Hello, I am usually pretty good with this stuff but I am totally stuck. I ran a few scans including Malwarebytes when I rebooted and found myself in a startup loop that I can not get out of. I ran the farbar scan tool but I have no idea what the problem is. If someone could please give me some help it would be greatly appreciated. Here is the logs: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 06-12-2012 Ran by SYSTEM at 11-12-2012 00:40:58 Running from F:\ Windows Vista Home Premium Service Pack 1 (X64) OS Language: English(US) The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKU\Default\...\Run: [HPADVISOR] c:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1644088 2009-05-08] (Hewlett-Packard) HKU\Default\...\Policies\system: [WallpaperStyle] 2 HKU\Default User\...\Run: [HPADVISOR] c:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1644088 2009-05-08] (Hewlett-Packard) HKU\Default User\...\Policies\system: [WallpaperStyle] 2 HKU\Guest\...\Run: [HPADVISOR] c:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1644088 2009-05-08] (Hewlett-Packard) HKU\Guest\...\Policies\system: [WallpaperStyle] 2 HKU\Jason\...\Run: [HPADVISOR] c:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1644088 2009-05-08] (Hewlett-Packard) HKU\Jason\...\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [2387968 2009-01-27] (Hewlett-Packard Company) HKU\Jason\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2009-10-30] (Google Inc.) HKU\Jason\...\Policies\system: [WallpaperStyle] 2 HKU\Old iPod Account\...\Run: [HPADVISOR] c:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1644088 2009-05-08] (Hewlett-Packard) HKU\Old iPod Account\...\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [2387968 2009-01-27] (Hewlett-Packard Company) HKU\Old iPod Account\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2009-10-30] (Google Inc.) HKU\Old iPod Account\...\Policies\system: [WallpaperStyle] 2 HKU\Stacy\...\RunOnce: [spybotDeletingB2274] command.com /c del "C:\Program Files (x86)\Free Offers from Freeze.com\control.txt" [x] HKU\Stacy\...\RunOnce: [spybotDeletingD8369] cmd.exe /c del "C:\Program Files (x86)\Free Offers from Freeze.com\control.txt" [x] HKU\Stacy\...\Policies\system: [WallpaperStyle] 2 HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /install /silent [766536 2012-09-29] (Malwarebytes Corporation) HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1089608 2012-09-29] (Malwarebytes Corporation) HKLM-x32\...\Runonce: [spybotDeletingA6698] command.com /c del "C:\Program Files (x86)\Free Offers from Freeze.com\control.txt" [x] HKLM-x32\...\Runonce: [spybotDeletingC1844] cmd.exe /c del "C:\Program Files (x86)\Free Offers from Freeze.com\control.txt" [x] Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 ==================== Services (Whitelisted) =================== 2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_7477fb4c\AESTSr64.exe [88576 2008-11-17] (Andrea Electronics Corporation) 2 AgereModemAudio; C:\Program Files\LSI SoftModem\agr64svc.exe [16896 2008-08-26] (Agere Systems) 2 atashost; "C:\Windows\SysWOW64\atashost.exe" [20376 2009-03-06] (WebEx Communications, Inc.) 2 HitmanPro36CrusaderBoot; "C:\Users\Stacy\Desktop\Tools\03HitmanPro36_x64.exe" /crusader:boot [9105176 2012-12-09] (SurfRight B.V.) 2 