users\Hanna\Downloads\portal_turret_pepakura_file_by_billybob884-d1p9011.rar
2012-06-25 10:06 - 2012-06-25 10:06 - 00293155 ___RA C:\Users\Hanna\Desktop\keaton mask.pdo
2012-06-25 10:03 - 2008-11-11 13:38 - 00000000 ____D C:\Users\Hanna\Desktop\Medium Chest
2012-06-25 10:00 - 2012-06-25 10:00 - 00542821 ____A C:\Users\Hanna\Downloads\Heartpiece.zip
2012-06-25 09:40 - 2012-06-25 09:41 - 19179063 ____A C:\Users\Hanna\Desktop\Adult Link Equipment Pack.RAR
2012-06-25 09:38 - 2012-06-25 09:38 - 04833642 ____A C:\Users\Hanna\Downloads\Ordon Shield.rar
2012-06-24 23:31 - 2009-04-27 20:39 - 00962679 ____A C:\Users\Hanna\Desktop\WhiteWolfos-Letter.pdo
2012-06-18 12:24 - 2012-06-18 14:26 - 00000000 ____D C:\Users\Hanna\Desktop\packages
2012-06-13 09:24 - 2012-04-23 21:59 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-06-13 09:24 - 2012-04-23 20:47 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-06-13 09:23 - 2012-04-19 22:25 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-13 09:23 - 2012-04-19 21:07 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-06-07 18:20 - 2012-06-07 18:20 - 00000039 ____A C:\Windows\WININIT.INI
2012-06-05 11:57 - 2012-06-05 11:57 - 00000000 ____A C:\Windows\setup32.INI
2012-06-05 11:57 - 2002-05-08 01:09 - 00274432 ____A (Riverdeep Interactive Learning Limited) C:\Windows\TLCUninstall.exe
2012-06-04 09:44 - 2012-06-04 09:44 - 00000000 ____D C:\Program Files\OT2

============ 3 Months Modified Files ========================

2012-07-02 06:57 - 2012-06-30 17:20 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-07-02 06:54 - 2010-02-05 20:23 - 00000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-07-02 06:45 - 2012-07-02 06:45 - 01430427 ____A C:\Users\Hanna\Downloads\FRST64(1).exe
2012-07-02 06:30 - 2009-07-13 20:45 - 00013632 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-02 06:30 - 2009-07-13 20:45 - 00013632 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-02 06:23 - 2009-12-28 17:18 - 02094432 ____A C:\Windows\WindowsUpdate.log
2012-07-02 06:22 - 2010-12-08 11:07 - 00127266 ____A C:\Windows\setupact.log
2012-07-02 06:22 - 2010-02-05 20:23 - 00000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-07-02 06:22 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-01 04:42 - 2010-12-19 10:39 - 00023802 ____A C:\Windows\PFRO.log
2012-06-30 21:52 - 2012-06-30 21:22 - 00020680 ____A C:\Users\Hanna\Desktop\DDS.txt
2012-06-30 21:45 - 2012-06-30 21:22 - 00010438 ____A C:\Users\Hanna\Desktop\Attach.txt
2012-06-30 21:15 - 2012-06-30 21:14 - 00607260 ____R (Swearware) C:\Users\Hanna\Downloads\dds.scr
2012-06-30 21:10 - 2012-06-30 21:10 - 00051305 ____A C:\Users\Hanna\Desktop\gmer.log
2012-06-30 19:14 - 2012-06-30 19:14 - 00302592 ____A C:\Users\Hanna\Downloads\2o2j7ox9.exe
2012-06-30 19:07 - 2009-07-13 21:08 - 00032602 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-06-30 18:50 - 2012-06-30 18:50 - 10063000 ____A (Malwarebytes Corporation ) C:\Users\Hanna\Downloads\mbam-setup-1.61.0.1400.exe
2012-06-30 18:50 - 2012-06-30 18:50 - 00001109 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-06-30 18:27 - 2009-07-13 21:13 - 00847098 ____A C:\Windows\System32\PerfStringBackup.INI
2012-06-30 17:59 - 2012-06-30 17:59 - 00001205 ____A C:\Users\Hanna\Downloads\FixNCR.reg
2012-06-30 17:57 - 2012-06-30 17:57 - 01428239 ____A C:\Users\Hanna\Downloads\FRST64.exe
2012-06-30 17:20 - 2012-06-30 17:20 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-06-30 17:20 - 2011-07-02 09:37 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-06-30 12:41 - 2012-03-15 23:59 - 00318640 ____A C:\Windows\IE9_main.log
2012-06-25 17:17 - 2012-06-25 17:17 - 00683117 ____A C:\Users\Hanna\Downloads\portal_turret_pepakura_file_by_billybob884-d1p9011.rar
2012-06-25 10:06 - 2012-06-25 10:06 - 00293155 ___RA C:\Users\Hanna\Desktop\keaton mask.pdo
2012-06-25 10:00 - 2012-06-25 10:00 - 00542821 ____A C:\Users\Hanna\Downloads\Heartpiece.zip
2012-06-25 09:41 - 2012-06-25 09:40 - 19179063 ____A C:\Users\Hanna\Desktop\Adult Link Equipment Pack.RAR
2012-06-25 09:38 - 2012-06-25 09:38 - 04833642 ____A C:\Users\Hanna\Downloads\Ordon Shield.rar
2012-06-24 08:09 - 2010-12-07 19:53 - 00000356 ____A C:\Windows\Tasks\RegInOut Scheduled Scan - Hanna.job
2012-06-13 23:00 - 2010-01-29 23:40 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-06-07 18:20 - 2012-06-07 18:20 - 00000039 ____A C:\Windows\WININIT.INI
2012-06-07 13:21 - 2012-06-07 13:19 - 30856741 ____A C:\Users\Hanna\Downloads\PES from RIP SLYME - ???KISS.rar
2012-06-05 11:57 - 2012-06-05 11:57 - 00000000 ____A C:\Windows\setup32.INI
2012-05-11 22:12 - 2012-05-11 22:12 - 00030844 ____A C:\Users\Hanna\Downloads\But+what+is+an+oxygen+festival+_4f3e06ac56d69692de0db2e775d8a33b.png
2012-04-23 21:59 - 2012-06-13 09:24 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-04-23 20:47 - 2012-06-13 09:24 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-04-19 22:25 - 2012-06-13 09:23 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-04-19 21:07 - 2012-06-13 09:23 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-04-07 15:19 - 2012-04-07 15:19 - 00206739 ____A C:\Users\Hanna\Downloads\3552369+_fffa21d756da5f7dd041aa2693216681.gif
2012-04-04 14:56 - 2012-06-30 18:50 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

