Blacksbane

Members
  • Content count

    20
  • Joined

  • Last visited

About Blacksbane

  • Rank
    New Member
  1. Thank you very much!! Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.07.25.08 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 Patrick :: MYPCYADIG [administrator] 7/26/2012 6:15:01 PM mbam-log-2012-07-26 (18-15-01).txt Scan type: Quick scan Scan options enabled: Memory | Startup | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: Registry | P2P Objects scanned: 186695 Time elapsed: 4 minute(s), 13 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
  2. Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] "58762"="C:\\PROGRA~3\\LOCALS~1\\Temp\\msvara.cmd"
  3. I scan with mbam and it found trojan.agent. this is the log. Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.07.25.08 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 Patrick :: MYPCYADIG [administrator] 7/25/2012 5:16:26 PM mbam-log-2012-07-25 (17-16-26).txt Scan type: Quick scan Scan options enabled: Memory | Startup | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: Registry | P2P Objects scanned: 187217 Time elapsed: 3 minute(s), 48 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|58762 (Trojan.Agent) -> Data: C:\PROGRA~3\LOCALS~1\Temp\msvara.cmd -> Delete on reboot. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) i did remove selected and restarted. i just scanned with mbam now and it found it again heres the log: Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.07.25.08 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 Patrick :: MYPCYADIG [administrator] 7/25/2012 5:24:23 PM mbam-log-2012-07-25 (17-32-47).txt Scan type: Quick scan Scan options enabled: Memory | Startup | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: Registry | P2P Objects scanned: 186724 Time elapsed: 4 minute(s), 11 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|58762 (Trojan.Agent) -> Data: C:\PROGRA~3\LOCALS~1\Temp\msvara.cmd -> No action taken. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
  4. ComboFix 12-07-26.04 - Patrick 07/25/2012 15:56:06.2.1 - x64 MINIMAL Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2812.1959 [GMT -5:00] Running from: c:\users\Patrick\Desktop\ComboFix.exe AV: McAfee VirusScan *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} FW: McAfee Personal Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} SP: McAfee VirusScan *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((( Files Created from 2012-06-25 to 2012-07-25 ))))))))))))))))))))))))))))))) . . 2012-07-25 21:05 . 2012-07-25 21:05 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp 2012-07-25 21:05 . 2012-07-25 21:05 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-07-25 02:07 . 2012-07-25 02:07 -------- d-----w- C:\FRST 2012-07-11 08:28 . 2012-07-11 08:28 -------- d-----w- C:\TDSSKiller_Quarantine 2012-07-11 08:11 . 2012-06-12 03:02 3147264 ----a-w- c:\windows\system32\win32k.sys 2012-07-11 06:16 . 2010-12-20 23:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2012-07-11 06:16 . 2012-07-03 18:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-07-09 22:45 . 2012-07-09 22:45 -------- d-sh--w- c:\windows\SysWow64\%APPDATA% 2012-07-09 22:01 . 2012-07-09 22:01 -------- d-----w- c:\programdata\Local Settings 2012-07-07 00:09 . 2012-07-22 23:07 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-22 23:07 . 2011-06-18 20:26 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-11 08:04 . 2011-04-16 20:56 59701280 ----a-w- c:\windows\system32\MRT.exe 2012-06-02 22:19 . 2012-06-24 01:07 38424 ----a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-24 01:07 2428952 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:19 . 2012-06-24 01:07 57880 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-24 01:07 44056 ----a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-24 01:07 701976 ----a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:15 . 2012-06-24 01:07 2622464 ----a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:15 . 2012-06-24 01:07 99840 ----a-w- c:\windows\system32\wudriver.dll 2012-06-02 20:19 . 2012-06-24 01:06 186752 ----a-w- c:\windows\system32\wuwebv.dll 2012-06-02 20:15 . 2012-06-24 01:06 36864 ----a-w- c:\windows\system32\wuapp.exe 2012-05-04 10:52 . 2012-06-14 04:14 5505392 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 10:08 . 2012-06-14 04:14 3958128 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:08 . 2012-06-14 04:14 3902320 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-05-02 05:32 . 2012-06-14 04:14 208896 ----a-w- c:\windows\system32\profsvc.dll 2012-04-28 03:50 . 2012-06-14 04:13 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2009-08-06 17:18 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408] "Messenger (Yahoo!)"="c:\progra~2\Yahoo!