Solved Stubborn backdoor infection

whiteknight1950 · Aug 8, 2012

Hello

I'm a new user here. Terrific forum for troubled users.

I discovered that Windows Defender preferences had been changed to manual. Ran SystemCare 5 which discovered a Backdoor trojan. Sorry, I did not keep the details.

Now I can boot up but if I attempt to install another malware like Comodo, I get a BSOD. I have run Roguekiller and attach a report. I have also run the Farbar Recovery Scan and have the frst.txt and services.exe results.

Rootkiller report is:

[FONT=Arial]RogueKiller V7.6.5 [08/03/2012] by Tigzy[/FONT]
[FONT=Arial]mail: tigzyRK<at>gmail<dot>com[/FONT]
[FONT=Arial]Feedback: https://www.techspot.com/downloads/5562-roguekiller.html[/FONT]
[FONT=Arial]Blog: http://tigzyrk.blogspot.com[/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version[/FONT]
[FONT=Arial]Started in : Normal mode[/FONT]
[FONT=Arial]User: Mikes [Admin rights][/FONT]
[FONT=Arial]Mode: Scan -- Date: 08/07/2012 17:22:41[/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]¤¤¤ Bad processes: 0 ¤¤¤[/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]¤¤¤ Registry Entries: 4 ¤¤¤[/FONT]
[FONT=Arial][HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND[/FONT]
[FONT=Arial][HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND[/FONT]
[FONT=Arial][HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND[/FONT]
[FONT=Arial][HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND[/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]¤¤¤ Particular Files / Folders: ¤¤¤[/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]¤¤¤ Driver: [LOADED] ¤¤¤[/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]¤¤¤ Infection : ¤¤¤[/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]¤¤¤ HOSTS File: ¤¤¤[/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]¤¤¤ MBR Check: ¤¤¤[/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]+++++ PhysicalDrive0: WDC WD15 00ADFD-00NLR SCSI Disk Device +++++[/FONT]
[FONT=Arial]--- User ---[/FONT]
[FONT=Arial][MBR] ff2ecf268d7af06607021fb345bdc36f[/FONT]
[FONT=Arial][BSP] 681538495c3e4354c8b7457cd59889df : Windows 7 MBR Code[/FONT]
[FONT=Arial]Partition table:[/FONT]
[FONT=Arial]0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 89999 Mo[/FONT]
[FONT=Arial]1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 184322048 | Size: 53087 Mo[/FONT]
[FONT=Arial]User = LL1 ... OK![/FONT]
[FONT=Arial]Error reading LL2 MBR![/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]+++++ PhysicalDrive1: WDC WD50 00AAKS-00UU3 SCSI Disk Device +++++[/FONT]
[FONT=Arial]--- User ---[/FONT]
[FONT=Arial][MBR] c074465a049331b64a83e62ff3ac15bd[/FONT]
[FONT=Arial][BSP] 542b1c9950b67d6fe021c7990e059f6f : Windows Vista MBR Code[/FONT]
[FONT=Arial]Partition table:[/FONT]
[FONT=Arial]0 - [XXXXXX] UNKNOWN (0xee) [VISIBLE] Offset (sectors): 1 | Size: 2097151 Mo[/FONT]
[FONT=Arial]User = LL1 ... OK![/FONT]
[FONT=Arial]Error reading LL2 MBR![/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]Finished : << RKreport[1].txt >>[/FONT]
[FONT=Arial]RKreport[1].txt[/FONT]
[FONT=Arial] [/FONT]
[FONT=Arial]If someone is interested could they let me know and I will post the frst.txt and services.exe from Farbar Scan. I think that the Virus has created an extensive whitelist of its own which is blocking my attempt to intall another viruskiller ![/FONT]

Cheers
Whiteknight[FONT=Arial][/FONT]

whiteknight1950 · Aug 8, 2012

I mistakenly PM'd Dragonmaster in an attempt to get help and now realize that was against the Forum Rules. I apologize. Her is the frst.text of Farbar Scan.

Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 08-08-2012
Ran by SYSTEM at 08-08-2012 14:42:47
Running from G:\
Windows 7 Home Premium (X86) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.)
HKLM\...\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot [296056 2012-05-25] (RealNetworks, Inc.)
HKLM\...\Run: [Cmaudio8788] RunDll32 cmicnfgp.cpl,CMICtrlWnd [x]
HKLM\...\Run: [Cmaudio8788GX] C:\Windows\system\HsMgr.exe Envoke [200704 2008-07-11] ()
HKLM\...\Run: [NVRaidService] C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe [163944 2010-04-09] (NVIDIA Corporation)
HKLM\...\Run: [Malwarebytes' Anti-Malware] "d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [x]
HKU\Mikes\...\Run: [Advanced SystemCare 5] "D:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart [x]
HKU\Mikes\...\Run: [Akamai NetSession Interface] "C:\Users\Mikes\AppData\Local\Akamai\netsession_win.exe" [4327744 2012-05-26] (Akamai Technologies, Inc)
HKU\Mikes\...\Policies\system: [EnableLUA] 0
Tcpip\Parameters: [DhcpNameServer] 10.0.1.1

================================ Services (Whitelisted) ==================

2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [20992 2009-07-13] (Microsoft Corporation)
2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [387616 2009-08-10] ()
2 IMFservice; C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe [821592 2012-01-09] (IObit)
2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [11552 2012-03-26] (Microsoft Corporation)
3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [214952 2012-03-26] (Microsoft Corporation)
2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [178720 2009-08-10] ()
2 nvUpdatusService; C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [1262400 2012-05-15] (NVIDIA Corporation)
2 AdvancedSystemCareService5; C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe [x]
2 MBAMService; "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [x]
3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2011.SP4\RpcAgentSrv.exe [x]

========================== Drivers (Whitelisted) =============

3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [1760256 2011-03-10] (C-Media Inc)
2 cpuz135; \??\C:\Windows\system32\drivers\cpuz135_x32.sys [21992 2010-11-09] (CPUID)
3 DrvAgent32; \??\C:\Windows\system32\Drivers\DrvAgent32.sys [23456 2012-06-23] (Phoenix Technologies)
1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [31088 2010-12-16] (Elaborate Bytes AG)
3 FileMonitor; \??\C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [20336 2012-01-05] (IObit)
0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [22344 2012-07-03] (Malwarebytes Corporation)
0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
3 NVNET; C:\Windows\System32\DRIVERS\nvmf6232.sys [295272 2009-11-11] (NVIDIA Corporation)
3 RegFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [30600 2011-09-20] (IObit.com)
0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [15672 2010-11-26] ()
0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
0 sptd; C:\Windows\System32\Drivers\sptd.sys [477240 2012-07-09] (Duplex Secure Ltd.)
3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26112 2011-07-13] (The OpenVPN Project)
3 UrlFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [19792 2011-09-20] (IObit.com)
1 MpKsl692f6064; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{ADA8B66C-DDC9-484E-9A94-A5A08E37B707}\MpKsl692f6064.sys [x]
3 RTCore32; \??\D:\Program Files\EVGA Precision\RTCore32.sys [x]
3 SANDRA; \??\d:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP4c\WNt500x86\Sandra.sys [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-08-08 13:22 - 2012-08-08 13:22 - 336178085 ____A C:\Windows\MEMORY.DMP
2012-08-08 13:22 - 2012-08-08 13:22 - 00155288 ____A C:\Windows\Minidump\080812-29998-01.dmp
2012-08-08 13:22 - 2012-08-08 13:22 - 00000056 ____A C:\Windows\setupact.log
2012-08-08 13:22 - 2012-08-08 13:22 - 00000000 ____A C:\Windows\setuperr.log
2012-08-08 13:12 - 2012-08-08 13:12 - 00000000 ____D C:\Program Files\COMODO
2012-08-08 01:19 - 2012-08-08 01:19 - 03907920 ____A (Piriform Ltd) C:\Users\Mikes\Downloads\ccsetup321.exe
2012-08-07 17:48 - 2012-08-07 17:48 - 00000000 ____D C:\FRST
2012-08-07 16:30 - 2012-08-07 16:30 - 00892900 ____A (Farbar) C:\Users\Mikes\Downloads\FRST.exe
2012-08-07 16:22 - 2012-08-07 16:22 - 00001667 ____A C:\Users\Mikes\Desktop\RKreport[1].txt
2012-08-07 16:21 - 2012-08-07 16:22 - 00000000 ____D C:\Users\Mikes\Desktop\RK_Quarantine
2012-08-06 16:01 - 2012-08-07 10:42 - 00000000 ____D C:\Program Files\Vuze
2012-08-06 15:23 - 2012-08-06 15:23 - 00000000 ____D C:\Users\Mikes\AppData\Local\Apps\2.0
2012-08-06 15:11 - 2012-08-06 15:11 - 00000689 ____A C:\Users\UpdatusUser\Desktop\Free Window Registry Repair.lnk
2012-08-06 15:11 - 2012-08-06 15:11 - 00000689 ____A C:\Users\Mikes\Desktop\Free Window Registry Repair.lnk
2012-08-06 15:11 - 2012-08-06 15:10 - 00799416 ____A C:\Users\Mikes\Downloads\RegpairSetup.exe
2012-08-06 15:10 - 2012-08-06 15:10 - 00463080 ____A (CNET Download.com) C:\Users\Mikes\Downloads\cnet2_RegpairSetup_exe.exe
2012-08-06 15:02 - 2012-08-06 15:02 - 00000114 ____A C:\Users\Mikes\Downloads\renew-ip-reset-winsock.bat
2012-08-05 15:06 - 2012-08-08 02:06 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-08-05 15:06 - 2012-08-05 15:06 - 00000763 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-08-05 15:06 - 2012-08-05 15:06 - 00000000 ____D C:\Users\Mikes\AppData\Roaming\Malwarebytes
2012-08-05 15:06 - 2012-07-03 12:46 - 00022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-08-02 09:05 - 2012-08-02 09:08 - 00000000 ____D C:\Users\Mikes\Documents\Asus Xonar Dx
2012-08-02 09:04 - 2012-08-08 14:20 - 00000000 ____D C:\Users\Mikes\AppData\Local\Akamai
2012-08-02 09:04 - 2012-08-02 09:04 - 10720808 ____A (Akamai Technologies, Inc) C:\Users\Mikes\Downloads\AsusInstaller.exe
2012-08-01 11:56 - 2012-08-01 11:56 - 00000689 ____A C:\Users\UpdatusUser\Desktop\SpeedFan.lnk
2012-08-01 11:56 - 2012-08-01 11:56 - 00000689 ____A C:\Users\Mikes\Desktop\SpeedFan.lnk
2012-08-01 11:56 - 2012-08-01 11:56 - 00000045 ____A C:\Windows\System32\initdebug.nfo
2012-08-01 10:50 - 2012-08-08 02:08 - 00000000 ____D C:\Windows\pss
2012-07-31 09:41 - 2012-07-31 09:41 - 00000000 ____D C:\Users\Mikes\Documents\SniperEliteV2_Benchmark
2012-07-30 10:07 - 2012-08-08 02:08 - 00000000 ____D C:\Users\Mikes\AppData\Local\SniperV2
2012-07-22 17:28 - 2012-08-08 01:20 - 00000000 ____D C:\Users\Mikes\AppData\Roaming\uTorrent
2012-07-22 17:28 - 2012-07-22 17:28 - 00000637 ____A C:\Users\Public\Desktop\µTorrent.lnk
2012-07-18 17:50 - 2012-07-18 17:50 - 00000000 ____D C:\Users\Mikes\AppData\Local\Spoon
2012-07-18 10:33 - 2012-08-08 02:08 - 00000000 ____D C:\Program Files\Vuze_Remote
2012-07-18 10:33 - 2012-07-18 10:33 - 00000000 ____D C:\Program Files\Conduit
2012-07-15 15:14 - 2012-07-15 15:14 - 00000000 ____D C:\Windows\Sun
2012-07-11 15:19 - 2012-06-02 01:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-07-11 15:19 - 2012-06-02 00:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-07-11 15:19 - 2012-06-02 00:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-07-11 15:19 - 2012-06-02 00:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-07-11 15:19 - 2012-06-02 00:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-07-11 15:19 - 2012-06-02 00:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-07-11 15:19 - 2012-06-02 00:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-07-11 15:19 - 2012-06-02 00:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-07-11 15:19 - 2012-06-02 00:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-07-11 15:19 - 2012-06-02 00:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-07-11 15:19 - 2012-06-02 00:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-07-11 15:19 - 2012-06-02 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-07-11 15:19 - 2012-06-02 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-07-11 15:19 - 2012-06-02 00:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-07-11 15:17 - 2012-06-11 18:40 - 02345984 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-07-11 08:30 - 2012-06-08 20:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-07-11 08:30 - 2012-06-05 21:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2012-07-11 08:30 - 2012-06-05 21:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2012-07-11 08:30 - 2012-06-05 21:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll
2012-07-11 08:30 - 2012-06-01 20:45 - 00134000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2012-07-11 08:30 - 2012-06-01 20:45 - 00067440 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-07-11 08:30 - 2012-06-01 20:40 - 00369336 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2012-07-11 08:30 - 2012-06-01 20:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-07-11 08:30 - 2012-06-01 20:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2012-07-11 08:30 - 2010-06-25 19:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll
2012-07-10 09:29 - 2012-07-10 09:29 - 00001106 ____A C:\Users\Public\Desktop\SiSoftware Sandra Professional Business 2011.SP4.lnk
2012-07-10 09:02 - 2012-08-03 09:49 - 11710464 ____A C:\Users\Mikes\AppData\Roaming\Sandra.mdb
2012-07-10 08:15 - 2012-07-10 08:15 - 00001769 ____A C:\Users\UpdatusUser\Desktop\MagicISO.lnk
2012-07-10 08:15 - 2012-07-10 08:15 - 00001769 ____A C:\Users\Mikes\Desktop\MagicISO.lnk
2012-07-10 08:15 - 2012-07-10 08:15 - 00000000 ____D C:\Program Files\MagicISO
2012-07-09 17:52 - 2012-07-09 17:53 - 00000000 ____D C:\Users\Mikes\AppData\Roaming\Nero
2012-07-09 17:51 - 2012-07-09 17:51 - 00002654 ____A C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
2012-07-09 17:51 - 2012-07-09 17:51 - 00000000 ____D C:\Program Files\Nero
2012-07-09 17:50 - 2012-07-09 17:51 - 00000000 ____D C:\Users\All Users\Nero
2012-07-09 17:50 - 2012-07-09 17:51 - 00000000 ____D C:\Program Files\Common Files\Nero
2012-07-09 17:40 - 2012-07-09 17:40 - 00477240 ____A (Duplex Secure Ltd.) C:\Windows\System32\Drivers\sptd.sys
2012-07-09 17:39 - 2012-07-09 17:39 - 01065832 ____A C:\Users\Mikes\Downloads\Alcohol120_trial_2.0.2.3931.exe