ZeroAccess:
C:\Windows\Installer\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6}
C:\Windows\Installer\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6}\@
C:\Windows\Installer\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6}\L
C:\Windows\Installer\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6}\U
C:\Windows\Installer\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6}\U\00000001.@
C:\Windows\Installer\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6}\U\800000cb.@

ZeroAccess:
C:\Users\Hanna\AppData\Local\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6}
C:\Users\Hanna\AppData\Local\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6}\@
C:\Users\Hanna\AppData\Local\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6}\L
C:\Users\Hanna\AppData\Local\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6}\U

========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 16%
Total physical RAM: 4086.85 MB
Available physical RAM: 3423.32 MB
Total Pagefile: 4085 MB
Available Pagefile: 3405.43 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:420.55 GB) (Free:93.72 GB) NTFS
2 Drive d: (Lenovo) (Fixed) (Total:30.25 GB) (Free:29.17 GB) NTFS
3 Drive f: (Sims3EP05) (CDROM) (Total:5.3 GB) (Free:0 GB) UDF
4 Drive g: (TravelDrive) (Removable) (Total:0.96 GB) (Free:0.07 GB) FAT
5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
6 Drive y: () (Fixed) (Total:0.2 GB) (Free:0.15 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 465 GB 0 B
Disk 1 Online 981 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 200 MB 1024 KB
Partition 2 Primary 420 GB 201 MB
Partition 0 Extended 30 GB 420 GB
Partition 4 Logical 30 GB 420 GB
Partition 3 OEM 14 GB 451 GB

==================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y NTFS Partition 200 MB Healthy

==================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 420 GB Healthy

==================================================================================

Disk: 0
Partition 4
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 D Lenovo NTFS Partition 30 GB Healthy

==================================================================================

Disk: 0
Partition 3
Type : 12
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 LENOVO_PART NTFS Partition 14 GB Healthy Hidden

==================================================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 980 MB 16 KB

==================================================================================

Disk: 1
Partition 1
Type : 0E
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 G TravelDrive FAT Removable 980 MB Healthy

==================================================================================

==========================================================

Last Boot: 2012-06-30 20:46

======================= End Of Log ==========================

Broni · Jul 2, 2012

In Vista or Windows 7: Boot to System Recovery Options and run FRST.
In Windows XP: Please boot to UBCD and run FRST.
Type the following in the edit box after "Search:".

services.exe

Click Search button and post the log (Search.txt) it makes to your reply.

hrabbit · Jul 2, 2012

[CENTER]---------Search--------[/CENTER]
Farbar Recovery Scan Tool Version: 30-06-2012 04
Ran by SYSTEM at 2012-07-02 19:49:08
Running from G:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06

====== End Of Search ======

Broni · Jul 2, 2012

Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Next...

Restart normally.

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe

Double-click on the Rkill icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

hrabbit · Jul 3, 2012

[LEFT]All done, here are the logs.[/LEFT]
[CENTER] [/CENTER]
[CENTER]---------------Fixlog--------------[/CENTER]

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 30-06-2012 04
Ran by SYSTEM at 2012-07-02 22:59:26 Run:1
Running from G:\

==============================================

HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows Value was restored successfully .
C:\Windows\System32\consrv.dll not found.
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.
C:\Windows\Installer\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6} moved successfully.
C:\Users\hrabbit\AppData\Local\{008c1ed5-b128-cefc-43c0-6c56c7d1b4f6} moved successfully.
C:\Windows\System32\services.exe moved successfully.
C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe

==== End of Fixlog ====

[CENTER]-------------------------Log--------------------------[/CENTER]
[CENTER] [/CENTER]
[CENTER] [/CENTER]
[LEFT]ComboFix 12-07-02.01 - Hanna 07/03/2012 19:19:32.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4087.2257 [GMT -7:00]
Running from: c:\users\hrabbit\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\hrabbit\AppData\Roaming\Local
c:\users\hrabbit\AppData\Roaming\Local\FalloutNV\Fallout.ini
c:\users\hrabbitAppData\Roaming\Local\FalloutNV\FalloutPrefs.ini
c:\users\hrabbit\AppData\Roaming\Local\FalloutNV\NVDLCList.txt
c:\users\hrabbit\AppData\Roaming\Local\FalloutNV\plugins.txt
c:\users\hrabbit\AppData\Roaming\Local\FalloutNV\RendererInfo.txt
.
.
((((((((((((((((((((((((( Files Created from 2012-06-04 to 2012-07-04 )))))))))))))))))))))))))))))))
.
.
2012-07-04 02:33 . 2012-07-04 02:33 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-02 16:01 . 2012-07-02 16:01 -------- d-----w- C:\FRST
2012-07-01 05:40 . 2012-07-01 05:40 -------- d-----w- c:\users\hrabbit\AppData\Local\Conduit
2012-07-01 02:51 . 2012-07-01 02:51 -------- d-----w- c:\users\hrabbit\AppData\Roaming\Malwarebytes
2012-07-01 02:50 . 2012-07-01 02:50 -------- d-----w- c:\programdata\Malwarebytes
2012-07-01 02:50 . 2012-07-01 02:50 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-07-01 02:50 . 2012-04-04 22:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-01 01:23 . 2012-07-01 01:23 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-07-01 01:20 . 2012-07-01 01:20 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-13 17:24 . 2012-04-24 05:59 140288 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-13 17:24 . 2012-04-24 04:47 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2012-06-07 05:01 . 2012-06-07 05:01 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-07 05:01 . 2012-06-07 05:01 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll
2012-06-05 19:57 . 2002-05-08 09:09 274432 ----a-w- c:\windows\TLCUninstall.exe
2012-06-04 17:44 . 2012-06-04 17:44 -------- d-----w- c:\program files\OT2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-01 01:20 . 2011-07-02 17:37 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-31 04:04 . 2012-07-01 00:55 9013136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CA1020A6-83A0-4E2D-B29D-5AC24A458C9F}\mpengine.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\hrabbit\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\hrabbit\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\hrabbit\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"F.lux"="c:\users\hrabbit\Local Settings\Apps\F.lux\flux.exe" [2009-08-29 966656]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-08-02 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"OnekeyDM"="c:\program files (x86)\Lenovo\OnekeyDM\OnekeyDM.exe" [2009-03-27 468480]
"IdeaNotesUser"="c:\program files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe" [2009-06-10 221872]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-04-04 815512]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 135664]
R2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\System32\IgrsSvcs.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-01 257224]
R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys [2009-07-16 79376]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 135664]
R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe [2009-07-28 414984]
R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [2009-07-28 472328]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-17 113120]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-05-14 5435904]
R3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\System32\IgrsSvcs.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-05-08 215552]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712]
R3 UsbGps;LGE Mobile USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgx64gps.sys [2010-01-21 26624]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-03-26 145936]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-02 1255736]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-30 834544]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2011-08-04 146432]
S1 funfrm;funfrm; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 DDNIMSGService;DDNIMSGService;c:\program files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGService.exe [2009-06-23 172720]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2011-08-09 202576]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-09-22 974944]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2011-08-04 137144]
S2 IGRS;IGRS;c:\program files (x86)\Lenovo\ReadyComm\common\IGRS.exe [2009-07-14 38152]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2009-05-19 26128]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2009-06-29 70656]
S3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\DRIVERS\enecirhid.sys [2009-05-19 14848]
S3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\DRIVERS\enecirhidma.sys [2008-04-24 6656]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-06-07 317480]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]
S3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2009-09-16 6952960]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2010-09-07 155752]
S3 usbsmi;Lenovo EasyCamera;c:\windows\system32\DRIVERS\SMIksdrv.sys [2009-08-21 197120]
S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys [2009-07-16 11280]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
IgrsSvcs REG_MULTI_SZ ReadyComm.DirectRouter PS_MDP
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-01 01:20]
.
2012-07-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 04:22]
.
2012-07-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 04:22]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\hrabbit\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\hrabbit\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\hrabbit\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\hrabbit\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-19 8060960]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\utility.exe" [2009-09-01 4366704]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2009-08-19 5825536]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-09-22 4035152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://lenovo.live.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\hrabbit\AppData\Roaming\Mozilla\Firefox\Profiles\tybajjr6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2095689&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.sitfy.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=bJ2hy9lp&q=
FF - user.js: keyword.URL - hxxp://www.sitfy.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=bJ2hy9lp&q=
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
AddRemove-Rainmeter - c:\program files\Rainmeter\uninst.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3089571139-241592476-2382567337-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3089571139-241592476-2382567337-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Completion time: 2012-07-03 19:43:49 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-04 02:43
.
Pre-Run: 108,612,435,968 bytes free
Post-Run: 129,135,718,400 bytes free
.
- - End Of File - - 378D862A392AEDD2F883F63BCE52D873
[/LEFT]