\MESSEN~1\YahooMessenger.exe" [2011-06-16 6276408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] "NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-24 588648] "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-07-28 1157128] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-30 98304] "ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-08-01 128296] "PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-08-05 181480] "Acer Assist Launcher"="c:\program files (x86)\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568] "mcagent_exe"="c:\program files (x86)\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008] "ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-07-06 421888] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Air Mouse.lnk - c:\program files (x86)\Air Mouse\Air Mouse\Air Mouse.exe [2011-9-3 1106432] McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R1 archlp;archlp;SysWOW64\drivers\archlp.sys [x] R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576] R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016] R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-07-29 203264] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 DVBLink Server;DVBLink Server;c:\program files (x86)\DVBLogic\DVBLink\DVBLinkSrv.exe [2009-07-01 135168] R2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-08-06 844320] R2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-06-04 1150496] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 135664] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files (x86)\McAfee\SiteAdvisor\McSACore.exe [2012-06-15 103472] R2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-08-06 311592] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640] R2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160] R3 dump_wmimmc;dump_wmimmc;c:\ijji\ENGLISH\u_sf\GameGuard\dump_wmimmc.sys [x] R3 dvblinkcap;DVBLink Capture 39A16CF1D2D85F6F7A968981EE9B99511F32CC46;c:\windows\system32\DRIVERS\dvblinkcap.sys [2009-05-04 18608] R3 dvblinkcap2;DVBLink Capture 454A65853766664A35602CB9F5C0D12CAE31EA2F37D729C7360EE9AB;c:\windows\system32\DRIVERS\dvblinkcap2.sys [2009-05-04 18608] R3 dvblinkcap3;DVBLink Capture A7BD1C44C58FD1378C13AA43CB1B848B1302D908598A62281224518D10373E70;c:\windows\system32\DRIVERS\dvblinkcap3.sys [2009-05-04 18608] R3 dvblinkcap4;DVBLink Capture B28D17A1EBD894FCA3AFB1EA0EC40D9AD7BBB02E97C180E2FED7CFDC89BBBB0073E3D79F5FDE39EE80A7E060B6211843;c:\windows\system32\DRIVERS\dvblinkcap4.sys [2009-05-04 18608] R3 dvblinktun;DVBLink Tuner B80EC7464A7658949D5BFD306EE25AF644FCFE67;c:\windows\system32\DRIVERS\dvblinktun.sys [2009-05-04 20784] R3 dvblinktun2;DVBLink Tuner 13E436F7285F837B06C484A7CDC45FEAA0D50C11A1EC92DE192BC201;c:\windows\system32\DRIVERS\dvblinktun2.sys [2009-05-04 20784] R3 dvblinktun3;DVBLink Tuner 22E8A099F6626A869E8B3F08F1B728E9623E08FFA775B78513EE17E5C8080678;c:\windows\system32\DRIVERS\dvblinktun3.sys [2009-05-04 20784] R3 dvblinktun4;DVBLink Tuner 64113C0133109F21D4F8C5E284FAF7865AFB3EB7A6FFA3D1C536FB414753D37991117EF0B0D24DC8A021A0F52A5CD08D;c:\windows\system32\DRIVERS\dvblinktun4.sys [2009-05-04 20784] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 135664] R3 hcwhdpvr;Hauppauge HD PVR Capture Device;c:\windows\system32\DRIVERS\hcwhdpvr.sys [2010-04-24 189440] R3 jumi;%Jumi%;c:\windows\system32\DRIVERS\jumi.sys [2010-06-03 15160] R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [2009-07-27 58880] R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys [2008-07-26 15768] R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2008-07-26 790424] R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys [2008-07-26 50072] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x] R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-08-10 222208] R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-01 1255736] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-07-05 254528] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-04-03 34872] . . Contents of the 'Scheduled Tasks' folder . 2012-07-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 05:33] . 2012-07-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 05:33] . 2012-07-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3794066387-2219636134-70439330-1000Core.job - c:\users\Patrick\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-18 05:33] . 2012-07-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3794066387-2219636134-70439330-1000UA.job - c:\users\Patrick\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-18 05:33] . 2012-07-15 c:\windows\Tasks\McDefragTask.job - c:\progra~2\mcafee\mqc\QcConsol.exe [2009-12-25 18:22] . 2012-07-01 c:\windows\Tasks\McQcTask.job - c:\progra~2\mcafee\mqc\QcConsol.exe [2009-12-25 18:22] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2009-08-06 17:19 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112] "Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-08-06 828960] "mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-08-06 349480] . ------- Supplementary Scan ------- . uStart Page = uLocal Page = c:\windows\system32\blank.htm mStart Page = mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D1E1F7ED622A0E5D.dll/cmsidewiki.html TCP: DhcpNameServer = 192.168.1.254 DPF: Justin.tv Publisher - hxxp://www.justin.tv/plugins/justintv_publisher.CAB FF - ProfilePath - c:\users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\yppm9cke.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.mydtzone.com/startpage|https://mail.google.com/mail/?shva=1#|https://www.google.com/calendar/render?tab=mc&gsessionid=KyyaFjT6OOlMUBo7bbM01A|https://docs.google.com/?tab=mo&pli=1#all FF - user.js: yahoo.ytff.general.dontshowhpoffer - true . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Explorer_Run-58762 - c:\progra~3\LOCALS~1\Temp\msvara.cmd HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe HKLM-Run-LogMeIn GUI - c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe AddRemove-Adobe Flash Player Plugin - c:\windows\SysWOW64\Macromed\Flash\FlashUtil10t_Plugin.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-3794066387-2219636134-70439330-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-3794066387-2219636134-70439330-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-07-25 16:09:29 ComboFix-quarantined-files.txt 2012-07-25 21:09 . Pre-Run: 49,035,927,552 bytes free Post-Run: 48,833,175,552 bytes free . - - End Of File - - 2682A607BD4B75F83A340458C2BF5CF4