============ 3 Months Modified Files ========================

2012-08-08 13:40 - 2011-09-07 11:10 - 00000459 ____A C:\Windows\BRWMARK.INI
2012-08-08 13:40 - 2011-08-26 09:52 - 01107384 ____A C:\Windows\WindowsUpdate.log
2012-08-08 13:30 - 2009-07-13 20:34 - 00022256 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-08-08 13:30 - 2009-07-13 20:34 - 00022256 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-08-08 13:25 - 2012-04-03 07:43 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-08-08 13:22 - 2012-08-08 13:22 - 336178085 ____A C:\Windows\MEMORY.DMP
2012-08-08 13:22 - 2012-08-08 13:22 - 00155288 ____A C:\Windows\Minidump\080812-29998-01.dmp
2012-08-08 13:22 - 2012-08-08 13:22 - 00000056 ____A C:\Windows\setupact.log
2012-08-08 13:22 - 2012-08-08 13:22 - 00000000 ____A C:\Windows\setuperr.log
2012-08-08 13:22 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-08-08 01:20 - 2011-08-26 11:03 - 00000689 ____A C:\Users\Public\Desktop\CCleaner.lnk
2012-08-08 01:19 - 2012-08-08 01:19 - 03907920 ____A (Piriform Ltd) C:\Users\Mikes\Downloads\ccsetup321.exe
2012-08-08 01:11 - 2011-08-26 09:53 - 00743162 ____A C:\Windows\System32\PerfStringBackup.INI
2012-08-07 16:30 - 2012-08-07 16:30 - 00892900 ____A (Farbar) C:\Users\Mikes\Downloads\FRST.exe
2012-08-07 16:22 - 2012-08-07 16:22 - 00001667 ____A C:\Users\Mikes\Desktop\RKreport[1].txt
2012-08-06 16:32 - 2012-06-19 08:54 - 42381312 ____A C:\Windows\System32\config\software.iobit
2012-08-06 16:32 - 2012-06-19 08:54 - 19808256 ____A C:\Windows\System32\config\system.iobit
2012-08-06 16:32 - 2012-06-19 08:54 - 00188416 ____A C:\Windows\System32\config\default.iobit
2012-08-06 16:32 - 2012-06-19 08:54 - 00061440 ____A C:\Windows\System32\config\sam.iobit
2012-08-06 16:32 - 2012-06-19 08:54 - 00028672 ____A C:\Windows\System32\config\security.iobit
2012-08-06 15:11 - 2012-08-06 15:11 - 00000689 ____A C:\Users\UpdatusUser\Desktop\Free Window Registry Repair.lnk
2012-08-06 15:11 - 2012-08-06 15:11 - 00000689 ____A C:\Users\Mikes\Desktop\Free Window Registry Repair.lnk
2012-08-06 15:10 - 2012-08-06 15:11 - 00799416 ____A C:\Users\Mikes\Downloads\RegpairSetup.exe
2012-08-06 15:10 - 2012-08-06 15:10 - 00463080 ____A (CNET Download.com) C:\Users\Mikes\Downloads\cnet2_RegpairSetup_exe.exe
2012-08-06 15:02 - 2012-08-06 15:02 - 00000114 ____A C:\Users\Mikes\Downloads\renew-ip-reset-winsock.bat
2012-08-05 15:19 - 2012-03-12 07:20 - 00002198 ____A C:\Windows\epplauncher.mif
2012-08-05 15:06 - 2012-08-05 15:06 - 00000763 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-08-05 14:35 - 2011-12-08 07:59 - 24973312 ____A C:\Windows\System32\config\components.iobit
2012-08-03 09:49 - 2012-07-10 09:02 - 11710464 ____A C:\Users\Mikes\AppData\Roaming\Sandra.mdb
2012-08-02 13:25 - 2012-04-03 07:43 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2012-08-02 13:25 - 2011-08-26 14:12 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-08-02 09:09 - 2011-08-27 17:00 - 00413696 ____A (Creative Labs) C:\Windows\System32\wrap_oal.dll
2012-08-02 09:09 - 2011-08-27 17:00 - 00102400 ____A (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\System32\OpenAL32.dll
2012-08-02 09:08 - 2011-10-29 14:49 - 00238953 ____A C:\Windows\Cmicnfgp.ini.cfl
2012-08-02 09:08 - 2011-10-29 14:49 - 00000931 ____A C:\Windows\Cmicnfgp.ini.imi
2012-08-02 09:04 - 2012-08-02 09:04 - 10720808 ____A (Akamai Technologies, Inc) C:\Users\Mikes\Downloads\AsusInstaller.exe
2012-08-01 11:56 - 2012-08-01 11:56 - 00000689 ____A C:\Users\UpdatusUser\Desktop\SpeedFan.lnk
2012-08-01 11:56 - 2012-08-01 11:56 - 00000689 ____A C:\Users\Mikes\Desktop\SpeedFan.lnk
2012-08-01 11:56 - 2012-08-01 11:56 - 00000045 ____A C:\Windows\System32\initdebug.nfo
2012-07-22 17:28 - 2012-07-22 17:28 - 00000637 ____A C:\Users\Public\Desktop\µTorrent.lnk
2012-07-18 10:36 - 2011-08-26 11:45 - 00000629 ____A C:\Users\Public\Desktop\Vuze.lnk
2012-07-12 07:58 - 2009-07-13 20:33 - 00358048 ____A C:\Windows\System32\FNTCACHE.DAT
2012-07-11 15:18 - 2011-08-27 15:39 - 57442464 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-07-11 15:17 - 2009-07-13 18:04 - 00000499 ____A C:\Windows\win.ini
2012-07-10 09:29 - 2012-07-10 09:29 - 00001106 ____A C:\Users\Public\Desktop\SiSoftware Sandra Professional Business 2011.SP4.lnk
2012-07-10 08:15 - 2012-07-10 08:15 - 00001769 ____A C:\Users\UpdatusUser\Desktop\MagicISO.lnk
2012-07-10 08:15 - 2012-07-10 08:15 - 00001769 ____A C:\Users\Mikes\Desktop\MagicISO.lnk
2012-07-09 17:51 - 2012-07-09 17:51 - 00002654 ____A C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
2012-07-09 17:40 - 2012-07-09 17:40 - 00477240 ____A (Duplex Secure Ltd.) C:\Windows\System32\Drivers\sptd.sys
2012-07-09 17:39 - 2012-07-09 17:39 - 01065832 ____A C:\Users\Mikes\Downloads\Alcohol120_trial_2.0.2.3931.exe
2012-07-03 12:46 - 2012-08-05 15:06 - 00022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-06-23 10:18 - 2012-06-23 10:18 - 00624672 ____A (Copyright © 2010 eSupport.com. All Rights Reserved.) C:\Users\Mikes\Downloads\biosagentplus_40.exe
2012-06-23 10:18 - 2012-06-23 10:18 - 00023456 ____A (Phoenix Technologies) C:\Windows\System32\Drivers\DrvAgent32.sys
2012-06-23 10:18 - 2012-06-23 10:18 - 00001090 ____A C:\Users\Mikes\Desktop\BiosAgent Plus.lnk
2012-06-23 09:55 - 2009-07-13 20:53 - 00032638 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-06-17 11:15 - 2012-06-17 11:15 - 00514560 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2012-06-12 16:33 - 2012-06-12 16:33 - 00001260 ____A C:\Users\Mikes\Desktop\MW3 use me.lnk
2012-06-11 18:40 - 2012-07-11 15:17 - 02345984 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-08 20:41 - 2012-07-11 08:30 - 12873728 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-06-07 12:20 - 2012-06-07 12:20 - 00151282 ____N C:\Users\Mikes\Documents\doc-04-78-docsviewer.googleusercontent.com-viewer-securedownload-ponunvtemoqk0uk59r6vfphkre2u5t07-ir7ca55ra7ujcotvanrr2lqkdgslgqhu-1339100100000-Z21haWw=-AGZ5hq_xlJIV0qVl8tNk0aZNeLfC-MTM3OWY5NzBmMjk4NjIxYXwwLjEuMQ==.tif
2012-06-07 12:19 - 2012-06-07 12:19 - 00198308 ____N C:\Users\Mikes\Documents\MTM3OWY5N2Y4NWUxZDY3MXwwLjEuMQ==.tif
2012-06-05 21:05 - 2012-07-11 08:30 - 01390080 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2012-06-05 21:05 - 2012-07-11 08:30 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2012-06-05 21:03 - 2012-07-11 08:30 - 00805376 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll
2012-06-02 14:19 - 2012-06-21 08:29 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-21 08:29 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-21 08:29 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-02 14:19 - 2012-06-21 08:29 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-21 08:29 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-21 08:29 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:12 - 2012-06-21 08:29 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:12 - 2012-06-21 08:29 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 14:12 - 2012-06-21 08:29 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-02 01:07 - 2012-07-11 15:19 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-02 00:43 - 2012-07-11 15:19 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-02 00:33 - 2012-07-11 15:19 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-06-02 00:26 - 2012-07-11 15:19 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-02 00:25 - 2012-07-11 15:19 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-06-02 00:25 - 2012-07-11 15:19 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-02 00:23 - 2012-07-11 15:19 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-02 00:21 - 2012-07-11 15:19 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-02 00:20 - 2012-07-11 15:19 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-06-02 00:19 - 2012-07-11 15:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-02 00:19 - 2012-07-11 15:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-06-02 00:17 - 2012-07-11 15:19 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-02 00:16 - 2012-07-11 15:19 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-02 00:14 - 2012-07-11 15:19 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-01 20:45 - 2012-07-11 08:30 - 00134000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2012-06-01 20:45 - 2012-07-11 08:30 - 00067440 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-06-01 20:40 - 2012-07-11 08:30 - 00369336 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2012-06-01 20:40 - 2012-07-11 08:30 - 00225280 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-06-01 20:39 - 2012-07-11 08:30 - 00219136 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2012-05-25 18:02 - 2012-05-25 18:02 - 00001012 ____A C:\Users\Public\Desktop\RealPlayer.lnk
2012-05-25 18:01 - 2011-12-28 08:43 - 00499712 ____A (Microsoft Corporation) C:\Windows\System32\msvcp71.dll
2012-05-25 18:01 - 2011-12-28 08:43 - 00198832 ____A (RealNetworks, Inc.) C:\Windows\System32\rmoc3260.dll
2012-05-25 18:01 - 2011-12-28 08:43 - 00006656 ____A (RealNetworks, Inc.) C:\Windows\System32\pndx5016.dll
2012-05-25 18:01 - 2011-12-28 08:43 - 00005632 ____A (RealNetworks, Inc.) C:\Windows\System32\pndx5032.dll
2012-05-25 18:01 - 2011-10-14 11:56 - 00272896 ____A (Progressive Networks) C:\Windows\System32\pncrt.dll
2012-05-15 02:26 - 2012-06-23 10:27 - 19607872 ____A (NVIDIA Corporation) C:\Windows\System32\nvoglv32.dll
2012-05-15 02:26 - 2012-06-23 10:27 - 17551680 ____A (NVIDIA Corporation) C:\Windows\System32\nvcompiler.dll
2012-05-15 02:26 - 2012-06-23 10:27 - 15322432 ____A (NVIDIA Corporation) C:\Windows\System32\nvd3dum.dll
2012-05-15 02:26 - 2012-06-23 10:27 - 11354944 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvlddmkm.sys
2012-05-15 02:26 - 2012-06-23 10:27 - 05982528 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuda.dll
2012-05-15 02:26 - 2012-06-23 10:27 - 02524992 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvid.dll
2012-05-15 02:26 - 2012-06-23 10:27 - 02445120 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvenc.dll
2012-05-15 02:26 - 2012-06-23 10:27 - 00301376 ____A (NVIDIA Corporation) C:\Windows\System32\nvdecodemft.dll
2012-05-15 02:26 - 2012-06-23 10:27 - 00202048 ____A (NVIDIA Corporation) C:\Windows\System32\nvinit.dll
2012-05-15 02:26 - 2012-03-13 15:35 - 00061248 ____A (Khronos Group) C:\Windows\System32\OpenCL.dll
2012-05-15 02:26 - 2012-02-21 11:36 - 00818496 ____A (NVIDIA Corporation) C:\Windows\System32\nvumdshim.dll
2012-05-15 02:26 - 2011-08-26 10:36 - 08105280 ____A (NVIDIA Corporation) C:\Windows\System32\nvwgf2um.dll
2012-05-15 02:26 - 2011-08-26 10:36 - 01000768 ____A (NVIDIA Corporation) C:\Windows\System32\nvdispco32.dll
2012-05-15 02:26 - 2011-08-26 10:36 - 00883008 ____A (NVIDIA Corporation) C:\Windows\System32\nvgenco32.dll
2012-05-15 02:26 - 2011-05-21 05:01 - 02368832 ____A (NVIDIA Corporation) C:\Windows\System32\nvapi.dll
2012-05-15 02:26 - 2011-05-21 05:01 - 00011190 ____A C:\Windows\System32\nvinfo.pb
2012-05-15 01:28 - 2012-02-21 11:36 - 02621723 ____A C:\Windows\System32\nvcoproc.bin
2012-05-15 01:28 - 2011-08-26 09:59 - 03931456 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2012-05-15 01:28 - 2011-08-26 09:59 - 00645440 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2012-05-15 01:28 - 2011-08-26 09:59 - 00108352 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2012-05-15 01:28 - 2011-08-26 09:59 - 00062272 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2012-05-15 01:27 - 2011-08-26 09:59 - 02759488 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll
2012-05-15 01:21 - 2012-05-15 01:21 - 00423744 ____A C:\Windows\System32\nvStreaming.exe
2012-05-11 08:08 - 2012-05-11 08:08 - 03968368 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2012-05-11 08:08 - 2012-05-11 08:08 - 03913072 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-05-11 08:08 - 2012-05-11 08:08 - 01291632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2012-05-11 08:08 - 2012-05-11 08:08 - 00056176 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys
2012-05-11 08:05 - 2012-05-11 08:05 - 01077248 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll

========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 11%
Total physical RAM: 4094.54 MB
Available physical RAM: 3609.64 MB
Total Pagefile: 4092.82 MB
Available Pagefile: 3611.51 MB
Total Virtual: 2047.88 MB
Available Virtual: 1967.22 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:87.89 GB) (Free:49.01 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive d: (NewWest) (Fixed) (Total:465.63 GB) (Free:236.27 GB) NTFS
3 Drive e: (Games) (Fixed) (Total:51.84 GB) (Free:31.97 GB) NTFS
5 Drive g: () (Removable) (Total:0.12 GB) (Free:0.12 GB) FAT
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 139 GB 0 B
Disk 1 Online 465 GB 1024 KB *
Disk 2 Online 122 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 87 GB 1024 KB
Partition 2 Primary 51 GB 87 GB

==================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C NTFS Partition 87 GB Healthy

==================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 E Games NTFS Partition 51 GB Healthy

==================================================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Reserved 128 MB 17 KB
Partition 2 Primary 465 GB 129 MB

==================================================================================

Disk: 1
Partition 1
Type : e3c9e316-0b5c-4db8-817d-f92df00215ae
Hidden : Yes
Required: No
Attrib : 0000000000000000

There is no volume associated with this partition.

==================================================================================

Disk: 1
Partition 2
Type : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Hidden : No
Required: No
Attrib : 0000000000000000

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 D NewWest NTFS Partition 465 GB Healthy

==================================================================================

Partitions of Disk 2:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 122 MB 16 KB

==================================================================================

Disk: 2
Partition 1
Type : 06
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 G FAT Removable 122 MB Healthy

==================================================================================

==========================================================

Last Boot: 2012-07-31 10:39

======================= End Of Log ==========================

whiteknight1950 · Aug 8, 2012

This is the Services.exe from Farbar Scan

Farbar Recovery Scan Tool Version: 08-08-2012
Ran by SYSTEM at 2012-08-08 14:43:50
Running from G:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe
[2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6

C:\Windows\System32\services.exe
[2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6

=== End Of Search ===

whiteknight1950 · Aug 8, 2012

Any advice about how to get rid of this pesky fellow and preventing its return would be greatly appreciated !!

Cheers
Whiteknight1950

Broni · Aug 8, 2012

Welcome aboard

Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

========================================

Uninstall Advanced SystemCare 5.
Registry cleaners/optimizers are not recommended for several reasons:

Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".

Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.

whiteknight1950 · Aug 8, 2012

Hello and thanks for your prompt reply to my post.

I will download and install Comodo once this process is finished.

Malwarebytes log is:

Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.08.11

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Mikes :: MIKES-PC [administrator]

Protection: Disabled

8/8/2012 5:10:19 PM
mbam-log-2012-08-08 (17-10-19).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 201424
Time elapsed: 2 minute(s), 49 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

The Gmer log is:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-08-08 17:28:43
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\00000061 WDC_WD15 rev.21.0
Running: gmer.exe; Driver: C:\Users\Mikes\AppData\Local\Temp\kgloypow.sys

---- Devices - GMER 1.0.15 ----

Device \Driver\atapi \Device\Ide\IdePort0 857A61E8
Device \Driver\atapi \Device\Ide\IdePort1 857A61E8
Device \Driver\VClone \Device\Scsi\VClone1Port5Path0Target0Lun0 86E221E8
Device \Driver\VClone \Device\Scsi\VClone1 86E221E8
Device \FileSystem\Ntfs \Ntfs 857AA1E8
Device \FileSystem\fastfat \Fat 87D2F430

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

whiteknight1950 · Aug 8, 2012

Thanks again, the DDS otl is:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31
Run by Mikes at 17:32:03 on 2012-08-08
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2815.1838 [GMT -7:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
D:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
D:\Program Files\IObit\Smart Defrag 2\SmartDefrag.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Real\RealPlayer\Update\realsched.exe
C:\Windows\system\HsMgr.exe
C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe
D:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe
C:\Users\Mikes\AppData\Local\Akamai\netsession_win.exe
C:\Users\Mikes\AppData\Local\Akamai\netsession_win.exe
C:\Program Files\ASUS Xonar DX Audio\Customapp\ASUSAUDIOCENTER.EXE
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\PROGRAM FILES\MICROSOFT INTELLIPOINT\IPOINT.EXE
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
D:\PROGRAM FILES\ITUNES\ITUNESHELPER.EXE
C:\PROGRAM FILES\MICROSOFT SECURITY CLIENT\MSSECES.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\svchost.exe -k SDRSVC
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.babylon.com/?AF=109932&babsrc=HP_ss&mntrId=6024ca09000000000000044b80808004
uInternet Settings,ProxyOverride = *.local;<local>
uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuze.dll
mURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuze.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuze.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuze.dll
uRun: [Advanced SystemCare 5] "d:\program files\iobit\advanced systemcare 5\ASCTray.exe" /AutoStart
uRun: [Akamai NetSession Interface] "c:\users\mikes\appdata\local\akamai\netsession_win.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [Cmaudio8788] RunDll32 cmicnfgp.cpl,CMICtrlWnd
mRun: [Cmaudio8788GX] c:\windows\system\HsMgr.exe Envoke
mRun: [NVRaidService] c:\program files\nvidia corporation\raid\nvraidservice.exe
mRun: [Malwarebytes' Anti-Malware] "d:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRunOnce: [Malwarebytes Anti-Malware] d:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
uPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - d:\progra~1\micros~1\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\progra~1\micros~1\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: DhcpNameServer = 10.0.1.1
TCP: Interfaces\{DA014566-975D-44D4-BB0A-43528C765950} : DhcpNameServer = 10.0.1.1
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\mikes\appdata\roaming\mozilla\firefox\profiles\qhxebwz1.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\users\mikes\appdata\roaming\mozilla\firefox\profiles\qhxebwz1.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\plugins\np-mswmp.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_270.dll
FF - plugin: d:\program files\itunes\mozilla plugins\npitunes.dll
.
---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
FF - user.js: extensions.BabylonToolbar_i.id - 6024ca09000000000000044b80808004
FF - user.js: extensions.BabylonToolbar_i.hardId - 6024ca09000000000000044b80808004
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15408
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1719:21:30
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109932
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 171064]
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2012-1-16 15672]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]
R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;d:\program files\iobit\advanced systemcare 5\ASCService.exe [2011-12-10 478040]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2011-9-2 21992]
R2 IMFservice;IMF Service;c:\program files\iobit\iobit malware fighter\IMFsrv.exe [2011-12-17 821592]
R3 cmudaxp;ASUS Xonar DX Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2011-10-29 1760256]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-8-5 22344]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2012-6-23 148800]
R3 RegFilter;RegFilter;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\RegFilter.sys [2012-3-10 30600]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 MBAMService;MBAMService;d:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-8-8 655944]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-2-10 1262400]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-3 250056]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\drivers\BrSerIb.sys [2009-7-13 265088]
S3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\drivers\BrUsbSIb.sys [2009-7-13 11904]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [2012-6-23 23456]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 74112]
S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2012-3-26 214952]
S3 RTCore32;RTCore32;d:\program files\evga precision\RTCore32.sys [2005-5-25 4608]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\sisoftware\sisoftware sandra professional business 2011.sp4\RpcAgentSrv.exe [2012-7-10 93848]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-8-28 52224]
S3 UrlFilter;UrlFilter;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\UrlFilter.sys [2012-3-10 19792]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-8-27 1343400]
S4 FileMonitor;FileMonitor;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\FileMonitor.sys [2012-3-10 20336]
.
=============== Created Last 30 ================
.
2012-08-09 00:29:29 -------- d-----w- c:\users\mikes\appdata\local\ElevatedDiagnostics
2012-08-08 21:33:40 6891424 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{dc781c86-bcbb-47e3-b0c6-1ff89675c5ff}\mpengine.dll
2012-08-08 21:22:49 6891424 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-08-08 21:12:47 -------- d-----w- c:\program files\COMODO
2012-08-08 01:48:19 -------- d-----w- C:\FRST
2012-08-07 00:01:27 -------- d-----w- c:\program files\Vuze
2012-08-06 23:23:37 -------- d-----w- c:\users\mikes\appdata\local\Apps
2012-08-05 23:06:56 -------- d-----w- c:\users\mikes\appdata\roaming\Malwarebytes
2012-08-05 23:06:43 -------- d-----w- c:\programdata\Malwarebytes
2012-08-05 23:06:42 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-08-02 17:04:53 -------- d-----w- c:\users\mikes\appdata\local\Akamai
2012-08-01 19:53:06 -------- d-----w- c:\windows\system32\wbem\framework\root\OpenHardwareMonitor
2012-08-01 19:53:06 -------- d-----w- c:\windows\system32\wbem\framework\root
2012-08-01 19:53:06 -------- d-----w- c:\windows\system32\wbem\Framework
2012-08-01 18:50:19 -------- d-----w- c:\windows\pss
2012-07-30 18:07:46 -------- d-----w- c:\users\mikes\appdata\local\SniperV2
2012-07-23 01:28:04 -------- d-----w- c:\users\mikes\appdata\roaming\uTorrent
2012-07-19 01:50:55 -------- d-----w- c:\users\mikes\appdata\local\Spoon
2012-07-18 18:33:56 -------- d-----w- c:\program files\Conduit
2012-07-18 18:33:54 -------- d-----w- c:\program files\Vuze_Remote
2012-07-11 23:17:49 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-07-10 17:10:41 -------- d-----w- c:\windows\system32\URTTEMP
2012-07-10 16:15:32 -------- d-----w- c:\program files\MagicISO
2012-07-10 01:51:02 -------- d-----w- c:\program files\Nero
2012-07-10 01:50:53 -------- d-----w- c:\programdata\Nero
2012-07-10 01:40:52 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
.
==================== Find3M ====================
.
2012-08-02 21:25:10 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-02 21:25:10 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-02 17:09:00 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2012-08-02 17:09:00 102400 ----a-w- c:\windows\system32\OpenAL32.dll
2012-06-23 18:18:50 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
2012-06-17 19:15:56 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-06-06 05:05:52 1390080 ----a-w- c:\windows\system32\msxml6.dll
2012-06-06 05:05:52 1236992 ----a-w- c:\windows\system32\msxml3.dll
2012-06-06 05:03:06 805376 ----a-w- c:\windows\system32\cdosys.dll
2012-06-02 22:19:42 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 22:12:32 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12:20 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-02 22:12:13 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 08:33:25 1800192 ----a-w- c:\windows\system32\jscript9.dll
2012-06-02 08:25:08 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-06-02 08:25:03 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-06-02 08:20:33 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-06-02 08:16:52 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-06-02 04:45:04 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-06-02 04:45:03 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-06-02 04:40:59 369336 ----a-w- c:\windows\system32\drivers\cng.sys
2012-06-02 04:40:39 225280 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 04:39:10 219136 ----a-w- c:\windows\system32\ncrypt.dll
2012-05-26 02:01:31 499712 ----a-w- c:\windows\system32\msvcp71.dll
2012-05-15 09:28:49 645440 ----a-w- c:\windows\system32\nvvsvc.exe
2012-05-15 09:28:49 62272 ----a-w- c:\windows\system32\nvshext.dll
2012-05-15 09:28:49 2621723 ----a-w- c:\windows\system32\nvcoproc.bin
2012-05-15 09:28:49 108352 ----a-w- c:\windows\system32\nvmctray.dll
2012-05-15 09:28:48 3931456 ----a-w- c:\windows\system32\nvcpl.dll
2012-05-15 09:27:28 2759488 ----a-w- c:\windows\system32\nvsvc.dll
2012-05-15 09:21:50 423744 ----a-w- c:\windows\system32\nvStreaming.exe
2012-05-11 16:08:25 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-11 16:08:25 3913072 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-11 16:08:15 56176 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-11 16:08:07 1291632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-11 16:05:41 1077248 ----a-w- c:\windows\system32\DWrite.dll
.
============= FINISH: 17:32:26.82 ===============