Broni · Jul 3, 2012

Looks good

Any current issues?

==============================

Download Malwarebytes' Anti-Malware (MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
NOTE. If you already have MBAM installed, update it before running the scan.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

======================================

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

hrabbit · Jul 3, 2012

Everything is running fine ^^ ESET finally calmed down, and its all quarantined. Downloading OTL right now.
[CENTER] [/CENTER]
[CENTER]---------Malwarebytes log--------[/CENTER]
[CENTER] [/CENTER]
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
hrabbit :: CHARLES [administrator]

Protection: Disabled

7/3/2012 8:47:47 PM
mbam-log-2012-07-03 (20-47-47).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 215112
Time elapsed: 3 minute(s), 21 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

hrabbit · Jul 4, 2012

[CENTER]--------------OTL Log--------------[/CENTER]

OTL logfile created on: 7/3/2012 9:04:21 PM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\hrabbit\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.99 Gb Total Physical Memory | 2.45 Gb Available Physical Memory | 61.49% Memory free
7.98 Gb Paging File | 6.28 Gb Available in Paging File | 78.63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 420.55 Gb Total Space | 119.95 Gb Free Space | 28.52% Space Free | Partition Type: NTFS
Drive D: | 30.25 Gb Total Space | 29.17 Gb Free Space | 96.46% Space Free | Partition Type: NTFS
Drive E: | 5.30 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive G: | 980.72 Mb Total Space | 72.77 Mb Free Space | 7.42% Space Free | Partition Type: FAT

Computer Name: CHARLES | User Name: hrabbit | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/03 21:03:31 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\hrabbit\Downloads\OTL.exe
PRC - [2012/06/19 07:03:11 | 000,529,232 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe
PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/04/03 22:53:56 | 000,815,512 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
PRC - [2011/12/01 20:55:56 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011/09/22 13:03:30 | 000,974,944 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
PRC - [2011/08/02 03:35:56 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exe
PRC - [2010/10/16 12:46:40 | 000,369,256 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2009/08/28 23:00:12 | 000,966,656 | ---- | M] () -- C:\Users\hrabbit\Local Settings\Apps\F.lux\flux.exe
PRC - [2009/08/06 22:29:36 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009/07/14 07:27:26 | 000,038,152 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe
PRC - [2009/06/23 03:23:32 | 000,172,720 | ---- | M] (Digital Delivery Networks, Inc.) -- C:\Program Files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGService.exe
PRC - [2009/06/10 07:20:02 | 000,221,872 | ---- | M] (Digital Delivery Networks, Inc.) -- C:\Program Files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe
PRC - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/01/11 10:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

========== Modules (No Company Name) ==========

MOD - [2012/06/19 07:03:10 | 020,313,384 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dll
MOD - [2012/06/19 07:03:07 | 001,099,576 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-53.dll
MOD - [2012/06/19 07:03:07 | 000,895,312 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.dll
MOD - [2012/06/19 07:03:07 | 000,190,776 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-53.dll
MOD - [2012/06/19 07:03:07 | 000,123,192 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-51.dll
MOD - [2010/06/24 01:27:00 | 000,197,928 | ---- | M] () -- C:\Program Files (x86)\ManyCam\Bin\VideoSrc.dll
MOD - [2009/08/28 23:00:12 | 000,966,656 | ---- | M] () -- C:\Users\hrabbit\Local Settings\Apps\F.lux\flux.exe
MOD - [2009/07/14 14:42:34 | 000,221,184 | ---- | M] () -- C:\Windows\SysWOW64\370prop.ax