  5. Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 24-07-2012 02 Ran by SYSTEM at 2012-07-25 02:55:02 Run:1 Running from G:\ ============================================== C:\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118} moved successfully. C:\Users\Patrick\AppData\Local\{52a689ea-4d72-da20-a8af-379893955118} moved successfully. C:\Windows\assembly\GAC_32\Desktop.ini moved successfully. C:\Windows\assembly\GAC_64\Desktop.ini moved successfully. ==== End of Fixlog ====
  6. FRST Scan result of Farbar Recovery Scan Tool Version: 24-07-2012 02 Ran by SYSTEM at 24-07-2012 18:07:48 Running from G:\ Windows 7 Home Premium (X64) OS Language: English(US) The current controlset is ControlSet001 ========================== Registry (Whitelisted) ============= HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor) HKLM\...\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [828960 2009-08-05] (Acer Incorporated) HKLM\...\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-08-06] (Egis Technology Inc.) HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-18] (Synaptics Incorporated) HKLM\...\Run: [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe" [x] HKLM-x32\...\Run: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [199464 2009-08-03] (Egis Technology Inc.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-02-27] (Adobe Systems Incorporated) HKLM-x32\...\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED [588648 2009-07-24] (Symantec Corporation) HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [1157128 2009-07-27] (Dritek System Inc.) HKLM-x32\...\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-07-29] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [128296 2009-07-31] (CyberLink Corp.) HKLM-x32\...\Run: [PlayMovie] "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [181480 2009-08-04] (Acer Corp.) HKLM-x32\...\Run: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe [1261568 2007-11-19] () HKLM-x32\...\Run: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey [1218008 2009-10-29] (McAfee, Inc.) HKLM-x32\...\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-07-05] (Apple Inc.) HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-11-01] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2012-01-16] (Apple Inc.) HKU\Patrick\...\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [1305408 2011-01-20] (DT Soft Ltd) HKU\Patrick\...\Run: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet [6276408 2011-06-16] (Yahoo! Inc.) HKU\Patrick\...\Run: [Google Update] "C:\Users\Patrick\AppData\Local\Google\Update\GoogleUpdate.exe" /c [135664 2010-02-05] (Google Inc.) HKLM\...\Policies\Explorer\Run: [58762] C:\PROGRA~3\LOCALS~1\Temp\msvara.cmd Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 Startup: C:\Users\All Users\Start Menu\Programs\Startup\Air Mouse.lnk ShortcutTarget: Air Mouse.lnk -> C:\Program Files (x86)\Air Mouse\Air Mouse\Air Mouse.exe () Startup: C:\Users\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.) ==================== Services (Whitelisted) ====== 2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) 2 DVBLink Server; C:\Program Files (x86)\DVBLogic\DVBLink\DVBLinkSrv.exe [135168 2009-06-30] () 2 McAfee SiteAdvisor Service; "C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe" [103472 2012-06-15] (McAfee, Inc.) 3 McComponentHostService; "C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe" [227232 2010-01-15] (McAfee, Inc.) 2 mcmscsvc; C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe [865832 2009-10-29] (McAfee, Inc.) 2 McNASvc; "C:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe" [2482848 2009-07-07] (McAfee, Inc.) 3 McODS; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [696848 2009-10-28] (McAfee, Inc.) 2 McProxy; C:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe [359952 2009-07-08] (McAfee, Inc.) 2 McShield; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [155456 2009-11-04] (McAfee, Inc.) 3 McSysmon; C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe [606736 2009-11-04] (McAfee, Inc.) 2 MpfService; "C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe" [895696 2009-10-27] (McAfee, Inc.) 2 MSK80Service; "C:\Program Files (x86)\McAfee\MSK\MskSrver.exe" [26640 2009-10-02] (McAfee, Inc.) 2 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [311592 2009-08-06] (Egis Technology Inc.) ========================== Drivers (Whitelisted) ============= 1 archlp; C:\Windows\SysWow64\Drivers\archlp.sys [161792 2009-02-06] () 1 dtsoftbus01; C:\Windows\System32\Drivers\dtsoftbus01.sys [254528 2011-07-04] (DT Soft Ltd) 3 dvblinkcap; C:\Windows\System32\Drivers\dvblinkcap.sys [18608 2009-05-03] (DVBLink) 3 dvblinkcap2; C:\Windows\System32\Drivers\dvblinkcap2.sys [18608 2009-05-03] (DVBLink) 3 dvblinkcap3; C:\Windows\System32\Drivers\dvblinkcap3.sys [18608 2009-05-03] (DVBLink) 3 dvblinkcap4; C:\Windows\System32\Drivers\dvblinkcap4.sys [18608 2009-05-03] (DVBLink) 3 dvblinktun; C:\Windows\System32\Drivers\dvblinktun.sys [20784 2009-05-03] (DVBLink) 3 dvblinktun2; C:\Windows\System32\Drivers\dvblinktun2.sys [20784 2009-05-03] (DVBLink) 3 dvblinktun3; C:\Windows\System32\Drivers\dvblinktun3.sys [20784 2009-05-03] (DVBLink) 3 dvblinktun4; C:\Windows\System32\Drivers\dvblinktun4.sys [20784 2009-05-03] (DVBLink) 3 hcwhdpvr; C:\Windows\System32\Drivers\hcwhdpvr.sys [189440 2010-04-24] (Hauppauge, Inc.) 3 jumi; C:\Windows\System32\Drivers\jumi.sys [15160 2010-06-03] (Windows ® Codename Longhorn DDK provider) 3 lmimirr; C:\Windows\System32\Drivers\lmimirr.sys [11552 2011-01-11] (LogMeIn, Inc.) 2 LMIRfsDriver; C:\Windows\System32\Drivers\LMIRfsDriver.sys [72216 2011-01-11] (LogMeIn, Inc.) 3 mfeavfk; C:\Windows\System32\Drivers\mfeavfk.sys [102472 2009-11-04] (McAfee, Inc.) 1 mfehidk; C:\Windows\System32\Drivers\mfehidk.sys [308296 2009-11-04] (McAfee, Inc.) 3 mferkdk; C:\Windows\System32\Drivers\mferkdk.sys [40904 2009-11-04] (McAfee, Inc.) 3 mfesmfk; C:\Windows\System32\Drivers\mfesmfk.sys [49480 2009-11-04] (McAfee, Inc.) 1 MPFP; C:\Windows\System32\Drivers\MPFP.sys [176144 2009-04-09] (McAfee, Inc.) 3 UBHelper; C:\Windows\System32\Drivers\UBHelper.sys [16896 2009-05-05] (NewTech Infosystems Corporation) 3 dump_wmimmc; \??