whiteknight1950 · Aug 8, 2012

The Attach DDS is:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 8/26/2011 10:58:01 AM
System Uptime: 8/8/2012 4:55:04 PM (1 hours ago)
.
Motherboard: EVGA | | NFORCE 680i LT SLI
Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz | Socket 775 | 2400/267mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 88 GiB total, 49.078 GiB free.
D: is FIXED (NTFS) - 466 GiB total, 236.253 GiB free.
E: is FIXED (NTFS) - 52 GiB total, 31.969 GiB free.
F: is CDROM ()
G: is CDROM ()
H: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP403: 8/4/2012 2:09:24 PM - Windows Update
RP404: 8/6/2012 4:14:19 PM - Windows Backup
RP405: 8/7/2012 6:10:32 PM - Windows Update
RP406: 8/8/2012 2:20:50 AM - Windows Update
RP407: 8/8/2012 2:33:29 PM - Windows Update
.
==== Installed Programs ======================
.
µTorrent
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.3)
Adobe Shockwave Player 11.6
Advanced SystemCare 5
Advertising Center
Akamai NetSession Interface
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ASUS Xonar DX Audio Driver
AVS4YOU Software Navigator 1.4
Bonjour
Brother MFL-Pro Suite MFC-9440CN
Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
Call of Duty: Modern Warfare 3
Call of Duty: Modern Warfare 3 - Dedicated Server
Call of Duty: Modern Warfare 3 - Multiplayer
CCleaner
Company of Heroes
Company of Heroes - FAKEMSI
Compatibility Pack for the 2007 Office system
CPUID CPU-Z 1.58
DriverAgent by eSupport.com
EVGA Precision 2.1.2
Free Window Registry Repair
ImgBurn
IObit Malware Fighter
iTunes
Java Auto Updater
Java(TM) 6 Update 31
Left 4 Dead
Magic ISO Maker v5.5 (build 0281)
Malwarebytes Anti-Malware version 1.62.0.1300
Microsoft .NET Framework 1.1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft IntelliPoint 8.2
Microsoft Office File Validation Add-In
Microsoft Office Professional Edition 2003
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Mozilla Firefox 10.0.2 (x86 en-US)
Mozilla Firefox 7.0.1 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 9 Essentials
Nero ControlCenter
Nero Installer
Nero Online Upgrade
Nero StartSmart
Nero StartSmart OEM
neroxml
NVIDIA 3D Vision Controller Driver 301.42
NVIDIA 3D Vision Driver 301.42
NVIDIA Control Panel 301.42
NVIDIA Drivers
NVIDIA ForceWare Network Access Manager
NVIDIA Graphics Driver 301.42
NVIDIA HD Audio Driver 1.3.16.0
NVIDIA Install Application
NVIDIA MediaShield
NVIDIA PhysX
NVIDIA PhysX System Software 9.12.0213
NVIDIA Update 1.8.15
NVIDIA Update Components
OpenAL
PaperPort Image Printer
PCSafeDoctor
PeerBlock 1.1 (r518)
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
RealUpgrade 1.1
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
SiSoftware Sandra Lite 2012.SP4c
SiSoftware Sandra Professional Business 2011.SP4
Smart Defrag 2
Sniper Elite V2
SpeedFan (remove only)
Steam
swMSM
The Elder Scrolls V: Skyrim
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
ViewSonic Monitor Drivers
VirtualCloneDrive
Vuze
Vuze Remote Toolbar
WinRAR 4.01 (32-bit)
.
==== Event Viewer Messages From Past Week ========
.
8/8/2012 5:29:23 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
8/8/2012 5:29:16 PM, Error: NVNET [5008] - NVIDIA nForce 10/100/1000 Mbps Ethernet : Has encountered an invalid network address.
8/8/2012 4:57:35 PM, Error: Service Control Manager [7038] - The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error: Logon failure: the specified account password has expired. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
8/8/2012 4:57:35 PM, Error: Service Control Manager [7000] - The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not start due to a logon failure.
8/8/2012 4:57:35 PM, Error: Service Control Manager [7000] - The MBAMService service failed to start due to the following error: The system cannot find the file specified.
8/8/2012 4:55:21 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xc0000005, 0x92d2352e, 0xaeac7580, 0xaeac7160). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080812-14352-01.
8/8/2012 2:22:49 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.131.1460.0;1.131.1460.0 Engine version: 1.1.8601.0
8/8/2012 2:22:47 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007f (0x00000000, 0x00000000, 0x00000000, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080812-29998-01.
8/8/2012 2:10:21 AM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.131.1460.0;1.131.1460.0 Engine version: 1.1.8601.0
8/7/2012 5:26:57 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.131.1460.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8601.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
8/7/2012 5:16:50 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000004e (0x00000099, 0x000a2f00, 0x00000003, 0x000a3000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080712-14882-01.
8/7/2012 2:36:26 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR2.
8/7/2012 12:55:07 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.131.1460.0;1.131.1460.0 Engine version: 1.1.8601.0
8/7/2012 10:44:05 AM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 1.131.1460.0;1.131.1460.0 Engine version: 1.1.8601.0
8/7/2012 1:12:05 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.131.1460.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8601.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
8/6/2012 5:27:25 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xcaf0596a, 0x00000000, 0x923cbd85, 0x00000002). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080612-14804-01.
8/6/2012 4:46:52 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000, 0x00000002, 0x00000001, 0x830820af). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080612-19047-01.
8/6/2012 4:29:48 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x005d9159, 0x00000002, 0x00000001, 0x83008829). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080612-14835-01.
8/6/2012 4:15:37 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.131.1523.0).
8/6/2012 4:14:57 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.131.1460.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8601.0 Error code: 0x80246007 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
8/6/2012 4:02:59 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
8/6/2012 3:56:32 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
8/6/2012 3:56:26 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
8/6/2012 3:56:22 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache ElbyCDIO MpFilter spldr Wanarpv6
8/6/2012 3:56:01 PM, Error: sptd [4] - Driver detected an internal error in its data structures for .
8/5/2012 3:54:58 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x00000000, 0x8cbee9c4, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 080512-22885-01.
8/2/2012 2:22:12 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
8/2/2012 2:22:12 PM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/2/2012 12:39:04 PM, Error: Service Control Manager [7030] - The ForceWare Intelligent Application Manager (IAM) service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
8/2/2012 12:39:00 PM, Error: Service Control Manager [7030] - The ForceWare IP service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
8/2/2012 12:36:28 PM, Error: NVNET [5008] - NVIDIA nForce Networking Controller : Has encountered an invalid network address.
.
==== End Of File ===========================

Please advise the next step at your convenience.

Cheers
Whiteknight1950

whiteknight1950 · Aug 8, 2012

I hear what you say about SystemCare5, have uninstalled it and will deal with registry in a different way in the future....thanks for the advice.

Whiteknight1950

Broni · Aug 8, 2012

and will deal with registry in a different way

There is absolutely no need to play with registry whatsoever.

=====================================

Please download the below tool named Rkill (courtesy of BleepingComputer.com) to your desktop.

There are 2 different versions. If one of them won't run then download and try to run the other one.

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

http://download.bleepingcomputer.com/grinler/beta/rkill.exe
http://download.bleepingcomputer.com/grinler/beta/iExplore.exe

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

If normal mode still doesn't work, run the tool from safe mode.

When the scan is done Notepad will open with rKill log.
Post it in your next reply.

NOTE. rKill.txt log will also be present on your desktop.

========================================

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan.
On completion of the scan click "Save log", save it to your desktop and post in your next reply.

NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

whiteknight1950 · Aug 8, 2012

This is the rootkill result

Rkill 2.1.0 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 08/08/2012 06:21:02 PM in x86 mode.
Windows Version: Windows 7

Checking for Windows services to stop.

* No malware services found to stop.

Checking for processes to terminate.

* No malware processes found to kill.

Checking Registry for malware related settings.

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks.

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Restarting Explorer.exe in order to apply changes.

Program finished at: 08/08/2012 06:21:18 PM
Execution time: 0 hours(s), 0 minute(s), and 16 seconds(s)

whiteknight1950 · Aug 8, 2012

This is the MBR log:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-08 18:27:40
-----------------------------
18:27:40.682 OS Version: Windows 6.1.7601 Service Pack 1
18:27:40.682 Number of processors: 4 586 0xF0B
18:27:40.682 ComputerName: MIKES-PC UserName: Mikes
18:27:40.906 Initialize success
18:27:45.330 AVAST engine defs: 12080801
18:27:49.151 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000061
18:27:49.153 Disk 0 Vendor: WDC_WD15 21.0 Size: 143089MB BusType: 3
18:27:49.155 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000062
18:27:49.157 Disk 1 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
18:27:49.167 Disk 0 MBR read successfully
18:27:49.170 Disk 0 MBR scan
18:27:49.173 Disk 0 Windows 7 default MBR code
18:27:49.185 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 89999 MB offset 2048
18:27:49.201 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 53087 MB offset 184322048
18:27:49.207 Disk 0 scanning sectors +293044224
18:27:49.237 Disk 0 scanning C:\Windows\system32\drivers
18:27:54.921 Service scanning
18:28:00.151 Service MpKsl4bdbdff9 C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{382FB52C-A063-4CC8-9389-FBC73A60CD48}\MpKsl4bdbdff9.sys **LOCKED** 32
18:28:07.460 Modules scanning
18:28:10.925 Disk 0 trace - called modules:
18:28:10.941 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x857a81e8]<<
18:28:10.946 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x869a1030]
18:28:10.951 3 CLASSPNP.SYS[8b38e59e] -> nt!IofCallDriver -> [0x86518930]
18:28:10.956 5 ACPI.sys[8379e3d4] -> nt!IofCallDriver -> \Device\00000061[0x86550a28]
18:28:10.965 \Driver\nvstor32[0x85844a98] -> IRP_MJ_CREATE -> 0x857a81e8
18:28:11.303 AVAST engine scan C:\Windows
18:28:12.143 AVAST engine scan C:\Windows\system32
18:29:50.573 AVAST engine scan C:\Windows\system32\drivers
18:29:56.847 AVAST engine scan C:\Users\Mikes
18:31:09.664 AVAST engine scan C:\ProgramData
18:31:22.201 Scan finished successfully
18:31:55.370 Disk 0 MBR has been saved successfully to "C:\Users\Mikes\Desktop\MBR.dat"
18:31:55.378 The log file has been saved successfully to "C:\Users\Mikes\Desktop\aswMBR.txt"

Thanks again

Broni · Aug 8, 2012

I don't see much so far...

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe

Double-click on the Rkill icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

whiteknight1950 · Aug 9, 2012

ComboFix ran ok....here is the log:

ComboFix 12-08-08.03 - Mikes 08/08/2012 21:04:50.1.4 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2815.1785 [GMT -7:00]
Running from: c:\users\Mikes\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Mikes\AppData\Roaming\mm
c:\windows\system32\drivers\RKHit.sys
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-07-09 to 2012-08-09 )))))))))))))))))))))))))))))))
.
.
2012-08-09 04:09 . 2012-08-09 04:09 -------- d-----w- c:\users\Mikes\AppData\Local\temp
2012-08-09 04:09 . 2012-08-09 04:09 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-08-09 04:09 . 2012-08-09 04:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-09 02:18 . 2012-06-29 08:44 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB8500EF-699E-4AFF-870B-97DFD88D5BFE}\mpengine.dll
2012-08-09 02:07 . 2012-06-29 08:44 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-08-09 00:29 . 2012-08-09 00:29 -------- d-----w- c:\users\Mikes\AppData\Local\ElevatedDiagnostics
2012-08-08 21:12 . 2012-08-08 21:12 -------- d-----w- c:\program files\COMODO
2012-08-08 01:48 . 2012-08-08 01:48 -------- d-----w- C:\FRST
2012-08-07 00:01 . 2012-08-07 18:42 -------- d-----w- c:\program files\Vuze
2012-08-06 23:23 . 2012-08-06 23:23 -------- d-----w- c:\users\Mikes\AppData\Local\Apps
2012-08-05 23:06 . 2012-08-05 23:06 -------- d-----w- c:\users\Mikes\AppData\Roaming\Malwarebytes
2012-08-05 23:06 . 2012-08-08 10:06 -------- d-----w- c:\programdata\Malwarebytes
2012-08-05 23:06 . 2012-07-03 20:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-08-02 17:04 . 2012-08-09 03:06 -------- d-----w- c:\users\Mikes\AppData\Local\Akamai
2012-08-01 19:53 . 2012-08-01 19:53 -------- d-----w- c:\windows\system32\wbem\Framework
2012-07-30 18:07 . 2012-08-09 03:06 -------- d-----w- c:\users\Mikes\AppData\Local\SniperV2
2012-07-23 01:28 . 2012-08-08 09:20 -------- d-----w- c:\users\Mikes\AppData\Roaming\uTorrent
2012-07-19 01:50 . 2012-07-19 01:50 -------- d-----w- c:\users\Mikes\AppData\Local\Spoon
2012-07-18 18:33 . 2012-07-18 18:33 -------- d-----w- c:\program files\Conduit
2012-07-15 23:14 . 2012-07-15 23:14 -------- d-----w- c:\windows\Sun
2012-07-11 23:17 . 2012-06-12 02:40 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-07-10 16:15 . 2012-07-10 16:15 -------- d-----w- c:\program files\MagicISO
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-02 21:25 . 2012-04-03 15:43 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-02 21:25 . 2011-08-26 22:12 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-02 17:09 . 2011-08-28 01:00 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2012-08-02 17:09 . 2011-08-28 01:00 102400 ----a-w- c:\windows\system32\OpenAL32.dll
2012-07-10 01:40 . 2012-07-10 01:40 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-06-23 18:18 . 2012-06-23 18:18 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
2012-06-17 19:15 . 2012-06-17 19:15 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-06-02 22:19 . 2012-06-21 16:29 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 22:19 . 2012-06-21 16:29 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-21 16:29 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-21 16:29 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-21 16:29 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-21 16:29 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:12 . 2012-06-21 16:29 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12 . 2012-06-21 16:29 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-02 22:12 . 2012-06-21 16:29 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-05-26 02:01 . 2011-12-28 16:43 499712 ----a-w- c:\windows\system32\msvcp71.dll
2012-05-15 10:26 . 2012-06-23 18:27 5982528 ----a-w- c:\windows\system32\nvcuda.dll
2012-05-15 10:26 . 2012-06-23 18:27 301376 ----a-w- c:\windows\system32\nvdecodemft.dll
2012-05-15 10:26 . 2012-06-23 18:27 2524992 ----a-w- c:\windows\system32\nvcuvid.dll
2012-05-15 10:26 . 2012-06-23 18:27 2445120 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-05-15 10:26 . 2012-06-23 18:27 202048 ----a-w- c:\windows\system32\nvinit.dll
2012-05-15 10:26 . 2012-06-23 18:27 19607872 ----a-w- c:\windows\system32\nvoglv32.dll
2012-05-15 10:26 . 2012-06-23 18:27 15322432 ----a-w- c:\windows\system32\nvd3dum.dll
2012-05-15 10:26 . 2012-06-23 18:27 11354944 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-05-15 10:26 . 2012-06-23 18:27 17551680 ----a-w- c:\windows\system32\nvcompiler.dll
2012-05-15 10:26 . 2012-03-13 23:35 61248 ----a-w- c:\windows\system32\OpenCL.dll
2012-05-15 10:26 . 2012-02-21 19:36 818496 ----a-w- c:\windows\system32\nvumdshim.dll
2012-05-15 10:26 . 2011-08-26 18:36 8105280 ----a-w- c:\windows\system32\nvwgf2um.dll
2012-05-15 10:26 . 2011-08-26 18:36 883008 ----a-w- c:\windows\system32\nvgenco32.dll
2012-05-15 10:26 . 2011-08-26 18:36 1000768 ----a-w- c:\windows\system32\nvdispco32.dll
2012-05-15 10:26 . 2011-05-21 13:01 2368832 ----a-w- c:\windows\system32\nvapi.dll
2012-05-15 09:28 . 2011-08-26 17:59 645440 ----a-w- c:\windows\system32\nvvsvc.exe
2012-05-15 09:28 . 2011-08-26 17:59 62272 ----a-w- c:\windows\system32\nvshext.dll
2012-05-15 09:28 . 2011-08-26 17:59 108352 ----a-w- c:\windows\system32\nvmctray.dll
2012-05-15 09:28 . 2011-08-26 17:59 3931456 ----a-w- c:\windows\system32\nvcpl.dll
2012-05-15 09:27 . 2011-08-26 17:59 2759488 ----a-w- c:\windows\system32\nvsvc.dll
2012-05-15 09:21 . 2012-05-15 09:21 423744 ----a-w- c:\windows\system32\nvStreaming.exe
2012-05-11 16:08 . 2012-05-11 16:08 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-11 16:08 . 2012-05-11 16:08 3913072 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-11 16:08 . 2012-05-11 16:08 56176 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-11 16:08 . 2012-05-11 16:08 1291632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-11 16:05 . 2012-05-11 16:05 1077248 ----a-w- c:\windows\system32\DWrite.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\prxtbVuze.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
2011-05-09 08:49 176936 ----a-w- c:\program files\Vuze_Remote\prxtbVuze.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\prxtbVuze.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"="c:\users\Mikes\AppData\Local\Akamai\netsession_win.exe" [2012-05-26 4327744]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2012-05-26 296056]
"Cmaudio8788GX"="c:\windows\system\HsMgr.exe" [2008-07-11 200704]
"NVRaidService"="c:\program files\NVIDIA Corporation\Raid\nvraidservice.exe" [2010-04-09 163944]
"Malwarebytes' Anti-Malware"="d:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SmartDefragBootTime.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio8788
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW6
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Essentials TM
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2011-11-02 06:25 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2009-05-26 23:46 1159168 ------w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio8788GX]
2008-07-11 22:04 200704 ------w- c:\windows\system\HsMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2008-12-24 17:26 114688 ------w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
2011-08-01 22:56 1821576 ----a-w- c:\program files\Microsoft IntelliPoint\ipoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-01-17 00:22 421736 ----a-w- d:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2012-03-27 00:08 931200 ----a-w- c:\program files\Microsoft Security Client\msseces.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRaidService]
2010-04-09 09:42 163944 ----a-w- c:\program files\NVIDIA Corporation\Raid\nvraidservice.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 21:28 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-01-18 21:02 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2012-05-26 02:01 296056 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
2011-03-07 13:33 89456 ----a-w- d:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
.
R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;d:\program files\IObit\Advanced SystemCare 5\ASCService.exe [x]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys [x]
R3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys [x]
R3 DrvAgent32;DrvAgent32;c:\windows\system32\Drivers\DrvAgent32.sys [x]
R3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [x]
R3 RTCore32;RTCore32;d:\program files\EVGA Precision\RTCore32.sys [x]
R3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\SiSoftware\SiSoftware Sandra Professional Business 2011.SP4\RpcAgentSrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [x]
S2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [x]
S2 MBAMService;MBAMService;d:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S3 cmudaxp;ASUS Xonar DX Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 21:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.babylon.com/?AF=109932&babsrc=HP_ss&mntrId=6024ca09000000000000044b80808004
uInternet Settings,ProxyOverride = *.local;<local>
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.1.1
FF - ProfilePath - c:\users\Mikes\AppData\Roaming\Mozilla\Firefox\Profiles\qhxebwz1.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
FF - user.js: extensions.BabylonToolbar_i.id - 6024ca09000000000000044b80808004
FF - user.js: extensions.BabylonToolbar_i.hardId - 6024ca09000000000000044b80808004
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15408
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1719:21
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109932
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Advanced SystemCare 5 - d:\program files\IObit\Advanced SystemCare 5\ASCTray.exe
HKLM-Run-Cmaudio8788 - cmicnfgp.cpl
MSConfigStartUp-Advanced SystemCare 5 - d:\program files\IObit\Advanced SystemCare 5\ASCTray.exe
AddRemove-Advanced SystemCare 5_is1 - d:\program files\IObit\Advanced SystemCare 5\unins000.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-08-08 21:10:21
ComboFix-quarantined-files.txt 2012-08-09 04:10
.
Pre-Run: 53,196,877,824 bytes free
Post-Run: 53,064,036,352 bytes free
.
- - End Of File - - 1E4924E11EEF03D22D5620C3872F4D0D

Broni · Aug 9, 2012

Looks good

How is computer doing?

=========================

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

whiteknight1950 · Aug 9, 2012

Broni · Aug 9, 2012

You posted Combofix log already.
Read my previous reply.

whiteknight1950 · Aug 9, 2012

Sorry, I reposted the Combo fix report, I initially couldnt see it on the thread.

OTL here:

OTL logfile created on: 8/8/2012 9:45:23 PM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Mikes\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.78 Gb Available Physical Memory | 64.76% Memory free
5.50 Gb Paging File | 4.28 Gb Available in Paging File | 77.80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 87.89 Gb Total Space | 49.01 Gb Free Space | 55.76% Space Free | Partition Type: NTFS
Drive D: | 465.63 Gb Total Space | 236.35 Gb Free Space | 50.76% Space Free | Partition Type: NTFS
Drive E: | 51.84 Gb Total Space | 31.97 Gb Free Space | 61.66% Space Free | Partition Type: NTFS
Drive H: | 121.85 Mb Total Space | 120.97 Mb Free Space | 99.28% Space Free | Partition Type: FAT

Computer Name: MIKES-PC | User Name: Mikes | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/08 21:41:51 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Mikes\Desktop\OTL.exe
PRC - [2012/08/02 14:25:10 | 001,536,712 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
PRC - [2012/07/18 11:38:16 | 000,913,888 | ---- | M] (Mozilla Corporation) -- D:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/05/26 06:32:24 | 004,327,744 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\Mikes\AppData\Local\Akamai\netsession_win.exe
PRC - [2012/05/25 19:01:32 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2012/05/15 02:28:16 | 001,820,480 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
PRC - [2012/05/15 02:27:34 | 000,857,920 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2012/03/11 21:13:22 | 001,983,232 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
PRC - [2012/03/11 21:13:02 | 006,749,512 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
PRC - [2012/01/09 20:17:44 | 000,821,592 | ---- | M] (IObit) -- C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
PRC - [2012/01/04 14:26:46 | 001,606,488 | ---- | M] (IObit) -- D:\Program Files\IObit\Smart Defrag 2\SmartDefrag.exe
PRC - [2012/01/03 06:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/11/23 03:27:04 | 001,052,472 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe
PRC - [2011/02/24 22:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/20 05:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/04/09 02:42:28 | 000,163,944 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe
PRC - [2009/08/10 15:59:50 | 000,178,720 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
PRC - [2009/08/10 15:59:48 | 000,387,616 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
PRC - [2009/07/20 11:51:52 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2008/07/11 15:04:22 | 000,200,704 | ---- | M] () -- C:\Windows\system\HsMgr.exe

========== Modules (No Company Name) ==========

MOD - [2012/08/02 14:25:09 | 009,465,032 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_270.dll
MOD - [2012/07/18 11:38:01 | 002,003,424 | ---- | M] () -- D:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/08/19 16:33:28 | 000,047,960 | ---- | M] () -- D:\Program Files\IObit\Smart Defrag 2\NtfsData.dll
MOD - [2011/05/28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2008/07/11 15:04:22 | 000,200,704 | ---- | M] () -- C:\Windows\system\HsMgr.exe

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- D:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe -- (AdvancedSystemCareService5)
SRV - [2012/08/02 14:25:11 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/01 18:16:03 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- d:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/05/15 03:26:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012/03/26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/03/11 21:13:22 | 001,983,232 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV - [2012/01/09 20:17:44 | 000,821,592 | ---- | M] (IObit) [Auto | Running] -- C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe -- (IMFservice)
SRV - [2012/01/03 06:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/11/23 03:27:04 | 001,052,472 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe -- (CLPSLS)
SRV - [2011/08/27 16:38:24 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/08/10 15:59:50 | 000,178,720 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV - [2009/08/10 15:59:48 | 000,387,616 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)
SRV - [2009/07/20 11:51:52 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009/07/13 19:15:38 | 000,093,848 | ---- | M] (SiSoftware) [On_Demand | Stopped] -- d:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2011.SP4\RpcAgentSrv.exe -- (SandraAgentSrv)
SRV - [2009/07/13 18:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 18:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Mikes\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012/07/09 18:40:52 | 000,477,240 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2012/07/03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/06/23 11:18:50 | 000,023,456 | ---- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DrvAgent32.sys -- (DrvAgent32)
DRV - [2012/05/15 03:26:00 | 011,354,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012/04/18 10:08:04 | 000,148,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2012/03/20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2012/03/11 21:13:38 | 000,039,640 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\cmdhlp.sys -- (cmdHlp)
DRV - [2012/03/11 21:13:36 | 000,491,816 | ---- | M] (COMODO) [File_System | System | Running] -- C:\Windows\System32\drivers\cmdGuard.sys -- (cmdGuard)
DRV - [2012/02/03 19:27:48 | 000,082,400 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\inspect.sys -- (inspect)
DRV - [2012/01/05 18:07:20 | 000,020,336 | ---- | M] (IObit) [File_System | On_Demand | Stopped] -- C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys -- (FileMonitor)
DRV - [2011/09/20 14:28:18 | 000,019,792 | ---- | M] (IObit.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\UrlFilter.sys -- (UrlFilter)
DRV - [2011/09/20 14:28:14 | 000,030,600 | ---- | M] (IObit.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\RegFilter.sys -- (RegFilter)
DRV - [2011/07/13 07:00:14 | 000,026,112 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)
DRV - [2011/05/18 08:09:04 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d)
DRV - [2011/03/18 09:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\Windows\System32\speedfan.sys -- (speedfan)
DRV - [2011/03/10 15:43:40 | 001,760,256 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\cmudaxp.sys -- (cmudaxp)
DRV - [2010/11/26 18:02:20 | 000,015,672 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SmartDefragDriver.sys -- (SmartDefragDriver)
DRV - [2010/11/20 03:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/09 15:35:30 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\cpuz135_x32.sys -- (cpuz135)
DRV - [2010/04/09 01:32:36 | 000,215,656 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2009/11/11 15:47:16 | 000,295,272 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009/08/07 23:46:56 | 000,023,112 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- d:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP4c\WNt500x86\sandra.sys -- (SANDRA)
DRV - [2009/07/13 17:56:07 | 000,265,088 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BrSerIb.sys -- (BrSerIb)
DRV - [2009/07/13 15:53:33 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BrUsbSIb.sys -- (BrUsbSIb)
DRV - [2009/07/13 15:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2005/05/25 12:39:06 | 000,004,608 | ---- | M] () [Kernel | On_Demand | Stopped] -- D:\Program Files\EVGA Precision\RTCore32.sys -- (RTCore32)
DRV - [1996/04/03 12:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\giveio.sys -- (giveio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?AF=109932&babsrc=HP_ss&mntrId=6024ca09000000000000044b80808004
IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 70 79 BE 2D 1B 64 CC 01 [binary data]
IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searc...SP_ss&mntrId=6024ca09000000000000044b80808004
IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.com"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/08/08 20:06:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: d:\Program Files\Mozilla Firefox\components [2012/07/18 11:38:16 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2012/07/18 11:38:16 | 000,000,000 | ---D | M]