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/09/22 13:03:30 | 000,974,944 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -- (ekrn)
SRV:64bit: - [2009/07/28 07:41:06 | 000,472,328 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe -- (Lenovo ReadyComm ConnSvc)
SRV:64bit: - [2009/07/28 07:41:04 | 000,414,984 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files\Lenovo\ReadyComm\AppSvc.exe -- (Lenovo ReadyComm AppSvc)
SRV:64bit: - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/06/30 18:20:40 | 000,257,224 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/06/19 07:03:11 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/06/17 14:47:40 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/12/01 20:55:56 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2010/10/16 12:46:40 | 000,369,256 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/18 14:05:14 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/08/06 22:29:36 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2009/07/15 20:12:42 | 000,276,296 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll -- (PS_MDP)
SRV - [2009/07/14 07:27:26 | 000,038,152 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe -- (IGRS)
SRV - [2009/07/14 07:27:20 | 000,103,688 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll -- (ReadyComm.DirectRouter)
SRV - [2009/06/23 03:23:32 | 000,172,720 | ---- | M] (Digital Delivery Networks, Inc.) [Auto | Running] -- C:\Program Files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGService.exe -- (DDNIMSGService)
SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/01/11 10:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/04/04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011/08/09 15:24:52 | 000,202,576 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm)
DRV:64bit: - [2011/08/04 10:20:38 | 000,146,432 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv)
DRV:64bit: - [2011/08/04 10:20:38 | 000,137,144 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV:64bit: - [2011/03/10 23:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/10 23:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 06:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 04:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/09/28 16:44:52 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/09/23 01:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2010/09/07 13:08:55 | 000,155,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2010/03/30 14:40:21 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010/03/25 19:52:36 | 000,145,936 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:64bit: - [2010/01/21 02:03:10 | 000,027,648 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag)
DRV:64bit: - [2010/01/21 02:03:10 | 000,026,624 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64gps.sys -- (UsbGps)
DRV:64bit: - [2010/01/21 02:03:08 | 000,033,280 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem)
DRV:64bit: - [2010/01/21 02:03:06 | 000,017,920 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus)
DRV:64bit: - [2009/12/28 18:24:38 | 000,058,896 | ---- | M] () [Kernel | System | Running] -- C:\windows\SysNative\drivers\funfrm.sys -- (funfrm)
DRV:64bit: - [2009/09/15 20:40:42 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel(R)
DRV:64bit: - [2009/09/11 12:49:18 | 000,076,552 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmXlCore.sys -- (WmXlCore)
DRV:64bit: - [2009/09/11 12:49:08 | 000,015,880 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WmVirHid.sys -- (WmVirHid)
DRV:64bit: - [2009/09/11 12:48:46 | 000,041,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WmFilter.sys -- (WmFilter)
DRV:64bit: - [2009/09/11 12:48:36 | 000,026,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmBEnum.sys -- (WmBEnum)
DRV:64bit: - [2009/08/21 12:08:50 | 000,197,120 | ---- | M] (SMI) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SMIksdrv.sys -- (usbsmi)
DRV:64bit: - [2009/08/06 22:24:14 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/07/30 03:20:18 | 000,281,648 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009/07/21 07:20:06 | 000,121,840 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2009/07/16 04:55:34 | 000,011,280 | ---- | M] (Lenovo) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WDMirror.sys -- (wdmirror)
DRV:64bit: - [2009/07/15 20:38:20 | 000,079,376 | ---- | M] (Lenovo) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WDBridge.sys -- (Bridge0)
DRV:64bit: - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 18:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/02 07:55:38 | 000,044,912 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)
DRV:64bit: - [2009/06/28 19:17:00 | 000,070,656 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\enecir.sys -- (enecir)
DRV:64bit: - [2009/06/10 13:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/06/06 17:36:46 | 000,317,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)
DRV:64bit: - [2009/05/19 06:59:00 | 000,014,848 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\enecirhid.sys -- (enecirhid)
DRV:64bit: - [2009/05/19 06:43:32 | 000,026,128 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AcpiVpc.sys -- (ACPIVPC)
DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/05/13 17:51:40 | 005,435,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw5v64.sys -- (netw5v64) Intel(R)
DRV:64bit: - [2009/05/08 01:15:18 | 000,215,552 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009/04/29 16:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV:64bit: - [2008/08/06 05:32:16 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV:64bit: - [2008/04/24 03:16:00 | 000,006,656 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\enecirhidma.sys -- (enecirhidma)
DRV - [2009/07/13 18:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.live.com/
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&FORM=LENIE
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.live.com/
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&FORM=LENIE

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3089571139-241592476-2382567337-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-3089571139-241592476-2382567337-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3089571139-241592476-2382567337-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.sitfy.com/search/?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&rls=bJ2hy9lp
IE - HKU\S-1-5-21-3089571139-241592476-2382567337-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3089571139-241592476-2382567337-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "Eazel-FR Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2095689&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:5.9
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.99
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: web2pdfextension@web2pdf.adobedotcom:1.1
FF - prefs.js..extensions.enabledItems: {5F590AA2-1221-4113-A6F4-A4BB62414FAC}:0.45.6.20100202.1
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..keyword.URL: "http://www.sitfy.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=bJ2hy9lp&q="

FF - user.js..keyword.URL: "http://www.sitfy.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=bJ2hy9lp&q="

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll File not found
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.647: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.647: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\MOZILLA THUNDERBIRD [2012/02/03 23:08:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files (x86)\Google\Google Gears\Firefox\ [2010/03/05 23:33:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012/05/31 11:59:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/25 11:19:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/17 14:47:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/05/31 12:00:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012/02/03 23:08:17 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/17 14:47:41 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/05/31 12:00:08 | 000,000,000 | ---D | M]