\C:\ijji\ENGLISH\u_sf\GameGuard\dump_wmimmc.sys [x] 3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x] 2 LMIInfo; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [x] 4 LMIRfsClientNP; [x] 3 NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [x] 3 RtsUIR; C:\Windows\System32\DRIVERS\Rts516xIR.sys [x] 3 USBCCID; C:\Windows\System32\DRIVERS\RtsUCcid.sys [x] ========================== NetSvcs (Whitelisted) =========== ============ One Month Created Files and Folders ============== 2012-07-24 15:00 - 2012-07-24 15:00 - 00008212 ____A C:\Windows\mfebcdata 2012-07-23 21:49 - 2012-07-23 21:49 - 00002227 ____A C:\Users\Patrick\Desktop\RKreport[1].txt 2012-07-23 21:48 - 2012-07-23 21:49 - 00000000 ____D C:\Users\Patrick\Desktop\RK_Quarantine 2012-07-23 21:48 - 2012-07-23 21:48 - 01552384 ____A C:\Users\Patrick\Desktop\RogueKiller.exe 2012-07-22 13:37 - 2012-07-22 13:37 - 00031962 ____A C:\Users\Patrick\Desktop\DDS.txt 2012-07-22 13:36 - 2012-07-22 13:36 - 00015194 ____A C:\Users\Patrick\Desktop\Attach.txt 2012-07-22 13:33 - 2012-07-22 13:33 - 00607260 ____R (Swearware) C:\Users\Patrick\Desktop\dds.com 2012-07-13 15:42 - 2012-07-13 15:42 - 00000000 ____D C:\Users\Patrick\AppData\Local\{C9012D75-005A-4D65-BD54-88428683E238} 2012-07-13 15:42 - 2012-07-13 15:42 - 00000000 ____D C:\Users\Patrick\AppData\Local\{1A99A097-D428-45A6-9910-2A06800D8C42} 2012-07-13 15:41 - 2012-07-13 15:41 - 00000000 ____D C:\Users\Patrick\AppData\Local\{6C4ADD03-F059-4E93-A77C-0163A05E5156} 2012-07-13 15:41 - 2012-07-13 15:41 - 00000000 ____D C:\Users\Patrick\AppData\Local\{5D483348-1AD9-4410-A203-4ABBD327E982} 2012-07-11 12:57 - 2012-07-11 12:57 - 00000000 ____D C:\Users\Patrick\AppData\Local\{A0C152D8-9AEF-4D65-B857-EA04B5D088C6} 2012-07-11 12:57 - 2012-07-11 12:57 - 00000000 ____D C:\Users\Patrick\AppData\Local\{8946BABA-EEB5-4743-A051-7C5A6036850F} 2012-07-11 10:55 - 2012-07-11 10:55 - 00125488 ____A C:\Users\Patrick\Downloads\OTL.Txt 2012-07-11 10:19 - 2012-07-11 10:19 - 00000000 ____D C:\Users\Patrick\AppData\Local\{C0F4C81C-4B43-4D02-9FC8-EEBF8B45A1D3} 2012-07-11 10:19 - 2012-07-11 10:19 - 00000000 ____D C:\Users\Patrick\AppData\Local\{789956D4-0C83-42DF-A079-D55706C97942} 2012-07-11 02:44 - 2012-07-11 02:44 - 00000000 ____D C:\Users\Patrick\AppData\Local\{D79EF15C-DE3D-4C42-ADFB-CCFEFDD6E16D} 2012-07-11 02:44 - 2012-07-11 02:44 - 00000000 ____D C:\Users\Patrick\AppData\Local\{9037F0A1-59F3-41C6-9153-479AD39E8A01} 2012-07-11 01:28 - 2012-07-11 13:48 - 00000000 ____D C:\Windows\erdnt 2012-07-11 01:16 - 2012-07-11 01:16 - 00000000 ____D C:\Users\Patrick\AppData\Local\{CF68DEBC-8226-4E1E-9B54-E5D6726FEB64} 2012-07-11 01:16 - 2012-07-11 01:16 - 00000000 ____D C:\Users\Patrick\AppData\Local\{AB5A1DD3-7585-4A53-8C6C-554EADD1A579} 2012-07-11 01:02 - 2012-07-11 01:02 - 00000000 ____D C:\Users\Patrick\AppData\Local\{73F04097-B915-4DFF-ACE3-0A83D51AB16A} 2012-07-11 01:01 - 2012-07-11 01:02 - 00000000 ____D C:\Users\Patrick\AppData\Local\{EBB2A6AC-AC18-48FB-9CBE-41EB5D812DDB} 2012-07-11 00:47 - 2012-07-11 00:47 - 00060284 ____A C:\Users\Patrick\Downloads\Extras.Txt 2012-07-11 00:28 - 2012-07-11 00:28 - 00000000 ____D C:\TDSSKiller_Quarantine 2012-07-11 00:11 - 2012-06-11 19:02 - 03147264 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-07-11 00:02 - 2012-06-02 04:49 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-07-11 00:02 - 2012-06-02 04:17 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-07-11 00:02 - 2012-06-02 04:12 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-07-11 00:02 - 2012-06-02 04:05 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-07-11 00:02 - 2012-06-02 04:05 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-07-11 00:02 - 2012-06-02 04:04 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-07-11 00:02 - 2012-06-02 04:04 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-07-11 00:02 - 2012-06-02 04:03 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-07-11 00:02 - 2012-06-02 04:01 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-07-11 00:02 - 2012-06-02 04:00 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-07-11 00:02 - 2012-06-02 03:59 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-07-11 00:02 - 2012-06-02 03:57 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-07-11 00:02 - 2012-06-02 03:57 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-07-11 00:02 - 2012-06-02 03:54 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-07-11 00:02 - 2012-06-02 01:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-07-11 00:02 - 2012-06-02 00:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-07-11 00:02 - 2012-06-02 00:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2012-07-11 00:02 - 2012-06-02 00:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-07-11 00:02 - 2012-06-02 00:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2012-07-11 00:02 - 2012-06-02 00:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-07-11 00:02 - 2012-06-02 00:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-07-11 00:02 - 2012-06-02 00:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-07-11 00:02 - 2012-06-02 00:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2012-07-11 00:02 - 2012-06-02 00:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-07-11 00:02 - 2012-06-02 00:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2012-07-11 00:02 - 2012-06-02 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-07-11 00:02 - 2012-06-02 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-07-11 00:02 - 2012-06-02 00:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-07-10 23:30 - 2012-07-10 23:30 - 00000000 ____D C:\Users\Patrick\AppData\Local\{EEE30319-6879-4322-9711-122E1328624C} 2012-07-10 23:30 - 2012-07-10 23:30 - 00000000 ____D C:\Users\Patrick\AppData\Local\{580AA3BC-8939-44E5-A927-CA81E6D2F66C} 2012-07-10 23:17 - 2012-07-10 23:17 - 00000000 ____D C:\Users\Patrick\AppData\Local\{C4889019-5237-4FB8-ABC5-AC2F21390A1D} 2012-07-10 23:17 - 2012-07-10 23:17 - 00000000 ____D C:\Users\Patrick\AppData\Local\{9CA68046-8753-4102-840B-37157B95C4B3} 2012-07-10 22:23 - 2012-07-21 10:57 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-07-10 22:16 - 2012-07-03 10:46 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-07-10 22:16 - 2010-12-20 15:09 - 00038224 ____A (Malwarebytes Corporation) C:\Windows\SysWOW64\Drivers\mbamswissarmy.sys 2012-07-10 16:49 - 2012-07-10 16:49 - 00000000 ____D C:\Users\Patrick\AppData\Local\{0C363A0D-6181-4E36-A36C-42BD1D466D7F} 2012-07-10 16:49 - 2012-07-10 16:49 - 00000000 ____D C:\Users\Patrick\AppData\Local\{01013834-02E5-4392-A743-464BDDBD6EF6} 2012-07-10 16:37 - 2012-06-08 21:30 - 14165504 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-07-10 16:37 - 2012-06-08 20:46 - 12868608 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2012-07-10 16:37 - 2012-06-05 21:50 - 02003968 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll 2012-07-10 16:37 - 2012-06-05 21:50 - 01880064 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll 2012-07-10 16:37 - 2012-06-05 21:09 - 01389568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2012-07-10 16:37 - 2012-06-05 21:09 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2012-07-10 16:37 - 2012-06-01 21:38 - 00152432 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys 2012-07-10 16:37 - 2012-06-01 21:38 - 00095088 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys 2012-07-10 16:37 - 2012-06-01 21:37 - 00459216 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys 2012-07-10 16:37 - 2012-06-01 21:27 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll 2012-07-10 16:37 - 2012-06-01 21:27 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll 2012-07-10 16:37 - 2012-06-01 20:48 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2012-07-10 16:37 - 2012-06-01 20:48 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2012-07-10 16:37 - 2012-06-01 20:47 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2012-07-10 16:37 - 2012-06-01 20:42 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2012-07-10 16:27 - 2012-07-10 16:27 - 00000000 ____D C:\Users\Patrick\AppData\Local\{B2159F49-5536-466B-B908-2B1DF9C1162E} 2012-07-10 16:27 - 2012-07-10 16:27 - 00000000 ____D C:\Users\Patrick\AppData\Local\{A46910BB-C141-44C2-B4BB-03214CF399A3} 2012-07-10 14:15 - 2012-07-10 14:16 - 00000000 ____D C:\Users\Patrick\AppData\Local\{E3B5E006-EEBC-4D5E-A7FE-F1ECB839017A} 2012-07-10 14:15 - 2012-07-10 14:15 - 00000000 ____D C:\Users\Patrick\AppData\Local\{C439CCF2-CE02-461E-B6E3-255C0AFCD429} 2012-07-09 14:45 - 2012-07-09 14:45 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA% 2012-07-09 13:06 - 2012-07-09 13:06 - 00000000 ____D C:\Users\Patrick\AppData\Local\{5BE8095B-6571-46A0-B25E-3CBCC0CF7926} 2012-07-09 13:06 - 2012-07-09 13:06 - 00000000 ____D C:\Users\Patrick\AppData\Local\{10E73D9D-2C59-4263-95F0-FC6EDAD6A106} 2012-07-08 07:35 - 2012-07-08 07:35 - 00000000 ____D C:\Users\Patrick\AppData\Local\{64D5610A-8B24-4E87-A0C9-5EF1B355C842} 2012-07-08 07:34 - 2012-07-08 07:34 - 00000000 ____D C:\Users\Patrick\AppData\Local\{4478E0BF-3731-4B28-B964-EFDD224FC6A9} 2012-07-07 14:47 - 2012-07-07 14:47 - 00000000 ____D C:\Users\Patrick\AppData\Local\{BE7AFDA7-1684-43E0-954B-E1E807B44BCA} 2012-07-07 14:47 - 2012-07-07 14:47 - 00000000 ____D C:\Users\Patrick\AppData\Local\{14E30936-4868-4B06-8CF9-54C03D8EB650} 2012-07-06 19:44 - 2012-07-06 19:44 - 00893936 ____A (Oracle Corporation) C:\Users\Patrick\Downloads\chromeinstall-7u5.exe 2012-07-06 16:09 - 2012-07-22 15:07 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2012-07-06 16:05 - 2012-07-06 16:06 - 00000000 ____D C:\Users\Patrick\AppData\Local\{C37781DE-714C-4179-BFA8-B2CC70378D71} 2012-07-06 16:05 - 2012-07-06 16:05 - 00000000 ____D C:\Users\Patrick\AppData\Local\{6D0689A1-A829-4F53-839C-9775365EF412} 2012-07-06 12:54 - 2012-07-06 12:54 - 00000000 ____D C:\Users\Patrick\AppData\Local\{938D3DAE-09E6-4C55-9AB5-0003C501A52F} 2012-07-06 12:54 - 2012-07-06 12:54 - 00000000 ____D C:\Users\Patrick\AppData\Local\{2E3820BA-E625-467E-8A1C-117CD91174B8} 2012-07-05 16:34 - 2012-07-05 16:34 - 00000000 ____D C:\Users\Patrick\AppData\Local\{37D2520D-2A25-4A50-8492-BB8DE751256A} 2012-07-05 16:34 - 2012-07-05 16:34 - 00000000 ____D C:\Users\Patrick\AppData\Local\{3441BA36-36C2-4117-9E7C-1357D9882E26} 2012-07-05 14:32 - 2012-07-05 14:32 - 00000000 ____D C:\Users\Patrick\AppData\Local\{FDCA8EAA-0061-456A-AAD5-E8C253C1AC0B} 2012-07-05 14:32 - 2012-07-05 14:32 - 00000000 ____D C:\Users\Patrick\AppData\Local\{B972F97F-8A82-42E5-A24E-8993CA55F8F0} 2012-07-05 11:58 - 2012-07-05 