[2011/08/26 11:13:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mikes\AppData\Roaming\Mozilla\Extensions
[2012/07/18 11:34:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mikes\AppData\Roaming\Mozilla\Firefox\Profiles\qhxebwz1.default\extensions
[2012/07/18 11:34:06 | 000,000,000 | ---D | M] (Vuze Remote) -- C:\Users\Mikes\AppData\Roaming\Mozilla\Firefox\Profiles\qhxebwz1.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2012/03/08 19:21:30 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Mikes\AppData\Roaming\Mozilla\Firefox\Profiles\qhxebwz1.default\extensions\ffxtlbr@babylon.com
[2012/02/21 13:49:59 | 000,000,000 | ---D | M] (Java Console) -- D:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google

riginalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\13.0.782.218\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Chrome NaCl (Disabled) = C:\Program Files\Google\Chrome\Application\13.0.782.218\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\13.0.782.218\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll
CHR - plugin: iTunes Application Detector (Enabled) = D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2012/08/08 21:09:08 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Cmaudio8788GX] C:\Windows\system\HsMgr.exe ()
O4 - HKLM..\Run: [COMODO] C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLA.exe (COMODO)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [CPA] C:\Program Files\COMODO\COMODO GeekBuddy\VALA.exe (COMODO)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NVRaidService] C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-376916492-290187006-1338432341-1001..\Run: [Akamai NetSession Interface] C:\Users\Mikes\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-376916492-290187006-1338432341-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - D:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DA014566-975D-44D4-BB0A-43528C765950}: DhcpNameServer = 10.0.1.1
O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) - C:\Windows\System32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011/08/23 12:44:30 | 000,000,000 | R--D | M] - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2011/08/23 12:44:30 | 000,000,000 | R--D | M] - E:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (SmartDefragBootTime.exe)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/08 21:41:51 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Mikes\Desktop\OTL.exe
[2012/08/08 21:30:32 | 000,000,000 | ---D | C] -- C:\Users\Mikes\Desktop\Virus Disablers
[2012/08/08 21:27:53 | 000,000,000 | ---D | C] -- C:\ProgramData\CPA_VA
[2012/08/08 21:26:51 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\COMODO
[2012/08/08 21:17:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\COMODO
[2012/08/08 21:17:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
[2012/08/08 21:15:44 | 062,855,008 | ---- | C] (COMODO) -- C:\Users\Mikes\Desktop\cfw_installer.exe
[2012/08/08 21:10:24 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/08/08 21:10:22 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/08/08 21:10:22 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\temp
[2012/08/08 20:59:27 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/08/08 20:59:27 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/08/08 20:59:27 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/08/08 19:16:59 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/08/08 19:16:46 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/08/08 19:08:55 | 004,727,758 | R--- | C] (Swearware) -- C:\Users\Mikes\Desktop\ComboFix.exe
[2012/08/08 17:29:29 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\ElevatedDiagnostics
[2012/08/08 14:12:47 | 000,000,000 | ---D | C] -- C:\Program Files\COMODO
[2012/08/07 18:48:19 | 000,000,000 | ---D | C] -- C:\FRST
[2012/08/06 17:01:27 | 000,000,000 | ---D | C] -- C:\Program Files\Vuze
[2012/08/06 16:23:37 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\Apps
[2012/08/06 16:11:52 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free Window Registry Repair
[2012/08/06 16:11:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Window Registry Repair
[2012/08/05 16:06:56 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Roaming\Malwarebytes
[2012/08/05 16:06:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/08/05 16:06:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/08/05 16:06:42 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/08/02 10:05:24 | 000,000,000 | ---D | C] -- C:\Users\Mikes\Documents\Asus Xonar Dx
[2012/08/02 10:04:53 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\Akamai
[2012/08/01 11:50:19 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012/07/31 10:41:10 | 000,000,000 | ---D | C] -- C:\Users\Mikes\Documents\SniperEliteV2_Benchmark
[2012/07/30 11:07:46 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\SniperV2
[2012/07/22 18:28:04 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Roaming\uTorrent
[2012/07/18 18:50:55 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Local\Spoon
[2012/07/18 11:33:56 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2012/07/18 11:33:54 | 000,000,000 | ---D | C] -- C:\Program Files\Vuze_Remote
[2012/07/15 16:14:45 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2012/07/10 10:02:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SiSoftware
[2012/07/10 09:15:37 | 000,000,000 | ---D | C] -- C:\Users\Mikes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MagicISO
[2012/07/10 09:15:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MagicISO
[2012/07/10 09:15:32 | 000,000,000 | ---D | C] -- C:\Program Files\MagicISO

========== Files - Modified Within 30 Days ==========

[2012/08/08 21:46:13 | 000,000,459 | ---- | M] () -- C:\Windows\BRWMARK.INI
[2012/08/08 21:41:51 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Mikes\Desktop\OTL.exe
[2012/08/08 21:34:29 | 000,000,017 | ---- | M] () -- C:\Users\Mikes\AppData\Local\resmon.resmoncfg
[2012/08/08 21:33:41 | 000,022,256 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/08 21:33:41 | 000,022,256 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/08 21:26:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/08/08 21:26:23 | 2213,441,536 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/08 21:18:06 | 000,001,846 | ---- | M] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
[2012/08/08 21:17:44 | 000,001,222 | ---- | M] () -- C:\Users\Mikes\Application Data\Microsoft\Internet Explorer\Quick Launch\COMODO GeekBuddy.lnk
[2012/08/08 21:17:44 | 000,001,198 | ---- | M] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
[2012/08/08 21:16:14 | 062,855,008 | ---- | M] (COMODO) -- C:\Users\Mikes\Desktop\cfw_installer.exe
[2012/08/08 21:09:08 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/08/08 21:03:25 | 004,727,758 | R--- | M] (Swearware) -- C:\Users\Mikes\Desktop\ComboFix.exe
[2012/08/08 20:25:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/08 14:22:41 | 336,178,085 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/08/08 02:20:12 | 000,000,689 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/08/08 02:11:56 | 000,634,808 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/08/08 02:11:56 | 000,111,342 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/08/06 16:11:52 | 000,000,689 | ---- | M] () -- C:\Users\Mikes\Desktop\Free Window Registry Repair.lnk
[2012/08/05 16:19:23 | 000,002,198 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/08/05 16:06:47 | 000,000,763 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/08/03 10:49:54 | 011,710,464 | ---- | M] () -- C:\Users\Mikes\AppData\Roaming\Sandra.mdb
[2012/08/02 10:09:00 | 000,413,696 | ---- | M] (Creative Labs) -- C:\Windows\System32\wrap_oal.dll
[2012/08/02 10:08:55 | 000,238,953 | ---- | M] () -- C:\Windows\Cmicnfgp.ini.cfl
[2012/08/02 10:08:54 | 000,000,931 | ---- | M] () -- C:\Windows\Cmicnfgp.ini.imi
[2012/08/02 10:08:54 | 000,000,870 | ---- | M] () -- C:\Windows\System\Cmicnfgp.ini
[2012/08/02 10:08:54 | 000,000,138 | ---- | M] () -- C:\Windows\System\Dlap.pfx
[2012/08/01 12:56:57 | 000,000,689 | ---- | M] () -- C:\Users\Mikes\Desktop\SpeedFan.lnk
[2012/08/01 12:56:55 | 000,000,045 | ---- | M] () -- C:\Windows\System32\initdebug.nfo
[2012/07/22 18:28:55 | 000,000,637 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012/07/22 18:28:55 | 000,000,637 | ---- | M] () -- C:\Users\Mikes\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/07/18 11:36:58 | 000,000,629 | ---- | M] () -- C:\Users\Public\Desktop\Vuze.lnk
[2012/07/18 11:36:58 | 000,000,629 | ---- | M] () -- C:\Users\Mikes\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
[2012/07/12 08:58:39 | 000,358,048 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/07/10 10:29:17 | 000,001,106 | ---- | M] () -- C:\Users\Public\Desktop\SiSoftware Sandra Professional Business 2011.SP4.lnk
[2012/07/10 09:15:37 | 000,001,769 | ---- | M] () -- C:\Users\Mikes\Desktop\MagicISO.lnk

========== Files Created - No Company Name ==========

[2012/08/08 21:34:29 | 000,000,017 | ---- | C] () -- C:\Users\Mikes\AppData\Local\resmon.resmoncfg
[2012/08/08 21:18:06 | 000,001,846 | ---- | C] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
[2012/08/08 21:17:44 | 000,001,222 | ---- | C] () -- C:\Users\Mikes\Application Data\Microsoft\Internet Explorer\Quick Launch\COMODO GeekBuddy.lnk
[2012/08/08 21:17:44 | 000,001,198 | ---- | C] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
[2012/08/08 20:59:27 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/08/08 20:59:27 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/08/08 20:59:27 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/08/08 20:59:27 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/08/08 20:59:27 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/08/08 17:09:22 | 000,000,763 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/08/08 14:22:41 | 336,178,085 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012/08/06 17:01:43 | 000,000,629 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vuze.lnk
[2012/08/06 16:11:52 | 000,000,689 | ---- | C] () -- C:\Users\Mikes\Desktop\Free Window Registry Repair.lnk
[2012/08/01 12:56:57 | 000,000,689 | ---- | C] () -- C:\Users\Mikes\Desktop\SpeedFan.lnk
[2012/08/01 12:56:54 | 000,000,045 | ---- | C] () -- C:\Windows\System32\initdebug.nfo
[2012/07/22 18:28:55 | 000,000,637 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012/07/22 18:28:55 | 000,000,637 | ---- | C] () -- C:\Users\Mikes\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/07/10 10:29:17 | 000,001,106 | ---- | C] () -- C:\Users\Public\Desktop\SiSoftware Sandra Professional Business 2011.SP4.lnk
[2012/07/10 10:02:26 | 011,710,464 | ---- | C] () -- C:\Users\Mikes\AppData\Roaming\Sandra.mdb
[2012/07/10 09:15:37 | 000,001,769 | ---- | C] () -- C:\Users\Mikes\Desktop\MagicISO.lnk
[2012/05/15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2012/03/12 08:59:02 | 000,000,066 | ---- | C] () -- C:\Windows\Brfaxrx.ini
[2012/03/12 08:59:02 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat
[2012/02/21 12:36:58 | 002,621,723 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin
[2012/01/16 10:44:59 | 000,015,672 | ---- | C] () -- C:\Windows\System32\drivers\SmartDefragDriver.sys
[2011/11/27 18:25:49 | 003,002,368 | ---- | C] () -- C:\Users\Mikes\s-1-5-21-376916492-290187006-1338432341-1001.rrr
[2011/11/23 13:24:29 | 000,020,312 | ---- | C] () -- C:\Windows\System32\RegistryDefragBootTime.exe
[2011/10/29 15:49:50 | 000,000,048 | ---- | C] () -- C:\Windows\System32\cmasiop.ini
[2011/10/29 15:49:49 | 000,238,953 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.cfl
[2011/10/29 15:49:31 | 000,000,931 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.imi
[2011/10/29 15:49:28 | 000,004,969 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.cfg
[2011/10/29 15:49:27 | 000,000,560 | ---- | C] () -- C:\Windows\cmudaxp.ini
[2011/09/07 12:18:52 | 000,000,244 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2011/09/07 12:18:52 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini
[2011/09/07 12:18:09 | 000,106,496 | ---- | C] () -- C:\Windows\System32\BrMuSNMP.dll
[2011/09/07 12:10:12 | 000,000,459 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011/09/07 12:10:12 | 000,000,065 | ---- | C] () -- C:\Windows\System32\bd9440cn.dat
[2011/09/07 12:10:12 | 000,000,026 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011/09/07 11:39:00 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2011/08/27 18:00:06 | 000,561,152 | ---- | C] () -- C:\Windows\System32\Cmeauoxy.exe
[2011/08/27 17:59:47 | 000,303,104 | ---- | C] () -- C:\Windows\System32\CmiInstallResAll.dll
[2011/08/26 11:58:36 | 000,009,548 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2010/09/14 09:37:41 | 000,045,056 | ---- | C] () -- C:\Windows\System32\BRTCPCON.DLL
[2010/09/14 09:37:41 | 000,000,114 | ---- | C] () -- C:\Windows\System32\BRLMW03A.INI
[2010/09/14 09:37:41 | 000,000,050 | ---- | C] () -- C:\Windows\System32\BAOCH06A.DAT

========== LOP Check ==========

[2011/10/29 15:49:57 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\ASUS
[2012/08/08 03:08:04 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\Azureus
[2012/03/08 19:21:24 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\Babylon
[2012/07/10 09:08:40 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\ImgBurn
[2012/08/08 03:08:04 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\IObit
[2011/09/24 22:36:41 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\Registry Mechanic
[2012/08/08 02:20:43 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\uTorrent
[2012/03/12 08:14:09 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\Zeon
[2012/06/23 10:55:41 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP

1B5B4F1

< End of report >

whiteknight1950 · Aug 9, 2012

And then the Extras txt.......:

OTL Extras logfile created on: 8/8/2012 9:45:23 PM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Mikes\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.78 Gb Available Physical Memory | 64.76% Memory free
5.50 Gb Paging File | 4.28 Gb Available in Paging File | 77.80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 87.89 Gb Total Space | 49.01 Gb Free Space | 55.76% Space Free | Partition Type: NTFS
Drive D: | 465.63 Gb Total Space | 236.35 Gb Free Space | 50.76% Space Free | Partition Type: NTFS
Drive E: | 51.84 Gb Total Space | 31.97 Gb Free Space | 61.66% Space Free | Partition Type: NTFS
Drive H: | 121.85 Mb Total Space | 120.97 Mb Free Space | 99.28% Space Free | Partition Type: FAT