MBAMScheduler; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe" [399432 2012-09-29] (Malwarebytes Corporation) 2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [676936 2012-09-29] (Malwarebytes Corporation) 2 Recovery Service for Windows; C:\Program Files (x86)\SMINST\BLService.exe [365952 2009-03-09] () 2 RichVideo; "C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe" [247152 2009-01-21] () 2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_7477fb4c\STacSV64.exe [290304 2009-01-28] (IDT, Inc.) 2 TVCapSvc; "C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe" [296320 2009-02-04] () 2 TVSched; "C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe" [116104 2009-02-24] () ==================== Drivers (Whitelisted) ===================== 3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [25928 2012-09-29] (Malwarebytes Corporation) 4 hitmanpro36; \??\C:\Windows\system32\drivers\hitmanpro36.sys [x] 3 IpInIp; C:\Windows\System32\DRIVERS\ipinip.sys [x] 3 NwlnkFlt; C:\Windows\System32\DRIVERS\nwlnkflt.sys [x] 3 NwlnkFwd; C:\Windows\System32\DRIVERS\nwlnkfwd.sys [x] ==================== NetSvcs (Whitelisted) ==================== ==================== One Month Created Files and Folders ======== 2012-12-11 00:37 - 2012-12-11 00:37 - 00000000 ____D C:\FRST 2012-12-09 12:15 - 2012-12-09 12:15 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe 2012-12-09 12:15 - 2012-12-09 12:15 - 00000732 ____A C:\Windows\System32\.crusader 2012-12-09 09:24 - 2012-12-09 12:14 - 00000000 ____D C:\Users\All Users\HitmanPro 2012-12-09 09:24 - 2012-12-09 12:14 - 00000000 ____D C:\Users\All Users\Application Data\HitmanPro 2012-12-09 09:20 - 2012-12-09 09:20 - 00000121 ____A C:\Windows\wininit.ini 2012-12-08 19:44 - 2012-12-09 12:09 - 00000732 ____A C:\Users\Stacy\Local Settings\d3d9caps64.dat 2012-12-08 19:44 - 2012-12-09 12:09 - 00000732 ____A C:\Users\Stacy\Local Settings\Application Data\d3d9caps64.dat 2012-12-08 19:44 - 2012-12-09 12:09 - 00000732 ____A C:\Users\Stacy\AppData\Local\d3d9caps64.dat 2012-12-08 19:32 - 2012-12-08 19:32 - 00000000 ____D C:\Users\Stacy\Application Data\Malwarebytes 2012-12-08 19:32 - 2012-12-08 19:32 - 00000000 ____D C:\Users\Stacy\AppData\Roaming\Malwarebytes 2012-12-08 19:31 - 2012-12-08 19:31 - 00000948 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-12-08 19:31 - 2012-12-08 19:31 - 00000948 ____A C:\Users\All Users\Desktop\Malwarebytes Anti-Malware.lnk 2012-12-08 19:31 - 2012-12-08 19:31 - 00000000 ____D C:\Users\All Users\Malwarebytes 2012-12-08 19:31 - 2012-12-08 19:31 - 00000000 ____D C:\Users\All Users\Application Data\Malwarebytes 2012-12-08 19:31 - 2012-12-08 19:31 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-12-08 19:31 - 2012-09-29 16:54 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-12-08 19:27 - 2012-12-09 09:20 - 00000000 ____D C:\Users\All Users\Spybot - Search & Destroy 2012-12-08 19:27 - 2012-12-09 09:20 - 00000000 ____D C:\Users\All Users\Application Data\Spybot - Search & Destroy 2012-12-08 19:27 - 2012-12-08 19:27 - 00001097 ____A C:\Users\Stacy\Desktop\Spybot - Search & Destroy.lnk 2012-12-08 19:27 - 2012-12-08 19:27 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2012-12-08 19:25 - 2012-12-08 19:26 - 00000000 ____D C:\Users\Stacy\Desktop\Tools 2012-12-08 18:07 - 2012-12-08 17:59 - 21669952 ____A (Hewlett-Packard Company ) C:\Users\Stacy\Desktop\sp47344.exe 2012-12-08 17:01 - 2012-12-08 17:01 - 00000000 ____D C:\Windows\pss 2012-12-08 16:01 - 2012-12-08 16:01 - 00001099 ____A C:\Users\Stacy\Desktop\Revo Uninstaller.lnk 2012-12-08 16:01 - 2012-12-08 16:01 - 00000000 ____D C:\Program Files (x86)\VS Revo Group 2012-12-04 15:59 - 2012-12-08 14:52 - 00000378 ____A C:\Windows\Tasks\HPCeeScheduleForOld iPod Account.job 2012-12-04 15:59 - 2012-12-04 15:59 - 00000000 ___AH C:\Users\Old iPod Account\BITFF06.tmp ==================== One Month Modified Files and Folders ======= 2012-12-11 00:37 - 2012-12-11 00:37 - 00000000 ____D C:\FRST 2012-12-09 15:37 - 2006-11-02 05:33 - 00000000 ____D C:\Windows\PolicyDefinitions 2012-12-09 12:15 - 2012-12-09 12:15 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe 2012-12-09 12:15 - 2012-12-09 12:15 - 00000732 ____A C:\Windows\System32\.crusader 2012-12-09 12:14 - 2012-12-09 09:24 - 00000000 ____D C:\Users\All Users\HitmanPro 2012-12-09 12:14 - 2012-12-09 09:24 - 00000000 ____D C:\Users\All Users\Application Data\HitmanPro 2012-12-09 12:09 - 2012-12-08 19:44 - 00000732 ____A C:\Users\Stacy\Local Settings\d3d9caps64.dat 2012-12-09 12:09 - 2012-12-08 19:44 - 00000732 ____A C:\Users\Stacy\Local Settings\Application Data\d3d9caps64.dat 2012-12-09 12:09 - 2012-12-08 19:44 - 00000732 ____A C:\Users\Stacy\AppData\Local\d3d9caps64.dat 2012-12-09 09:28 - 2006-11-02 04:46 - 00703388 ____A C:\Windows\System32\PerfStringBackup.INI 2012-12-09 09:22 - 2008-01-20 19:26 - 00662412 ____A C:\Windows\PFRO.log 2012-12-09 09:20 - 2012-12-09 09:20 - 00000121 ____A C:\Windows\wininit.ini 2012-12-09 09:20 - 2012-12-08 19:27 - 00000000 ____D C:\Users\All Users\Spybot - Search & Destroy 2012-12-09 09:20 - 2012-12-08 19:27 - 00000000 ____D C:\Users\All Users\Application Data\Spybot - Search & Destroy 2012-12-08 19:40 - 2009-05-31 20:56 - 00000000 ____D C:\Users\All Users\Norton 2012-12-08 19:40 - 2009-05-31 20:56 - 00000000 ____D C:\Users\All Users\Application Data\Norton 2012-12-08 19:32 - 2012-12-08 19:32 - 00000000 ____D C:\Users\Stacy\Application Data\Malwarebytes 2012-12-08 19:32 - 2012-12-08 19:32 - 00000000 ____D C:\Users\Stacy\AppData\Roaming\Malwarebytes 2012-12-08 19:31 - 2012-12-08 19:31 - 00000948 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-12-08 19:31 - 2012-12-08 19:31 - 00000948 ____A C:\Users\All Users\Desktop\Malwarebytes Anti-Malware.lnk 2012-12-08 19:31 - 2012-12-08 19:31 - 00000000 ____D C:\Users\All Users\Malwarebytes 2012-12-08 19:31 - 2012-12-08 19:31 - 00000000 ____D C:\Users\All Users\Application Data\Malwarebytes 2012-12-08 19:31 - 2012-12-08 19:31 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-12-08 19:27 - 2012-12-08 19:27 - 00001097 ____A C:\Users\Stacy\Desktop\Spybot - Search & Destroy.lnk 2012-12-08 19:27 - 2012-12-08 19:27 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2012-12-08 19:26 - 2012-12-08 19:25 - 00000000 ____D C:\Users\Stacy\Desktop\Tools 2012-12-08 19:20 - 2009-05-31 20:33 - 00000012 ____A C:\Windows\bthservsdp.dat 2012-12-08 19:20 - 2006-11-02 07:42 - 00032610 ____A C:\Windows\Tasks\SCHEDLGU.TXT 2012-12-08 19:20 - 2006-11-02 07:42 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2012-12-08 19:20 - 2006-11-02 07:22 - 00003216 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2012-12-08 