11:58 - 00000000 ____D C:\Users\Patrick\AppData\Local\{9241D156-0379-46D1-A8B7-F8F6739E8630} 2012-07-05 11:57 - 2012-07-05 11:58 - 00000000 ____D C:\Users\Patrick\AppData\Local\{7A04AECD-7F52-4FFA-82D2-8A579457D0EC} 2012-07-04 15:29 - 2012-07-04 15:29 - 00000000 ____D C:\Users\Patrick\AppData\Local\{60607F63-6508-4423-8136-A7C88836C66C} 2012-07-04 15:29 - 2012-07-04 15:29 - 00000000 ____D C:\Users\Patrick\AppData\Local\{4FFFBF54-ED2F-4C68-9CDD-8321C0729060} 2012-07-03 14:42 - 2012-07-03 14:42 - 00000000 ____D C:\Users\Patrick\AppData\Local\{770CD80F-D25B-45E8-926A-A77892117046} 2012-07-03 14:41 - 2012-07-03 14:42 - 00000000 ____D C:\Users\Patrick\AppData\Local\{8763851A-CF20-457F-9E0B-738CD44A8090} 2012-07-02 15:36 - 2012-07-02 15:36 - 00000000 ____D C:\Users\Patrick\AppData\Local\{AF35CE74-B339-4CB5-85A7-7895E47A6F2B} 2012-07-02 15:35 - 2012-07-02 15:36 - 00000000 ____D C:\Users\Patrick\AppData\Local\{DA981DCD-7BAA-47A2-BB67-F55AAFBCC6BC} 2012-07-02 11:41 - 2012-07-02 11:41 - 00000000 ____D C:\Users\Patrick\AppData\Local\{DEBED675-4DC3-41FF-90DE-B71F63D636AA} 2012-07-02 11:41 - 2012-07-02 11:41 - 00000000 ____D C:\Users\Patrick\AppData\Local\{6EF22011-3A98-41A1-876C-76F9B20FBD64} 2012-07-02 11:20 - 2012-07-02 11:21 - 00000000 ____D C:\Users\Patrick\AppData\Local\{064D1814-1DC5-4966-8A84-432744B1D80F} 2012-07-02 11:20 - 2012-07-02 11:20 - 00000000 ____D C:\Users\Patrick\AppData\Local\{9A5409B6-867C-4E7D-94DD-20E16EC2BD8E} 2012-07-01 11:20 - 2012-07-01 11:20 - 00000000 ____D C:\Users\Patrick\AppData\Local\{D33D7A15-1027-4DF5-BAD2-13595F41CBCF} 2012-07-01 11:20 - 2012-07-01 11:20 - 00000000 ____D C:\Users\Patrick\AppData\Local\{5CB2CC3A-6564-4B16-88FC-2C532FB91563} 2012-06-30 20:52 - 2012-06-30 20:53 - 00000000 ____D C:\Users\Patrick\AppData\Local\{E490AB90-8D06-483A-81D9-4F86A7C1A22B} 2012-06-30 20:52 - 2012-06-30 20:52 - 00000000 ____D C:\Users\Patrick\AppData\Local\{7519F929-C332-4D62-A538-6916196D8236} 2012-06-30 17:10 - 2012-06-30 17:11 - 00000000 ____D C:\Users\Patrick\AppData\Local\{C7F7A059-D0D6-46D7-9497-850105A49501} 2012-06-30 17:10 - 2012-06-30 17:10 - 00000000 ____D C:\Users\Patrick\AppData\Local\{2790055B-CF0C-4D4E-B4EA-A4F6C8A578D0} 2012-06-30 00:41 - 2012-06-30 00:41 - 00000000 ____D C:\Users\Patrick\AppData\Local\{FAC85988-E4FF-4F62-98DC-2A5299454832} 2012-06-30 00:40 - 2012-06-30 00:41 - 00000000 ____D C:\Users\Patrick\AppData\Local\{29BECB78-8DD7-47D4-ACE1-B38D7FB78DE0} 2012-06-30 00:30 - 2012-06-30 00:30 - 00000000 ____D C:\Users\Patrick\AppData\Local\{1D2939C0-B286-44FA-B093-5E25681F8FAB} 2012-06-30 00:29 - 2012-06-30 00:30 - 00000000 ____D C:\Users\Patrick\AppData\Local\{0F582AAD-C748-45AF-B8F5-8C156D3CA722} 2012-06-29 14:35 - 2012-06-29 14:35 - 00000000 ____D C:\Users\Patrick\AppData\Local\{F77D8AAB-7B07-4121-9020-5840ABA60885} 2012-06-29 14:35 - 2012-06-29 14:35 - 00000000 ____D C:\Users\Patrick\AppData\Local\{08DB040D-09D4-4E6D-B6FB-B8505D57CC97} 2012-06-26 16:32 - 2012-06-26 16:32 - 00000000 ____D C:\Users\Patrick\AppData\Local\{9041B08F-A188-437C-B9D1-67F20ED73008} 2012-06-26 16:31 - 2012-06-26 16:32 - 00000000 ____D C:\Users\Patrick\AppData\Local\{168D3202-B300-41CA-B986-D69357CBEECA} 2012-06-26 14:28 - 2012-06-26 14:28 - 00000000 ____D C:\Users\Patrick\AppData\Local\{D27A1578-8B41-4DD8-A0E4-1E7BBDA479F8} 2012-06-26 14:27 - 2012-06-26 14:28 - 00000000 ____D C:\Users\Patrick\AppData\Local\{602C18A7-F480-40E5-8B06-43B734ED9CB9} 2012-06-26 13:40 - 2012-06-26 13:40 - 00000000 ____D C:\Users\Patrick\AppData\Local\{18AB0261-A29B-468F-94F9-E86E5A70CBF4} 2012-06-26 13:39 - 2012-06-26 13:40 - 00000000 ____D C:\Users\Patrick\AppData\Local\{4A00B971-4CC8-4835-BBCF-1F258BF57287} 2012-06-24 21:03 - 2012-06-24 21:03 - 00000000 ____D C:\Users\Patrick\AppData\Local\{E4A54573-A0F6-4D6C-95A4-5ECE97DB8E70} 2012-06-24 21:03 - 2012-06-24 21:03 - 00000000 ____D C:\Users\Patrick\AppData\Local\{81EA8777-7E8D-4673-B2FF-05F4EC9EF337} ============ 3 Months Modified Files ======================== 2012-07-24 15:00 - 2012-07-24 15:00 - 00008212 ____A C:\Windows\mfebcdata 2012-07-24 15:00 - 2010-02-05 21:33 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2012-07-24 14:59 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2012-07-24 14:59 - 2009-07-13 20:51 - 00110089 ____A C:\Windows\setupact.log 2012-07-24 14:56 - 2009-11-05 19:30 - 01250350 ____A C:\Windows\WindowsUpdate.log 2012-07-24 14:53 - 2009-07-13 21:13 - 00726444 ____A C:\Windows\System32\PerfStringBackup.INI 2012-07-24 14:50 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-07-24 14:50 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-07-24 14:48 - 2010-02-05 21:33 - 00000898 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2012-07-24 02:42 - 2010-02-17 17:35 - 00000916 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3794066387-2219636134-70439330-1000UA.job 2012-07-23 21:49 - 2012-07-23 21:49 - 00002227 ____A C:\Users\Patrick\Desktop\RKreport[1].txt 2012-07-23 21:48 - 2012-07-23 21:48 - 01552384 ____A C:\Users\Patrick\Desktop\RogueKiller.exe 2012-07-23 21:38 - 2009-08-21 18:31 - 01043866 ____A C:\Windows\PFRO.log 2012-07-22 19:41 - 2010-02-17 17:35 - 00000864 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3794066387-2219636134-70439330-1000Core.job 2012-07-22 15:07 - 2012-07-06 16:09 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2012-07-22 15:07 - 2011-06-18 12:26 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2012-07-22 13:37 - 2012-07-22 13:37 - 00031962 ____A C:\Users\Patrick\Desktop\DDS.txt 2012-07-22 13:36 - 2012-07-22 13:36 - 00015194 ____A C:\Users\Patrick\Desktop\Attach.txt 2012-07-22 13:33 - 2012-07-22 13:33 - 00607260 ____R (Swearware) C:\Users\Patrick\Desktop\dds.com 2012-07-21 10:57 - 2012-07-10 22:23 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-07-15 01:28 - 2009-12-25 20:41 - 00000342 ____A C:\Windows\Tasks\McDefragTask.job 2012-07-11 15:40 - 2010-02-17 17:43 - 00002373 ____A C:\Users\Patrick\Desktop\Google Chrome.lnk 2012-07-11 13:47 - 2009-07-13 18:34 - 00000215 ____A C:\Windows\system.ini 2012-07-11 10:55 - 2012-07-11 10:55 - 00125488 ____A C:\Users\Patrick\Downloads\OTL.Txt 2012-07-11 00:59 - 2009-07-13 20:45 - 00343552 ____A C:\Windows\System32\FNTCACHE.DAT 2012-07-11 00:47 - 2012-07-11 00:47 - 00060284 ____A C:\Users\Patrick\Downloads\Extras.Txt 2012-07-11 00:04 - 2011-04-16 12:56 - 59701280 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-07-09 17:09 - 2009-08-21 18:24 - 00009737 ____A C:\Windows\System32\Config.MPF 2012-07-06 19:44 - 2012-07-06 19:44 - 00893936 ____A (Oracle Corporation) C:\Users\Patrick\Downloads\chromeinstall-7u5.exe 2012-07-03 10:46 - 2012-07-10 22:16 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-07-02 15:34 - 2009-07-13 21:08 - 00032646 ____A C:\Windows\Tasks\SCHEDLGU.TXT 2012-06-30 22:00 - 2009-12-25 20:41 - 00000320 ____A C:\Windows\Tasks\McQcTask.job 2012-06-14 14:30 - 2012-06-14 14:30 - 00002626 ____A C:\fmle_session_20120614_173016.log 2012-06-11 19:02 - 2012-07-11 00:11 - 03147264 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-06-08 21:30 - 2012-07-10 16:37 - 14165504 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-06-08 20:46 - 2012-07-10 16:37 - 12868608 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2012-06-05 21:50 - 2012-07-10 16:37 - 02003968 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll 2012-06-05 21:50 - 2012-07-10 16:37 - 01880064 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll 2012-06-05 21:09 - 2012-07-10 16:37 - 01389568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2012-06-05 21:09 - 2012-07-10 16:37 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2012-06-02 14:19 - 2012-06-23 17:07 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll 2012-06-02 14:19 - 2012-06-23 17:07 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll 2012-06-02 14:19 - 2012-06-23 17:07 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe 2012-06-02 14:19 - 2012-06-23 17:07 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll 2012-06-02 14:19 - 2012-06-23 17:07 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll 2012-06-02 14:15 - 2012-06-23 17:07 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll 2012-06-02 14:15 - 2012-06-23 17:07 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll 2012-06-02 12:19 - 2012-06-23 17:06 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll 2012-06-02 12:15 - 2012-06-23 17:06 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe 2012-06-02 04:49 - 2012-07-11 00:02 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-06-02 04:17 - 2012-07-11 00:02 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-06-02 04:12 - 2012-07-11 00:02 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-06-02 04:05 - 2012-07-11 00:02 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-06-02 04:05 - 2012-07-11 00:02 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-06-02 04:04 - 2012-07-11 00:02 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-06-02 04:04 - 2012-07-11 00:02 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-06-02 04:03 - 2012-07-11 00:02 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-06-02 04:01 - 2012-07-11 00:02 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-06-02 04:00 - 2012-07-11 00:02 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-06-02 03:59 - 2012-07-11 00:02 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-06-02 03:57 - 2012-07-11 00:02 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-06-02 03:57 - 2012-07-11 00:02 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-06-02 03:54 - 2012-07-11 00:02 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-06-02 01:07 - 2012-07-11 00:02 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-06-02 00:43 - 2012-07-11 00:02 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-06-02 00:33 - 2012-07-11 00:02 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2012-06-02 00:26 - 2012-07-11 00:02 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-06-02 00:25 - 2012-07-11 00:02 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2012-06-02 00:25 - 2012-07-11 00:02 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-06-02 00:23 - 2012-07-11 00:02 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-06-02 00:21 - 2012-07-11 00:02 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-06-02 00:20 - 2012-07-11 00:02 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2012-06-02 00:19 - 2012-07-11 00:02 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-06-02 00:19 - 2012-07-11 00:02 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2012-06-02 00:17 - 2012-07-11 00:02 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-06-02 00:16 - 2012-07-11 00:02 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-06-02 00:14 - 2012-07-11 00:02 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-06-01 21:38 - 2012-07-10 16:37 - 00152432 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys 2012-06-01 21:38 - 2012-07-10 16:37 - 00095088 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys 2012-06-01 21:37 - 2012-07-10 16:37 - 00459216 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys 2012-06-01 21:27 - 2012-07-10 16:37 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll 2012-06-01 21:27 - 2012-07-10 16:37 