[2010/01/30 01:16:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\hrabbit\AppData\Roaming\mozilla\Extensions
[2012/06/30 12:59:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\hrabbit\AppData\Roaming\mozilla\Firefox\Profiles\tybajjr6.default\extensions
[2011/04/06 22:23:17 | 000,000,000 | ---D | M] (SmoothWheel (mozdev.org)) -- C:\Users\hrabbit\AppData\Roaming\mozilla\Firefox\Profiles\tybajjr6.default\extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}
[2012/03/29 22:15:00 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\hrabbit\AppData\Roaming\mozilla\Firefox\Profiles\tybajjr6.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/08/15 13:29:04 | 000,000,919 | ---- | M] () -- C:\Users\hrabbit\AppData\Roaming\Mozilla\Firefox\Profiles\tybajjr6.default\searchplugins\conduit.xml
[2011/03/04 19:27:32 | 000,002,197 | ---- | M] () -- C:\Users\hrabbit\AppData\Roaming\Mozilla\Firefox\Profiles\tybajjr6.default\searchplugins\google-search.xml
[2012/04/26 08:41:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/03/13 01:51:15 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2012/05/31 11:59:56 | 000,000,000 | ---D | M] (Adobe Acrobat - Create PDF) -- C:\PROGRAM FILES (X86)\ADOBE\ACROBAT 10.0\ACROBAT\BROWSER\WCFIREFOXEXTN
[2012/06/30 12:59:52 | 000,377,145 | ---- | M] () (No name found) -- C:\USERS\HRABBIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TYBAJJR6.DEFAULT\EXTENSIONS\{AE93811A-5C9A-4D34-8462-F7B864FC4696}.XPI
[2012/06/17 14:47:41 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/03/25 13:59:50 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/02/13 00:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/02/13 00:21:19 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/07/03 19:36:22 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O2 - BHO: (FlashFXP Helper for Internet Explorer) - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\Program Files (x86)\FlashFXP\IEFlash.dll (IniCom Networks, Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3089571139-241592476-2382567337-1003\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKU\S-1-5-21-3089571139-241592476-2382567337-1003\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [IdeaNotesUser] C:\Program Files (x86)\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe (Digital Delivery Networks, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OnekeyDM] C:\Program Files (x86)\Lenovo\OnekeyDM\OnekeyDM.exe ()
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKU\S-1-5-21-3089571139-241592476-2382567337-1003..\Run: [F.lux] C:\Users\hrabbit\Local Settings\Apps\F.lux\flux.exe ()
O4 - HKU\S-1-5-21-3089571139-241592476-2382567337-1003..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3089571139-241592476-2382567337-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3089571139-241592476-2382567337-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra 'Tools' menuitem : &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (PCPitstop Exam)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{10C01644-AD88-49B4-B76C-A73B3D3CFD18}: DhcpNameServer = 192.168.6.1 64.134.255.2 64.134.255.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C98408E1-5DF1-417B-88CE-5E5167F6DDE7}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\gopher - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/09/16 00:07:13 | 000,054,544 | R--- | M] (Electronic Arts) - E:\Autorun.exe -- [ UDF ]
O32 - AutoRun File - [2011/09/15 21:58:13 | 000,000,049 | R--- | M] () - E:\Autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/03 20:09:19 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/07/03 19:43:53 | 000,000,000 | ---D | C] -- C:\windows\temp
[2012/07/03 19:16:04 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2012/07/03 19:16:04 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2012/07/03 19:16:04 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2012/07/03 19:06:51 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/07/03 19:06:17 | 000,000,000 | ---D | C] -- C:\windows\erdnt
[2012/07/02 21:14:51 | 004,568,951 | R--- | C] (Swearware) -- C:\Users\hrabbit\Desktop\ComboFix.exe
[2012/07/02 09:01:39 | 000,000,000 | ---D | C] -- C:\FRST
[2012/06/30 22:40:50 | 000,000,000 | ---D | C] -- C:\Users\hrabbit\AppData\Local\Conduit
[2012/06/30 19:51:02 | 000,000,000 | ---D | C] -- C:\Users\hrabbit\AppData\Roaming\Malwarebytes
[2012/06/30 19:50:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/30 19:50:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/06/30 19:50:49 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012/06/30 19:50:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/06/30 18:23:56 | 000,000,000 | -HSD | C] -- C:\windows\SysNative\%APPDATA%
[2012/06/25 11:03:59 | 000,000,000 | ---D | C] -- C:\Users\hrabbit\Desktop\Medium Chest
[2012/06/19 13:21:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fallout New Vegas
[2012/06/18 13:24:06 | 000,000,000 | ---D | C] -- C:\Users\hrabbit\Desktop\packages
[2012/06/05 12:57:58 | 000,274,432 | ---- | C] (Riverdeep Interactive Learning Limited) -- C:\windows\TLCUninstall.exe
[2012/06/04 10:44:29 | 000,000,000 | ---D | C] -- C:\Program Files\OT2
[2 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/03 21:06:59 | 000,013,632 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/03 21:06:59 | 000,013,632 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/03 20:59:21 | 000,000,892 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/03 20:59:14 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/07/03 20:59:07 | 3214,028,800 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/03 20:57:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/07/03 20:54:02 | 000,000,896 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/03 20:15:36 | 000,847,098 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012/07/03 20:15:36 | 000,708,824 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012/07/03 20:15:36 | 000,139,432 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012/07/03 19:36:22 | 000,000,027 | ---- | M] () -- C:\windows\SysNative\drivers\etc\hosts
[2012/07/02 21:15:07 | 004,568,951 | R--- | M] (Swearware) -- C:\Users\hrabbit\Desktop\ComboFix.exe
[2012/06/30 19:50:52 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/27 18:46:58 | 002,720,727 | ---- | M] () -- C:\Users\hrabbit\Desktop\IMG_3082.JPG
[2012/06/25 11:07:59 | 000,295,284 | ---- | M] () -- C:\Users\hrabbit\Desktop\keaton mask unlined.pdf
[2012/06/25 11:06:54 | 000,293,155 | R--- | M] () -- C:\Users\hrabbit\Desktop\keaton mask.pdo
[2012/06/25 10:41:13 | 019,179,063 | ---- | M] () -- C:\Users\hrabbit\Desktop\Adult Link Equipment Pack.RAR
[2012/06/19 13:21:06 | 000,001,316 | ---- | M] () -- C:\Users\Public\Desktop\Fallout New Vegas.lnk
[2012/06/17 19:15:49 | 000,002,156 | ---- | M] () -- C:\Users\Public\Desktop\The Sims™ 3 Pets.lnk
[2012/06/07 19:20:35 | 000,000,039 | ---- | M] () -- C:\windows\WININIT.INI
[2012/06/05 12:57:40 | 000,000,000 | ---- | M] () -- C:\windows\setup32.INI
[2 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/03 19:16:04 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe
[2012/07/03 19:16:04 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2012/07/03 19:16:04 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2012/07/03 19:16:04 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2012/07/03 19:16:04 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2012/06/30 19:50:52 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/30 18:20:40 | 000,000,830 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/06/27 19:47:24 | 002,720,727 | ---- | C] () -- C:\Users\hrabbit\Desktop\IMG_3082.JPG
[2012/06/25 11:07:59 | 000,295,284 | ---- | C] () -- C:\Users\hrabbit\Desktop\keaton mask unlined.pdf
[2012/06/25 11:06:57 | 000,293,155 | R--- | C] () -- C:\Users\hrabbit\Desktop\keaton mask.pdo
[2012/06/25 10:40:24 | 019,179,063 | ---- | C] () -- C:\Users\hrabbit\Desktop\Adult Link Equipment Pack.RAR
[2012/06/25 00:31:35 | 001,085,593 | ---- | C] () -- C:\Users\hrabbit\Desktop\WhiteWolfos-Letter_Lines.pdf
[2012/06/25 00:31:35 | 000,964,567 | ---- | C] () -- C:\Users\hrabbit\Desktop\WhiteWolfos-Letter_NoLines.pdf
[2012/06/25 00:31:35 | 000,962,679 | ---- | C] () -- C:\Users\hrabbit\Desktop\WhiteWolfos-Letter.pdo
[2012/06/19 13:21:06 | 000,001,316 | ---- | C] () -- C:\Users\Public\Desktop\Fallout New Vegas.lnk
[2012/06/19 11:31:10 | 000,045,026 | ---- | C] () -- C:\Users\hrabbit\Desktop\IMG_7607.JPG
[2012/06/17 19:15:49 | 000,002,156 | ---- | C] () -- C:\Users\Public\Desktop\The Sims™ 3 Pets.lnk
[2012/06/07 19:20:35 | 000,000,039 | ---- | C] () -- C:\windows\WININIT.INI
[2012/06/05 12:57:40 | 000,000,000 | ---- | C] () -- C:\windows\setup32.INI
[2011/12/01 20:55:52 | 003,123,272 | ---- | C] () -- C:\windows\SysWow64\pbsvc.exe
[2011/08/29 21:32:07 | 000,000,600 | ---- | C] () -- C:\Users\hrabbit\AppData\Local\PUTTY.RND
[2011/06/01 00:40:10 | 000,280,976 | ---- | C] () -- C:\windows\SysWow64\PnkBstrB.exe
[2011/06/01 00:40:05 | 000,075,136 | ---- | C] () -- C:\windows\SysWow64\PnkBstrA.exe
[2011/04/09 18:55:28 | 000,179,261 | ---- | C] () -- C:\windows\SysWow64\xlive.dll.cat
[2011/02/13 00:21:09 | 000,010,458 | ---- | C] () -- C:\Users\hrabbit\short bio.pdf
[2010/10/19 18:34:25 | 000,007,601 | ---- | C] () -- C:\Users\hrabbit\AppData\Local\Resmon.ResmonCfg
[2010/06/02 18:30:10 | 000,016,456 | ---- | C] () -- C:\Users\hrabbit\Snapshot 18.jpg
[2010/03/13 01:53:20 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/01/30 00:24:11 | 000,000,088 | ---- | C] () -- C:\ProgramData\profile.xml