19:20 - 2006-11-02 07:22 - 00003216 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2012-12-08 19:18 - 2010-01-31 08:38 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2012-12-08 18:55 - 2009-08-16 11:40 - 01147724 ____A C:\Windows\WindowsUpdate.log 2012-12-08 18:54 - 2010-11-05 19:05 - 00000000 ____D C:\Users\Stacy\Local Settings\CrashDumps 2012-12-08 18:54 - 2010-11-05 19:05 - 00000000 ____D C:\Users\Stacy\Local Settings\Application Data\CrashDumps 2012-12-08 18:54 - 2010-11-05 19:05 - 00000000 ____D C:\Users\Stacy\AppData\Local\CrashDumps 2012-12-08 18:50 - 2010-01-31 08:38 - 00000898 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2012-12-08 18:20 - 2011-12-16 06:06 - 00000354 ____A C:\Windows\Tasks\At44.job 2012-12-08 18:20 - 2011-12-16 06:06 - 00000352 ____A C:\Windows\Tasks\At43.job 2012-12-08 18:18 - 2011-11-22 17:00 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-178244740-4076690350-799914828-1000UA.job 2012-12-08 18:09 - 2009-09-08 13:52 - 00000000 ____D C:\users\Stacy 2012-12-08 18:08 - 2011-11-22 18:58 - 00000324 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job 2012-12-08 18:08 - 2009-08-16 11:45 - 03896832 ____A (Broadcom Corporation) C:\Windows\System32\bcmihvsrv64.dll 2012-12-08 18:08 - 2009-08-16 11:45 - 03561472 ____A (Broadcom Corporation) C:\Windows\System32\bcmihvui64.dll 2012-12-08 18:08 - 2009-08-16 11:45 - 03058168 ____A (Broadcom Corporation) C:\Windows\System32\Drivers\BCMWL664.SYS 2012-12-08 18:08 - 2009-08-16 11:45 - 00095472 ____A (Broadcom Corporation) C:\Windows\System32\bcmwlcoi.dll 2012-12-08 18:08 - 2009-08-16 11:45 - 00006656 ____A C:\Windows\System32\bcmwlrc.dll 2012-12-08 18:08 - 2009-08-16 11:45 - 00000000 ____D C:\Windows\System32\no-NO 2012-12-08 18:08 - 2006-11-02 05:34 - 00000000 ____D C:\Windows\System32\zh-HK 2012-12-08 18:08 - 2006-11-02 05:34 - 00000000 ____D C:\Windows\System32\tr-TR 2012-12-08 18:08 - 2006-11-02 05:34 - 00000000 ____D C:\Windows\System32\th-TH 2012-12-08 18:08 - 2006-11-02 05:34 - 00000000 ____D C:\Windows\System32\sl-SI 2012-12-08 18:08 - 2006-11-02 05:34 - 00000000 ____D C:\Windows\System32\sk-SK 2012-12-08 18:08 - 2006-11-02 05:34 - 00000000 ____D C:\Windows\System32\ro-RO 2012-12-08 18:08 - 2006-11-02 05:34 - 00000000 ____D C:\Windows\System32\lv-LV 2012-12-08 18:08 - 2006-11-02 05:34 - 00000000 ____D C:\Windows\System32\lt-LT 2012-12-08 18:08 - 2006-11-02 05:34 - 00000000 ____D C:\Windows\System32\hr-HR 2012-12-08 18:08 - 2006-11-02 05:34 - 00000000 ____D C:\Windows\System32\he-IL 2012-12-08 18:08 - 2006-11-02 05:34 - 00000000 ____D C:\Windows\System32\et-EE 2012-12-08 18:08 - 2006-11-02 05:33 - 00000000 ____D C:\Windows\System32\bg-BG 2012-12-08 18:08 - 2006-11-02 05:33 - 00000000 ____D C:\Windows\System32\ar-SA 2012-12-08 18:07 - 2008-06-09 05:44 - 00000000 ____D C:\SwSetup 2012-12-08 18:07 - 2006-11-02 07:27 - 00164009 ____A C:\Windows\setupact.log 2012-12-08 17:59 - 2012-12-08 18:07 - 21669952 ____A (Hewlett-Packard Company ) C:\Users\Stacy\Desktop\sp47344.exe 2012-12-08 17:23 - 2009-09-08 14:26 - 00000000 ____D C:\Program Files\Linksys 2012-12-08 17:20 - 2011-12-16 06:06 - 00000354 ____A C:\Windows\Tasks\At42.job 2012-12-08 17:20 - 2011-12-16 06:06 - 00000352 ____A C:\Windows\Tasks\At41.job 2012-12-08 17:01 - 2012-12-08 17:01 - 00000000 ____D C:\Windows\pss 2012-12-08 17:01 - 2010-11-03 16:05 - 00000000 ____D C:\Users\Stacy\Application Data\BitTorrent 2012-12-08 17:01 - 2010-11-03 16:05 - 00000000 ____D C:\Users\Stacy\AppData\Roaming\BitTorrent 2012-12-08 16:20 - 2011-12-16 06:06 - 00000354 ____A C:\Windows\Tasks\At40.job 2012-12-08 16:20 - 2011-12-16 06:06 - 00000352 ____A C:\Windows\Tasks\At39.job 2012-12-08 16:18 - 2011-11-22 17:00 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-178244740-4076690350-799914828-1000Core.job 2012-12-08 16:01 - 2012-12-08 16:01 - 00001099 ____A C:\Users\Stacy\Desktop\Revo Uninstaller.lnk 2012-12-08 16:01 - 2012-12-08 16:01 - 00000000 ____D C:\Program Files (x86)\VS Revo Group 2012-12-08 14:52 - 2012-12-04 15:59 - 00000378 ____A C:\Windows\Tasks\HPCeeScheduleForOld iPod Account.job 2012-12-04 16:02 - 2010-09-04 15:01 - 00002475 ____A C:\Users\Public\Desktop\Safari.lnk 2012-12-04 16:02 - 2010-09-04 15:01 - 00002475 ____A C:\Users\All Users\Desktop\Safari.lnk 2012-12-04 16:02 - 2010-08-04 12:10 - 00000000 ____D C:\Users\Old iPod Account\Local Settings\Application Data\Apple Computer 2012-12-04 16:02 - 2010-08-04 12:10 - 00000000 ____D C:\Users\Old iPod Account\Local Settings\Apple Computer 2012-12-04 16:02 - 2010-08-04 12:10 - 00000000 ____D C:\Users\Old iPod Account\AppData\Local\Apple Computer 2012-12-04 16:02 - 2010-08-04 12:06 - 00000000 ____D C:\Users\Old iPod Account\Application Data\Apple Computer 2012-12-04 16:02 - 2010-08-04 12:06 - 00000000 ____D C:\Users\Old iPod Account\AppData\Roaming\Apple Computer 2012-12-04 16:01 - 2010-08-08 08:48 - 00000000 ____D C:\Users\Old iPod Account\Local Settings\Google 2012-12-04 16:01 - 2010-08-08 08:48 - 00000000 ____D C:\Users\Old iPod Account\Local Settings\Application Data\Google 2012-12-04 16:01 - 2010-08-08 08:48 - 00000000 ____D C:\Users\Old iPod Account\AppData\Local\Google 2012-12-04 15:59 - 2012-12-04 15:59 - 00000000 ___AH C:\Users\Old iPod Account\BITFF06.tmp 2012-12-04 15:59 - 2010-08-04 12:03 - 00000000 ____D C:\users\Old iPod Account 2012-12-04 15:58 - 2010-08-04 12:07 - 00000000 ____D C:\Users\Old iPod Account\Application Data\Hewlett-Packard 2012-12-04 15:58 - 2010-08-04 12:07 - 00000000 ____D C:\Users\Old iPod Account\AppData\Roaming\Hewlett-Packard 2012-12-04 15:58 - 2009-08-16 12:55 - 00000052 ____A C:\Windows\SysWOW64\DOErrors.log 2012-12-04 15:57 - 2010-08-04 12:06 - 00000000 ____D C:\Users\Old iPod Account\Local Settings\Hewlett-Packard 2012-12-04 15:57 - 2010-08-04 12:06 - 00000000 ____D C:\Users\Old iPod Account\Local Settings\Application Data\Hewlett-Packard 2012-12-04 15:57 - 2010-08-04 12:06 - 00000000 ____D C:\Users\Old iPod Account\AppData\Local\Hewlett-Packard 2012-12-04 15:50 - 2010-08-04 12:06 - 00076208 ____A C:\Users\Old iPod Account\Local Settings\GDIPFONTCACHEV1.DAT 2012-12-04 15:50 - 2010-08-04 12:06 - 00076208 ____A C:\Users\Old iPod Account\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2012-12-04 15:50 - 2010-08-04 12:06 - 00076208 ____A C:\Users\Old iPod Account\AppData\Local\GDIPFONTCACHEV1.DAT 2012-12-04 15:48 - 2010-08-08 18:21 - 00000680 ____A C:\Users\Old iPod Account\Local Settings\d3d9caps.dat 2012-12-04 15:48 - 2010-08-08 18:21 - 00000680 ____A C:\Users\Old iPod Account\Local Settings\Application Data\d3d9caps.dat 2012-12-04 15:48 - 2010-08-08 18:21 - 