Computer Name: MIKES-PC | User Name: Mikes | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "D:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09BFD90B-E5FB-40F8-97B9-0803E041F423}" = lport=rpc | protocol=6 | dir=in | app=d:\program files\sisoftware\sisoftware sandra professional business 2011.sp4\wnt500x86\rpcsandrasrv.exe |
"{0F3CBE63-1937-4639-BE4F-E3A91AC54795}" = rport=445 | protocol=6 | dir=out | app=system |
"{1007D92E-869A-470F-959D-E84F24F96172}" = rport=137 | protocol=17 | dir=out | app=system |
"{16B17EAD-3B7F-4220-9534-ED4C677BAF44}" = lport=49181 | protocol=6 | dir=in | name=akamai netsession interface |
"{1A2CF81E-BBC5-4502-8190-2E08B831F3FE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{33579719-6EE3-4B8F-9AD7-E5DD6D3BB007}" = rport=10243 | protocol=6 | dir=out | app=system |
"{3CD7B1E4-B6E3-46D8-BC25-63D7483EA270}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{405E38D6-1A65-43EB-9A48-680F09194FF0}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{40A0C57A-A2D7-4C8E-88B9-E1664B0C6359}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{47074FC3-4612-4ACF-B4BC-074F6E12215D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{53FA826E-77AB-473F-A102-BC298DEAD44F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{56881F16-A21C-4CEB-B590-17BF45C7BD89}" = lport=2869 | protocol=6 | dir=in | app=system |
"{5AD8D200-2D7B-4F0D-8EF9-4E26A16DB60F}" = lport=rpc | protocol=6 | dir=in | app=d:\program files\sisoftware\sisoftware sandra lite 2012.sp4c\wnt500x86\rpcsandrasrv.exe |
"{5E20342A-1D67-4A47-A61C-B91374A9C309}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5FB8800C-E29B-46FF-8E78-02059CD5D387}" = lport=rpc | protocol=6 | dir=in | app=d:\program files\sisoftware\sisoftware sandra professional business 2011.sp4\rpcagentsrv.exe |
"{760C832B-A923-45BB-A094-6CEB4E6C6E11}" = lport=10243 | protocol=6 | dir=in | app=system |
"{820ECF2A-0335-4ADE-81F3-6A2E7E168988}" = lport=rpc | protocol=6 | dir=in | app=d:\program files\sisoftware\sisoftware sandra lite 2012.sp4c\rpcagentsrv.exe |
"{84FAA3E0-F856-414F-88D3-F3FD61B2A522}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8A2415FC-0D74-4C10-877A-84255847EA72}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{9F49C630-3101-412B-BA90-FE93A0E52852}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A315273D-C166-4662-A402-8E5670180A4B}" = rport=139 | protocol=6 | dir=out | app=system |
"{AC7603B7-387C-486D-906E-5B8AE60D86DD}" = lport=445 | protocol=6 | dir=in | app=system |
"{AFA2F36F-6032-4C72-92D3-C4C735B459FC}" = rport=138 | protocol=17 | dir=out | app=system |
"{C020E2F6-9DBC-41E7-91E3-DC536C1A03DB}" = lport=138 | protocol=17 | dir=in | app=system |
"{CC55021D-8BE4-4999-A001-510713488C49}" = lport=139 | protocol=6 | dir=in | app=system |
"{E41565D3-8710-4A9F-992D-852678B9F2B9}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F475FEF7-5BE3-4070-BB1D-F1FA5676580C}" = lport=137 | protocol=17 | dir=in | app=system |
"{F6C00DE9-840C-4911-A3A2-E02759CE23E8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{FDFF2316-BF7A-4BAE-9EA1-B9FD6456F03D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03AABE8C-B47A-47A8-B744-CE7CF51F18ED}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{03F9031E-1435-4DF8-9C5C-1EF81BAAE8AE}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{0779C0C8-63F6-42AC-BA36-C821555EAAEF}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{0AE6E346-96D4-4027-8A43-7DEFE9B9F21C}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{10D8FD7F-7955-434F-A955-D0096C3FB11A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1E974C1D-9ECB-4CEE-9CCA-833F0768C15C}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
"{222B1B13-3930-4DE6-83DF-A6A43843D93E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{22F94E1F-0631-41B4-8309-82F08C0D82D4}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{24BF35F4-8104-491A-8950-63576887B851}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{25BBD7CF-A3C7-4C44-A9E4-7EB811B12CAC}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"{27C4C9E0-5B12-4F38-8E5F-3E0D0B7E0BF7}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
"{2DFD8866-3DC4-4B6C-9410-BB29C3612C9A}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{2E44C0C8-AEAB-4A71-805D-AF1441AFFDC2}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe |
"{382A27DC-E85A-4F9A-8518-4214A3012568}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3F91E16A-697E-49DA-8094-397A5B89D150}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{40036157-8EF7-48D8-9583-6314E986153D}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\company of heroes\reliccoh.exe |
"{40ACD0DE-CA22-44DB-B094-C91E5B7A77BD}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{46FA2F44-D89D-49B5-88F2-30BBFD4CCCA9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{486AB1FF-DEAB-43C5-BB33-9DC583114DEC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{51AE10D6-781A-4BE6-AEDD-EFD756A0AE2B}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\company of heroes\reliccoh.exe |
"{5422C1D6-B187-4D58-A945-54116F94C129}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{578E8F00-F93E-435A-8F7D-C4EA570DA4EF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{59AE800F-530A-44BA-86A8-CDA32AA2A59C}" = protocol=1 | dir=in | name=sisoftware sandra agent service (icmp-in) |
"{5FBDDD15-40D7-4B56-B8C3-1BAAEEB72C3C}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steam.exe |
"{6573CF89-847E-4048-980E-D493FCE61081}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty black ops\blackops.exe |
"{67BFAE46-0FF1-4D30-9121-496CED361785}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{6A07776E-2E04-4E77-B450-0B2FD780DD41}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6F029C2B-4412-41FD-BD63-A75708D1E782}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7BED965B-F94D-4AB5-BABF-5A9AE18C57EC}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{83420CB4-932E-40A6-A1B6-C10BC902F83B}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{86119663-F893-4F4B-9B9D-16B0E69C628D}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe |
"{8E49AF06-7134-4405-B540-2E038D44BA29}" = protocol=6 | dir=in | app=d:\program files\azureus.exe |
"{8FEB6CB2-B5E8-442B-8571-185F894759CB}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\left 4 dead\left4dead.exe |
"{907400C7-16EB-4F83-A7A5-0CF8D95DD3B5}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty black ops\blackops.exe |
"{9075B8D1-8846-459B-9121-64ED6A9BBFE9}" = protocol=17 | dir=in | app=d:\program files\utorrent\utorrent.exe |
"{90BA3E75-851E-4344-9662-9842C373BDBA}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steam.exe |
"{9BFE1E55-8351-4F40-8CF2-3DF7BC4A549D}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steam.exe |
"{9DE34B6A-150B-452C-8E83-DB1143794F79}" = protocol=6 | dir=out | app=system |
"{A1E1FA4F-9D8E-4462-89D0-203DB9110669}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe |
"{A960DE5C-EE12-4E4D-8E99-C5242B1D2534}" = protocol=17 | dir=in | app=d:\program files\azureus.exe |
"{ACC4DC7D-39D1-48D0-91B2-43631C686F52}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BB0C3A18-1AB5-4CB4-B406-2A28C554212B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{BC7CAADF-748A-4103-BE06-362C2D942C00}" = protocol=1 | dir=in | name=sisoftware deployment agent service (icmp-in) |
"{CED9153F-DDED-45A9-A1DE-07519A6DE7DA}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steam.exe |
"{D33CB4B9-D419-4924-A183-B887B0E4DA78}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D3C6A69A-DED9-40B2-AD4A-387772ED4638}" = protocol=1 | dir=in | name=sisoftware deployment agent service (icmp-in) |
"{D3E5242D-66E1-4AF7-A426-513134831E7C}" = protocol=6 | dir=in | app=d:\program files\utorrent\utorrent.exe |
"{D595FBED-9517-4E1E-9C9F-F68DFF4B229A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D8F74FE3-5896-411A-89AF-83830C504CEB}" = protocol=1 | dir=in | name=sisoftware sandra agent service (icmp-in) |
"{D9A93F60-4D07-48E9-9768-5B2192241309}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{DE7FBDED-7E8A-4476-8CF9-98A690623F1C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E1BA0E75-4537-4946-903A-03E9C22AF86A}" = dir=in | app=d:\program files\itunes\itunes.exe |
"{E90E8801-298B-4DAF-A0D8-2CBAF7B64C1A}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{EE44B7F0-E4B8-4C62-B9D1-8D531717B172}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F11AA888-3964-43C2-A116-6724CA079D59}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F7FA8AAA-EA87-47B8-88E5-D12F4F944692}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe |
"{FC2C4435-5A92-45C9-A724-5840906301AF}" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"{FC346ECF-2A36-4789-B6B9-A0EB2E6CEFF8}" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\left 4 dead\left4dead.exe |
"TCP Query User{34A8C645-74A9-49EB-9B74-CC432D397494}C:\users\mikes\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\mikes\appdata\local\akamai\netsession_win.exe |
"TCP Query User{501D09F4-D8A5-48DC-9222-C2D720DD89B0}D:\program files\azureus.exe" = protocol=6 | dir=in | app=d:\program files\azureus.exe |
"TCP Query User{8C8DAB26-1846-4470-8B81-D31491BDB89E}D:\users\michael2\programs\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe |
"TCP Query User{9F5D9DDC-A8AF-47F7-A252-2379CF0329F4}D:\users\michael2\programs\steam\reliccoh.exe" = protocol=6 | dir=in | app=d:\users\michael2\programs\steam\reliccoh.exe |
"UDP Query User{06137134-62DD-491E-A11B-E1C0B3C8324D}D:\users\michael2\programs\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe |
"UDP Query User{977C8D54-2CC6-4A00-A4DA-CDEEABD2F03C}D:\users\michael2\programs\steam\reliccoh.exe" = protocol=17 | dir=in | app=d:\users\michael2\programs\steam\reliccoh.exe |
"UDP Query User{A633D05B-7B8F-4CB7-8EF4-DFB2300CD08B}C:\users\mikes\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\mikes\appdata\local\akamai\netsession_win.exe |
"UDP Query User{B9107E23-A4FE-4B24-9CC7-FC23893C3A53}D:\program files\azureus.exe" = protocol=17 | dir=in | app=d:\program files\azureus.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.1 (r518)
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI
"{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer
"{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{48963B63-7A10-49D6-8B08-61E6132453D0}" = ViewSonic Monitor Drivers
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D43D635-6FDA-4fa5-AA9B-23CF73D058EA}" = Nero StartSmart OEM
"{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI
"{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"{5d8d6048-e45a-499d-a6ee-fc02e4448548}" = Nero 9 Essentials
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI
"{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{942E5031-2BD6-4C1B-918C-C8A1CBAE7B8C}" = Microsoft IntelliPoint 8.2
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI
"{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.8.15
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.3.16.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2296}_is1" = SiSoftware Sandra Professional Business 2011.SP4
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1" = SiSoftware Sandra Lite 2012.SP4c
"{C83FB11D-9EC6-49D7-99A7-DDDB2264883C}" = Brother MFL-Pro Suite MFC-9440CN
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC452A50-5C87-4A1F-B295-445C3C69BF7D}" = NVIDIA MediaShield
"{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI
"{D6AB1F5B-FED6-49A9-9747-327BD28FB3C7}" = COMODO Internet Security
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{dba84796-8503-4ff0-af57-1747dd9a166d}" = Nero Online Upgrade
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes
"8461-7759-5462-8226" = Vuze
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"CCleaner" = CCleaner
"C-Media Oxygen HD Audio Driver" = ASUS Xonar DX Audio Driver
"COMODO GeekBuddy" = COMODO GeekBuddy
"Company of Heroes" = Company of Heroes
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.58
"DriverAgent.exe" = DriverAgent by eSupport.com
"Free Window Registry Repair" = Free Window Registry Repair
"ImgBurn" = ImgBurn
"InstallShield_{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"IObit Malware Fighter_is1" = IObit Malware Fighter
"Magic ISO Maker v5.5 (build 0281)" = Magic ISO Maker v5.5 (build 0281)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 7.0.1 (x86 en-US)" = Mozilla Firefox 7.0.1 (x86 en-US)
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"PCSafeDoctor_is1" = PCSafeDoctor
"Precision" = EVGA Precision 2.1.2
"RealPlayer 15.0" = RealPlayer
"Smart Defrag 2_is1" = Smart Defrag 2
"SpeedFan" = SpeedFan (remove only)
"Steam App 42680" = Call of Duty: Modern Warfare 3
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Steam App 42750" = Call of Duty: Modern Warfare 3 - Dedicated Server
"Steam App 500" = Left 4 Dead
"Steam App 63380" = Sniper Elite V2
"Steam App 72850" = The Elder Scrolls V: Skyrim
"uTorrent" = µTorrent
"VirtualCloneDrive" = VirtualCloneDrive
"Vuze_Remote Toolbar" = Vuze Remote Toolbar
"WinRAR archiver" = WinRAR 4.01 (32-bit)

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-376916492-290187006-1338432341-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Mozilla Firefox 10.0.2 (x86 en-US)" = Mozilla Firefox 10.0.2 (x86 en-US)