========== LOP Check ==========

[2010/09/25 21:54:37 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\.minecraft
[2010/01/30 13:47:56 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\acccore
[2010/12/22 02:22:21 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\Beat Hazard
[2010/04/06 15:20:05 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\DAEMON Tools Lite
[2011/09/17 21:34:52 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\Downloaded Installations
[2012/06/03 16:32:58 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\Dropbox
[2012/07/03 14:41:48 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\FileZilla
[2011/08/08 19:54:42 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\GetRightToGo
[2010/01/30 00:20:37 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\ID Vault
[2010/01/29 23:33:18 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\Lenovo
[2010/07/28 12:42:50 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\ManyCam
[2010/04/05 22:55:45 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\NVD
[2011/12/27 01:18:31 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\ooVoo Details
[2011/11/06 01:28:58 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\Origin
[2011/06/01 00:40:04 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\PunkBuster
[2012/03/10 14:05:02 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\Rainmeter
[2011/01/11 17:34:27 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\Rovio
[2010/11/09 20:45:18 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\SoftGrid Client
[2010/03/18 16:13:52 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\StepMania 4
[2010/10/13 10:40:05 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\SystemRequirementsLab
[2010/04/05 22:55:37 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\TP
[2011/12/13 20:46:53 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\Ubisoft
[2010/10/21 21:15:40 | 000,000,000 | ---D | M] -- C:\Users\hrabbit\AppData\Roaming\Windows Live Writer
[2012/06/30 20:07:16 | 000,032,602 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

hrabbit · Jul 4, 2012

[CENTER]------------------Extras.txt-------------------[/CENTER]
[LEFT] [/LEFT]
[LEFT]OTL Extras logfile created on: 7/3/2012 9:04:21 PM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Hanna\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.99 Gb Total Physical Memory | 2.45 Gb Available Physical Memory | 61.49% Memory free
7.98 Gb Paging File | 6.28 Gb Available in Paging File | 78.63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 420.55 Gb Total Space | 119.95 Gb Free Space | 28.52% Space Free | Partition Type: NTFS
Drive D: | 30.25 Gb Total Space | 29.17 Gb Free Space | 96.46% Space Free | Partition Type: NTFS
Drive E: | 5.30 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive G: | 980.72 Mb Total Space | 72.77 Mb Free Space | 7.42% Space Free | Partition Type: FAT

Computer Name: CHARLES | User Name: hrabbit | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-3089571139-241592476-2382567337-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{4A768100-D38D-435E-B895-3EB8494D9356}C:\program files (x86)\windows live\messenger\msnmsgr.exe" = protocol=6 | dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"UDP Query User{4DFCAEBB-E35E-4FB0-A960-9AB4A2335034}C:\program files (x86)\windows live\messenger\msnmsgr.exe" = protocol=17 | dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{587F20B7-4193-4400-B404-C6E3E1919BCA}" = ESET NOD32 Antivirus
"{77B8B4A5-EE79-4907-A318-2DA86325B8D7}" = iTunes
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96F70DF8-160F-4F9C-9B9E-2A9B439B4EB9}" = Broadcom Gigabit NetLink Controller
"{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}" = Microsoft SQL Server Native Client
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB3}" = Paint.NET v3.5.8
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 260.99
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.1.9.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B636C9B9-A3F2-4DCE-ADCC-72E095018385}" = Microsoft SQL Server VSS Writer
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{c57f437a-af10-428d-bccc-ec62d399353b}.sdb" = things
"{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour
"{E5C95CA5-4565-4B9D-97ED-05088D775614}" = Apple Mobile Device Support
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"3BA80AB4C7E9F8497C115C844953A3D4BEB84D21" = Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800)
"6B6B5E96843E55CF5CF8C7E45FB457F1FE642FF1" = Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405)
"6B8550A319DDC8B17F35F4A89988705E4592349B" = Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000)
"92F4CDC794E6E4E29DC063D292D1C94F6FA1EA1E" = Windows Driver Package - Lenovo (ACPIVPC) System (05/19/2009 4.4.0.1)
"CCleaner" = CCleaner
"CutePDF Writer Installation" = CutePDF Writer 2.8
"FFE7D41DF3C645075BB149E21988B63996C34187" = ENE CIR Receiver Driver
"Lenovo EasyCamera" = Lenovo EasyCamera
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{17542DBF-E17C-4562-BC4D-FA3EF3076C45}" = Lenovo ReadyComm 5
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F}_is1" = Fallout New Vegas
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}" = Google Gears
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{45057FCE-5784-48BE-8176-D9D00AF56C3C}" = The Sims™ 3 Late Night
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{675DD1E6-637A-4F0E-B6DE-26F45CC26092}_is1" = AC2 server emulator 0.44 by Dormine
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76C66170-C538-4E77-B54D-48E136B5B533}" = Lenovo ReadyComm 5.0 Service
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_PROPLUS_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{96E3AED5-3D0B-4BB0-84C2-1EDADB204487}" = FlashFXP v3
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B304612-421E-4CC3-84A1-5BAAC1CBE409}" = Onekey Theater
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A06E1854-1580-4157-AD70-72734D324DEA}" = Lenovo Idea Notes
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC76BA86-1033-F400-7760-000000000005}" = Adobe Acrobat X Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.0
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AE1E24C2-E720-42D5-B8E1-48F71A97B4DB}" = Energy Management
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 SP2
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{BBB3F622-D848-4CDA-B282-CC53627432F0}" = Microsoft Application Compatibility Toolkit 5.5
"{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C12631C6-804D-4B32-B0DD-8A496462F106}" = The Sims™ 3 Pets
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F2602F16-02D1-4F1C-99A5-E246C522A59D}" = Lenovo First Boot
"{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}" = ooVoo
"{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}" = Lenovo EasyCamera
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Age of Mythology 1.0" = Age of Mythology
"Age of Mythology Expansion Pack 1.0" = Age of Mythology - The Titans Expansion
"AIM_7" = AIM 7
"Audacity_is1" = Audacity 1.2.6
"Business Contact Manager" = Business Contact Manager for Outlook 2007 SP2
"Carnivores" = Carnivores
"Debut" = Debut Video Capture Software
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"InstallShield_{9B304612-421E-4CC3-84A1-5BAAC1CBE409}" = Onekey Theater
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.7.0 (Basic)
"Lenovo SlideNav" = Lenovo SlideNav
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"ManyCam" = ManyCam 2.5.48 (remove only)
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 13.0.1 (x86 en-US)" = Mozilla Firefox 13.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"pepakura_viewer3en" = Pepakura Viewer 3
"PROPLUS" = Microsoft Office Professional Plus 2007
"PunkBusterSvc" = PunkBuster Services
"Rainmeter" = Rainmeter
"RealPlayer 12.0" = RealPlayer
"Rockstar Games Social Club" = Rockstar Games Social Club
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"SprayR" = SprayR 1.0 RC7b
"Steam App 105600" = Terraria
"Steam App 1250" = Killing Floor
"Steam App 12900" = Audiosurf
"Steam App 130" = Half-Life: Blue Shift
"Steam App 201870" = Assassin's Creed Revelations
"Steam App 220" = Half-Life 2
"Steam App 380" = Half-Life 2: Episode One
"Steam App 3830" = Psychonauts
"Steam App 400" = Portal
"Steam App 420" = Half-Life 2: Episode Two
"Steam App 440" = Team Fortress 2
"Steam App 50" = Half-Life: Opposing Force
"Steam App 500" = Left 4 Dead
"Steam App 550" = Left 4 Dead 2
"Steam App 620" = Portal 2
"Steam App 65800" = Dungeon Defenders
"Steam App 70" = Half-Life
"Steam App 91600" = Sanctum
"StepMania" = StepMania (remove only)
"SystemRequirementsLab" = System Requirements Lab
"Voobly_is1" = Voobly Game Data
"VTFEdit_is1" = VTFEdit 1.2.5
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Yahoo! Software Update" = Yahoo! Software Update
"Zoo Tycoon 1.0" = Zoo Tycoon: Complete Collection