00000680 ____A C:\Users\Old iPod Account\AppData\Local\d3d9caps.dat ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2012-02-24 00:01:12 Restore point made on: 2012-02-24 21:00:23 Restore point made on: 2012-02-25 21:53:36 Restore point made on: 2012-02-26 22:09:20 Restore point made on: 2012-02-27 21:04:45 Restore point made on: 2012-02-28 21:52:11 Restore point made on: 2012-02-29 21:00:21 Restore point made on: 2012-03-01 21:00:05 Restore point made on: 2012-03-02 21:45:22 Restore point made on: 2012-03-03 21:00:21 Restore point made on: 2012-03-04 23:08:26 Restore point made on: 2012-03-05 22:58:59 Restore point made on: 2012-03-09 05:56:23 Restore point made on: 2012-03-09 21:00:04 Restore point made on: 2012-03-10 21:00:08 Restore point made on: 2012-03-11 20:00:20 Restore point made on: 2012-03-12 15:10:22 Restore point made on: 2012-03-13 03:28:36 Restore point made on: 2012-03-16 05:16:20 Restore point made on: 2012-03-16 20:00:04 Restore point made on: 2012-03-17 21:43:24 Restore point made on: 2012-03-18 20:33:32 Restore point made on: 2012-03-19 20:34:14 Restore point made on: 2012-05-13 09:28:09 Restore point made on: 2012-05-18 04:31:56 Restore point made on: 2012-06-01 05:40:55 Restore point made on: 2012-07-06 04:51:25 Restore point made on: 2012-07-06 04:58:28 Restore point made on: 2012-12-08 16:03:12 Restore point made on: 2012-12-08 17:37:38 Restore point made on: 2012-12-08 18:08:59 ==================== Memory info =========================== Percentage of memory in use: 16% Total physical RAM: 3998.02 MB Available physical RAM: 3328.83 MB Total Pagefile: 3676.99 MB Available Pagefile: 3303.7 MB Total Virtual: 8192 MB Available Virtual: 8191.91 MB ==================== Partitions ============================= 1 Drive c: () (Fixed) (Total:286.41 GB) (Free:133.24 GB) NTFS ==>[system with boot components (obtained from reading drive)] 2 Drive d: (2008.03.29_2201) (CDROM) (Total:0.15 GB) (Free:0 GB) UDF 3 Drive e: (RECOVERY) (Fixed) (Total:11.68 GB) (Free:1.9 GB) NTFS ==>[system with boot components (obtained from reading drive)] 4 Drive f: () (Removable) (Total:7.45 GB) (Free:0.44 GB) FAT32 5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Disk ### Status Size Free Dyn Gpt -------- ---------- ------- ------- --- --- Disk 0 Online 932 GB 633 GB Disk 1 Online 7630 MB 0 B Partitions of Disk 0: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 286 GB 1024 KB Partition 2 Primary 12 GB 286 GB ================================================================================== Disk: 0 Partition 1 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 1 C NTFS Partition 286 GB Healthy ========================================================= Disk: 0 Partition 2 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 2 E RECOVERY NTFS Partition 12 GB Healthy ========================================================= Partitions of Disk 1: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 7629 MB 16 KB ================================================================================== Disk: 1 Partition 1 Type : 0B Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 3 F FAT32 Removable 7629 MB Healthy ========================================================= Last Boot: 2012-12-09 09:43 ==================== End Of Log =============================