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 8/6/2012 10:25:57 PM | Computer Name = Mikes-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "d:\program files\sisoftware\sisoftware
sandra professional business 2011.sp4\wnt500x64\RpcSandraSrv.exe". Dependent Assembly
Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 8/6/2012 10:26:01 PM | Computer Name = Mikes-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "d:\program files\sisoftware\sisoftware
sandra lite 2012.sp4c\wnt500x64\RpcSandraSrv.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 8/7/2012 3:47:46 PM | Computer Name = Mikes-PC | Source = Application Error | ID = 1000
Description = Faulting application name: MsMpEng.exe, version: 4.0.1526.0, time
stamp: 0x4f710236 Faulting module name: mprtp.dll, version: 4.0.1526.0, time stamp:
0x4f71024d Exception code: 0xc0000005 Fault offset: 0x00024f00 Faulting process id:
0x40c Faulting application start time: 0x01cd74c43bfde164 Faulting application path:
C:\Program Files\Microsoft Security Client\MsMpEng.exe Faulting module path: C:\Program
Files\Microsoft Security Client\mprtp.dll Report Id: c28368c4-e0c8-11e1-97d1-044b80808004

Error - 8/8/2012 8:39:39 PM | Computer Name = Mikes-PC | Source = VSS | ID = 8194
Description =

Error - 8/8/2012 9:25:49 PM | Computer Name = Mikes-PC | Source = Application Error | ID = 1000
Description = Faulting application name: aswMBR.exe, version: 0.9.9.1665, time stamp:
0x4f5f9c86 Faulting module name: aswMBR.exe, version: 0.9.9.1665, time stamp: 0x4f5f9c86
Exception
code: 0xc0000005 Fault offset: 0x0004f5db Faulting process id: 0xb1c Faulting application
start time: 0x01cd75cda1e6b1f4 Faulting application path: C:\Users\Mikes\Desktop\aswMBR.exe
Faulting
module path: C:\Users\Mikes\Desktop\aswMBR.exe Report Id: 262db73c-e1c1-11e1-aa92-044b80808004

Error - 8/8/2012 9:39:28 PM | Computer Name = Mikes-PC | Source = IMFservice | ID = 0
Description =

Error - 8/8/2012 10:16:56 PM | Computer Name = Mikes-PC | Source = Application Error | ID = 1000
Description = Faulting application name: taskhost.exe, version: 6.1.7601.17514,
time stamp: 0x4ce78ca9 Faulting module name: HsSrv.dll_unloaded, version: 0.0.0.0,
time stamp: 0x4c930239 Exception code: 0xc0000005 Fault offset: 0x1000ab9e Faulting
process id: 0x920 Faulting application start time: 0x01cd75d3c29e87b8 Faulting application
path: C:\Windows\system32\taskhost.exe Faulting module path: HsSrv.dll Report Id:
4a2d3ebc-e1c8-11e1-8067-044b80808004

Error - 8/8/2012 10:52:14 PM | Computer Name = Mikes-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "d:\program files\sisoftware\sisoftware
sandra lite 2012.sp4c\wnt500x64\RpcSandraSrv.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 8/8/2012 10:52:20 PM | Computer Name = Mikes-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "d:\program files\sisoftware\sisoftware
sandra professional business 2011.sp4\wnt500x64\RpcSandraSrv.exe". Dependent Assembly
Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 8/8/2012 10:52:24 PM | Computer Name = Mikes-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "d:\program files\sisoftware\sisoftware
sandra professional home 2010.sp2\wnt500x64\RpcSandraSrv.exe". Dependent Assembly
Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

[ System Events ]
Error - 4/13/2012 3:55:43 PM | Computer Name = Mikes-PC | Source = NVNET | ID = 5008
Description = NVIDIA nForce 10/100/1000 Mbps Ethernet : Has encountered an invalid
network address.

Error - 4/13/2012 3:56:34 PM | Computer Name = Mikes-PC | Source = NVNET | ID = 5008
Description = NVIDIA nForce 10/100/1000 Mbps Ethernet : Has encountered an invalid
network address.

Error - 4/13/2012 3:57:01 PM | Computer Name = Mikes-PC | Source = Service Control Manager | ID = 7001
Description = The HomeGroup Provider service depends on the Function Discovery Provider
Host service which failed to start because of the following error: %%1058

Error - 4/14/2012 1:15:23 PM | Computer Name = Mikes-PC | Source = NVNET | ID = 5008
Description = NVIDIA nForce 10/100/1000 Mbps Ethernet : Has encountered an invalid
network address.

Error - 4/14/2012 1:15:29 PM | Computer Name = Mikes-PC | Source = BugCheck | ID = 1001
Description =

Error - 4/14/2012 1:19:16 PM | Computer Name = Mikes-PC | Source = Service Control Manager | ID = 7001
Description = The HomeGroup Provider service depends on the Function Discovery Provider
Host service which failed to start because of the following error: %%1058

Error - 4/15/2012 2:11:32 PM | Computer Name = Mikes-PC | Source = NVNET | ID = 5008
Description = NVIDIA nForce 10/100/1000 Mbps Ethernet : Has encountered an invalid
network address.

Error - 4/15/2012 2:12:48 PM | Computer Name = Mikes-PC | Source = Service Control Manager | ID = 7001
Description = The HomeGroup Provider service depends on the Function Discovery Provider
Host service which failed to start because of the following error: %%1058

Error - 4/15/2012 6:32:11 PM | Computer Name = Mikes-PC | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Steam
Client Service service to connect.

Error - 4/15/2012 6:32:11 PM | Computer Name = Mikes-PC | Source = Service Control Manager | ID = 7000
Description = The Steam Client Service service failed to start due to the following
error: %%1053

< End of report >

Running better....have downloaded and installed Comodo now.....thank

whiteknight1950 · Aug 9, 2012

Oops, just had a BSOD ....event viewer had a series of errors showing like Function Discovery Provider Host Service would not start,

custom dynamic link libraries are being loaded for every service,

Advanced System Care 5 failed to start bc the system cant find the file (I had already deleted the program)

Audit events have been dropped by the transport

Microsoft Security client OOBE stopped due to error 0xC000000D

Nvidia Nforce has encountered an invalid network address

The computer rebooted from a bugcheck with dump saved,

Broni · Aug 9, 2012

You may have some other issues as well beside being infected.
Let's finish cleaning process and we'll see how it goes.
BTW, those registry cleaning tools could be one of the reasons for your troubles.

Uninstall Free Window Registry Repair for the very same reason as Advanced System Care.

==============================================

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
SRV - File not found [Auto | Stopped] -- D:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe -- (AdvancedSystemCareService5)
IE - HKU\S-1-5-21-376916492-290187006-1338432341-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
[2012/08/07 18:48:19 | 000,000,000 | ---D | C] -- C:\FRST
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:D1B5B4F1
[2011/09/24 22:36:41 | 000,000,000 | ---D | M] -- C:\Users\Mikes\AppData\Roaming\Registry Mechanic


:Services

:Reg

:Files
D:\Program Files\IObit

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

=====================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

3. Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

4. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Tick the box next to YES, I accept the Terms of Use
Click Start
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click on List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

whiteknight1950 · Aug 9, 2012

Thanks Broni, OTL custom scan log here:

All processes killed
========== OTL ==========
Service AdvancedSystemCareService5 stopped successfully!
Service AdvancedSystemCareService5 deleted successfully!
File D:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe not found.
HKU\S-1-5-21-376916492-290187006-1338432341-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
C:\FRST\Quarantine folder moved successfully.
C:\FRST\Logs folder moved successfully.
C:\FRST\Hives folder moved successfully.
C:\FRST folder moved successfully.
ADS C:\ProgramData\TEMP

1B5B4F1 deleted successfully.
C:\Users\Mikes\AppData\Roaming\Registry Mechanic\log folder moved successfully.
C:\Users\Mikes\AppData\Roaming\Registry Mechanic\Health folder moved successfully.
C:\Users\Mikes\AppData\Roaming\Registry Mechanic folder moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
D:\Program Files\IObit\Smart Defrag 2\Skins\White folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\Skins\Black folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\Skins folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\Log folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\LatestNews folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\Language folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\Help\Images folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\Help folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\Freeware folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\drivers\wxp_x86 folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\drivers\wxp_x64 folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\drivers\wnet_x86 folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\drivers\wnet_x64 folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\drivers\wlh_x86 folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\drivers\wlh_x64 folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\drivers\win7_x86 folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\drivers\win7_x64 folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2\drivers folder moved successfully.
D:\Program Files\IObit\Smart Defrag 2 folder moved successfully.
D:\Program Files\IObit\IObit Malware Fighter\Quarantine Zone folder moved successfully.
D:\Program Files\IObit\IObit Malware Fighter\log\scan folder moved successfully.
D:\Program Files\IObit\IObit Malware Fighter\log\realtime folder moved successfully.
D:\Program Files\IObit\IObit Malware Fighter\log folder moved successfully.
D:\Program Files\IObit\IObit Malware Fighter folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 5\Update folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 5\SecurityHole_Backup folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 5\LatestNews folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 5\BootTimeLog folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 5\ASCServiceLog folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 5 folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 4\Update folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 4\LatestNews folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 4\Freeware\FreeSoftwareDownload folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 4\Freeware folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 4 folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Update\Skin\White folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Update\Skin\Black folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Update\Skin folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Update\Language folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Update folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Skin\White folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Skin\Black folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Skin folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\News\Css folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\News folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Language folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Images folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\ViewSonic VX2235wm-7 folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\ViewSonic VX2235wm-3 folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\NVIDIA nForce Serial ATA Controller folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\NVIDIA nForce 101001000 Mbps Ethernet folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\NVIDIA High Definition Audio folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\NVIDIA GeForce GTX 580 folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\MagicISO SCSI Host Controller folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\Brother MFC-9440CN Remote Setup Port folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\Brother MFC-9440CN Printer folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\Brother MFC-9440CN folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\ASUS Xonar DX Audio Device folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\Apple iPod USB Driver folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3\Backup folder moved successfully.
D:\Program Files\IObit\Advanced SystemCare 3 folder moved successfully.
D:\Program Files\IObit folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Mikes
->Temp folder emptied: 1098792 bytes
->Temporary Internet Files folder emptied: 40836 bytes
->Java cache emptied: 811422 bytes
->FireFox cache emptied: 81006857 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 1646 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 7004 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 79.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Mikes
->Java cache emptied: 0 bytes

User: Public

User: UpdatusUser

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Mikes
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.56.0 log created on 08092012_102357

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

whiteknight1950 · Aug 9, 2012

Security Check log here:

Results of screen317's Security Check version 0.99.43
Windows 7 Service Pack 1 x86 (UAC is disabled!)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
Microsoft Security Essentials
(On Access scanning disabled!)
Error obtaining update status for antivirus!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.62.0.1300
CCleaner
Java(TM) 6 Update 31
Java version out of Date!
Adobe Flash Player 11.3.300.270
Adobe Reader X (10.1.3)
Mozilla Firefox (7.0.1)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Malwarebytes Anti-Malware mbamservice.exe
Comodo Firewall cmdagent.exe
Comodo Firewall cfp.exe
IObit IObit Malware Fighter IMFsrv.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

whiteknight1950 · Aug 9, 2012

Farbar Log here:

Farbar Service Scanner Version: 06-08-2012
Ran by Mikes (administrator) on 09-08-2012 at 10:35:32
Running from "C:\Users\Mikes\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

whiteknight1950 · Aug 9, 2012

Temp file Cleaner ran ok:

The ESET ONline Scanner text file is:

C:\Program Files\FoxTabVideoConverter\VideoConverter.exe a variant of Win32/InstallCore.A application
C:\Qoobox\Quarantine\C\Windows\System32\drivers\RKHit.sys.vir Win32/Adware.SpywareCease application
C:\Users\Mikes\Downloads\Alcohol120_trial_2.0.2.3931.exe a variant of Win32/InstallCore.T application
C:\Users\Mikes\Downloads\cnet2_RegpairSetup_exe.exe a variant of Win32/InstallCore.D application
D:\MIKES-PC\Backup Set 2012-03-18 190001\Backup Files 2012-03-18 190001\Backup files 5.zip HTML/Hoax.FastDownload.A.Gen application
D:\MIKES-PC\Backup Set 2012-03-18 190001\Backup Files 2012-03-30 111111\Backup files 2.zip Java/Exploit.CVE-2011-3544.BB trojan
D:\MIKES-PC\Backup Set 2012-05-27 190002\Backup Files 2012-06-03 190005\Backup files 2.zip HTML/ScrInject.B.Gen virus
D:\MIKES-PC\Backup Set 2012-05-27 190002\Backup Files 2012-07-16 110612\Backup files 1.zip multiple threats
D:\MIKES-PC\Backup Set 2012-05-27 190002\Backup Files 2012-07-16 110612\Backup files 7.zip Win32/Toolbar.AskSBar application
D:\MIKES-PC\Backup Set 2012-08-06 161406\Backup Files 2012-08-06 161406\Backup files 6.zip multiple threats

Darn it !!!

Cheers
Mike

Solved Stubborn backdoor infection

Posts: 28 +0

Posts: 28 +0

Posts: 28 +0

Posts: 28 +0

Posts: 56,041 +516

Posts: 28 +0

Posts: 28 +0

Posts: 28 +0

Posts: 28 +0

Posts: 56,041 +516

Posts: 28 +0

Posts: 28 +0

Posts: 56,041 +516

Posts: 28 +0

Posts: 56,041 +516

Posts: 28 +0

Posts: 56,041 +516

Posts: 28 +0

Posts: 28 +0

Posts: 28 +0

Posts: 56,041 +516

Posts: 28 +0

Posts: 28 +0

Posts: 28 +0

Posts: 28 +0

Similar threads