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3089571139-241592476-2382567337-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Flux" = F.lux
"Yume Nikki 0.10 English v3" = Yume Nikki 0.10 English v3

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 7/3/2012 8:01:57 PM | Computer Name = Charles | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8352075

Error - 7/3/2012 8:01:58 PM | Computer Name = Charles | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/3/2012 8:01:58 PM | Computer Name = Charles | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8353229

Error - 7/3/2012 8:01:58 PM | Computer Name = Charles | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8353229

Error - 7/3/2012 8:01:59 PM | Computer Name = Charles | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/3/2012 8:01:59 PM | Computer Name = Charles | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8354243

Error - 7/3/2012 8:01:59 PM | Computer Name = Charles | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8354243

Error - 7/3/2012 10:22:36 PM | Computer Name = Charles | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 10:22:36 PM | Computer Name = Charles | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 7/3/2012 11:03:01 PM | Computer Name = Charles | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

[ System Events ]
Error - 7/3/2012 10:35:38 PM | Computer Name = Charles | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.
Use
the string "705AB64E0313" to identify the interface for which initialization failed.
It represents the MAC address of the failed interface or the Globally Unique Interface
Identifier (GUID) if NetBT was unable to map from GUID to MAC address. If neither
the MAC address nor the GUID were available, the string represents a cluster device
name.

Error - 7/3/2012 10:35:44 PM | Computer Name = Charles | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.
Use
the string "00216A9697C8" to identify the interface for which initialization failed.
It represents the MAC address of the failed interface or the Globally Unique Interface
Identifier (GUID) if NetBT was unable to map from GUID to MAC address. If neither
the MAC address nor the GUID were available, the string represents a cluster device
name.

Error - 7/3/2012 10:35:52 PM | Computer Name = Charles | Source = Service Control Manager | ID = 7000
Description = The ReadyComm.DirectRouter service failed to start due to the following
error: %%2

Error - 7/3/2012 10:35:52 PM | Computer Name = Charles | Source = Service Control Manager | ID = 7023
Description = The Windows Defender service terminated with the following error:
%%126

Error - 7/3/2012 11:09:02 PM | Computer Name = Charles | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.
Use
the string "705AB64E0313" to identify the interface for which initialization failed.
It represents the MAC address of the failed interface or the Globally Unique Interface
Identifier (GUID) if NetBT was unable to map from GUID to MAC address. If neither
the MAC address nor the GUID were available, the string represents a cluster device
name.

Error - 7/3/2012 11:09:08 PM | Computer Name = Charles | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.
Use
the string "00216A9697C8" to identify the interface for which initialization failed.
It represents the MAC address of the failed interface or the Globally Unique Interface
Identifier (GUID) if NetBT was unable to map from GUID to MAC address. If neither
the MAC address nor the GUID were available, the string represents a cluster device
name.

Error - 7/3/2012 11:09:14 PM | Computer Name = Charles | Source = Service Control Manager | ID = 7000
Description = The ReadyComm.DirectRouter service failed to start due to the following
error: %%2

Error - 7/3/2012 11:59:08 PM | Computer Name = Charles | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.
Use
the string "705AB64E0313" to identify the interface for which initialization failed.
It represents the MAC address of the failed interface or the Globally Unique Interface
Identifier (GUID) if NetBT was unable to map from GUID to MAC address. If neither
the MAC address nor the GUID were available, the string represents a cluster device
name.

Error - 7/3/2012 11:59:15 PM | Computer Name = Charles | Source = NetBT | ID = 4311
Description = Initialization failed because the driver device could not be created.
Use
the string "00216A9697C8" to identify the interface for which initialization failed.
It represents the MAC address of the failed interface or the Globally Unique Interface
Identifier (GUID) if NetBT was unable to map from GUID to MAC address. If neither
the MAC address nor the GUID were available, the string represents a cluster device
name.

Error - 7/3/2012 11:59:20 PM | Computer Name = Charles | Source = Service Control Manager | ID = 7000
Description = The ReadyComm.DirectRouter service failed to start due to the following
error: %%2

< End of report >
[/LEFT]

Broni · Jul 4, 2012

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3089571139-241592476-2382567337-1003\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

============================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

3. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

4. Please, run F-Secure Online Scanner

Disable your Antivirus program.
Checkmark I have read and accepted the license terms.
Click on Run Check button.
Quick scan (recommended) option will come pre-checked. Don't change it.
Click on Start button.
When scan is done, in Step 3: Clean the files, leave all settings as they're.
Click Next button.
Click Full report... button.
Copy report's content and paste it into your next reply.

hrabbit · Jul 4, 2012

Here's the results of the OTL scan

All processes killed
Error: Unable to interpret <Code:> in the current context!
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3089571139-241592476-2382567337-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: hrabbit
->Temp folder emptied: 3395 bytes
->Temporary Internet Files folder emptied: 204480621 bytes
->Java cache emptied: 12933184 bytes
->FireFox cache emptied: 199013682 bytes
->Flash cache emptied: 1355 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 125858032 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 517.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: hrabbit
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: hrabbit
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.53.1 log created on 07032012_222000

Files\Folders moved on Reboot...
C:\Users\hrabbit\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\hrabbit\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...

hrabbit · Jul 4, 2012

[CENTER]----------------Security check results--------------[/CENTER]
[LEFT] [/LEFT]
[LEFT] Results of screen317's Security Check version 0.99.24
Windows 7 x64 (UAC is enabled)
Internet Explorer 8 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Java(TM) 6 Update 31
Adobe Flash Player ( 10.3.183.5) Flash Player Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Malwarebytes' Anti-Malware mbamservice.exe
Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe
``````````End of Log````````````[/LEFT]
[LEFT] [/LEFT]
[LEFT] [/LEFT]
[CENTER]---------------FFS-------------[/CENTER]
[CENTER] [/CENTER]
[CENTER] [/CENTER]
[LEFT]Farbar Service Scanner Version: 02-07-2012
Ran by hrabbit (administrator) on 03-07-2012 at 22:42:43
Running from "C:\Users\hrabbit\Downloads"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============
BITS Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to retrieve start type of BITS. The value does not exist.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****[/LEFT]
[LEFT] [/LEFT]
[LEFT] [/LEFT]

hrabbit · Jul 4, 2012

[FONT=Arial] Alright, all done now. Here is the final report.[/FONT]

[FONT=Arial][/FONT]

[FONT=Arial]Scanning Report[/FONT]

[FONT=Arial]Tuesday, July 3, 2012 23:03:31 - 23:08:35[/FONT]

Computer name: CHARLES
Scanning type: Quick scan
Target: System
[FONT=Arial]6 malware found[/FONT]

TrackingCookie.Questionmarket(spyware)

System (Disinfected)

TrackingCookie.Atdmt(spyware)

System (Disinfected)

TrackingCookie.Doubleclick(spyware)

System (Disinfected)

TrackingCookie.Fastclick(spyware)

System (Disinfected)

TrackingCookie.Adbrite(spyware)

System (Disinfected)

TrackingCookie.Mediaplex(spyware)

System (Disinfected)

[FONT=Arial]Statistics[/FONT]

Scanned:

Files: 6505
System: 6505
Not scanned: 0

Actions:

Disinfected: 6
Renamed: 0
Deleted: 0
Not cleaned: 0
Submitted: 0

[FONT=Arial]Options[/FONT]

Scanning engines:

Broni · Jul 4, 2012

Update Adobe Flash Player
Download the Latest Adobe Flash for Firefox and IE Without Any Extras: http://www.404techsupport.com/2010/...-flash-for-firefox-and-ie-without-any-extras/

==========================================

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it.

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Do NOT post JavaRa log.

=============================================

Now, we have some issue with Windows updates due to a corrupted registry key.

Following steps involve registry editing. Please create new restore point before proceeding!!!
How to:
XP - http://support.microsoft.com/kb/948247
Vista and Seven - http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/

Download Seven.zip file from here: http://www.smartestcomputing.us.com/files/download/9-registry-network-keys/
Unzip the file.
You'll find several files inside.
Double click on bits.reg file and confirm the prompt.
Restart computer.
Post new FSS log.

hrabbit · Jul 4, 2012

[CENTER]-----------------New Fss log----------------[/CENTER]
[CENTER] [/CENTER]
[LEFT]Farbar Service Scanner Version: 02-07-2012
Ran by hrabbit (administrator) on 04-07-2012 at 10:29:56
Running from "C:\Users\hrabbit\Downloads"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****[/LEFT]

Broni · Jul 4, 2012

You got it

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:

Code:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

13. Please, let me know, how your computer is doing.

hrabbit · Jul 4, 2012

All processes killed
Error: Unable to interpret <Code:> in the current context!
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: hrabbit
->Temp folder emptied: 481646280 bytes
->Temporary Internet Files folder emptied: 1331915 bytes
->Java cache emptied: 31659 bytes
->FireFox cache emptied: 167971550 bytes
->Flash cache emptied: 2768 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36076368 bytes
RecycleBin emptied: 7467759 bytes

Total Files Cleaned = 662.00 mb

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: hrabbit
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: hrabbit
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.53.1 log created on 07042012_113921

Files\Folders moved on Reboot...
C:\Users\hrabbit\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\hrabbit\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K5DFCHJK\ADSAdClient31[1].txt not found!
File\Folder C:\Users\hrabbit\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K5DFCHJK\direct;auc.1457544282585229618;ai.254301523.280291971.60097972;ac.1341419725-6486841;wi.234;hi.60;cp.0[1].htm not found!
File\Folder C:\Users\hrabbit\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K5DFCHJK\tt[1].txt not found!

PendingFileRenameOperations files...
File C:\Users\hrabbit\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File C:\Users\hrabbit\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K5DFCHJK\ADSAdClient31[1].txt not found!
File C:\Users\hrabbit\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K5DFCHJK\direct;auc.1457544282585229618;ai.254301523.280291971.60097972;ac.1341419725-6486841;wi.234;hi.60;cp.0[1].htm not found!
File C:\Users\hrabbit\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K5DFCHJK\tt[1].txt not found!

Registry entries deleted on Reboot...

hrabbit · Jul 4, 2012

Ok everything is all scanned and downloaded. Everything is looking great! Thank you so much for your help <3 I don't know what I would have done without it!

Broni · Jul 4, 2012

Way to go!!

Good luck and stay safe

Solved Patched.b.gen.trojan, quarantined but not removed

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 16 +0

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 56,041 +516

Attachments

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 16 +0

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 16 +0

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 16 +0

Posts: 56,041 +516

Similar threads