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll 2012-06-01 20:48 - 2012-07-10 16:37 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2012-06-01 20:48 - 2012-07-10 16:37 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2012-06-01 20:47 - 2012-07-10 16:37 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2012-06-01 20:42 - 2012-07-10 16:37 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2012-05-04 02:52 - 2012-06-13 20:14 - 05505392 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-05-04 02:08 - 2012-06-13 20:14 - 03958128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2012-05-04 02:08 - 2012-06-13 20:14 - 03902320 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2012-05-01 21:32 - 2012-06-13 20:14 - 00208896 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll 2012-04-27 19:50 - 2012-06-13 20:13 - 00204800 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys ZeroAccess: C:\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118} C:\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\L C:\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U ZeroAccess: C:\Users\Patrick\AppData\Local\{52a689ea-4d72-da20-a8af-379893955118} C:\Users\Patrick\AppData\Local\{52a689ea-4d72-da20-a8af-379893955118}\L C:\Users\Patrick\AppData\Local\{52a689ea-4d72-da20-a8af-379893955118}\U ZeroAccess: C:\Windows\assembly\GAC_32\Desktop.ini ZeroAccess: C:\Windows\assembly\GAC_64\Desktop.ini ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ========================= Memory info ====================== Percentage of memory in use: 19% Total physical RAM: 2812.05 MB Available physical RAM: 2269.05 MB Total Pagefile: 2810.2 MB Available Pagefile: 2267.82 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ======================= Partitions ========================= 1 Drive c: (Acer) (Fixed) (Total:136.95 GB) (Free:45.43 GB) NTFS 2 Drive e: (PQSERVICE) (Fixed) (Total:12 GB) (Free:2.36 GB) NTFS 4 Drive g: (YOUNG JEEZY) (Removable) (Total:0.12 GB) (Free:0.03 GB) FAT32 5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS 6 Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)] Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- Disk 0 Online 149 GB 0 B Disk 1 Online 127 MB 0 B Partitions of Disk 0: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Recovery 12 GB 31 KB Partition 2 Primary 101 MB 12 GB Partition 3 Primary 136 GB 12 GB ================================================================================== Disk: 0 Partition 1 Type : 27 Hidden: Yes Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 3 E PQSERVICE NTFS Partition 12 GB Healthy Hidden ================================================================================== Disk: 0 Partition 2 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 1 Y SYSTEM RESE NTFS Partition 101 MB Healthy ================================================================================== Disk: 0 Partition 3 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 2 C Acer NTFS Partition 136 GB Healthy ================================================================================== Partitions of Disk 1: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 124 MB 16 KB ================================================================================== Disk: 1 Partition 1 Type : 0B Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 4 G YOUNG JEEZY FAT32 Removable 124 MB Healthy ================================================================================== ========================================================== Last Boot: 2012-07-18 15:21 ======================= End Of Log ========================== Search Farbar Recovery Scan Tool Version: 24-07-2012 02 Ran by SYSTEM at 2012-07-24 19:22:30 Running from G:\ ================== Search: "services.exe" =================== C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe [2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB C:\Windows\System32\services.exe [2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB C:\Windows\erdnt\cache64\services.exe [2012-07-11 13:48] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB ====== End Of Search ======
  7. RogueKiller V7.6.4 [07/17/2012] by Tigzy mail: tigzyRK<at>gmail<dot>com Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/ Blog: http://tigzyrk.blogspot.com Operating System: Windows 7 (6.1.7600 ) 64 bits version Started in : Normal mode User: Patrick [Admin rights] Mode: Scan -- Date: 07/24/2012 00:49:23 ¤¤¤ Bad processes: 0 ¤¤¤ ¤¤¤ Registry Entries: 6 ¤¤¤ [sUSP PATH] HKLM\[...]\Policies\Explorer\Run : 58762 (C:\PROGRA~3\LOCALS~1\Temp\msvara.cmd) -> FOUND [sUSP PATH] HKLM\[...]\Wow6432Node\Policies\Explorer\Run : 58762 (C:\PROGRA~3\LOCALS~1\Temp\msvara.cmd) -> FOUND [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND [HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND [HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][FOLDER] U : c:\windows\installer\{52a689ea-4d72-da20-a8af-379893955118}\U --> FOUND [ZeroAccess][FOLDER] L : c:\windows\installer\{52a689ea-4d72-da20-a8af-379893955118}\L --> FOUND [ZeroAccess][FOLDER] U : c:\users\patrick\appdata\local\{52a689ea-4d72-da20-a8af-379893955118}\U --> FOUND [ZeroAccess][FOLDER] L : c:\users\patrick\appdata\local\{52a689ea-4d72-da20-a8af-379893955118}\L --> FOUND [ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_32\desktop.ini --> FOUND [ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_64\desktop.ini --> FOUND ¤¤¤ Driver: [NOT LOADED] ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ 127.0.0.1 localhost ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: WDC WD1600BEVT-22ZCT0 ATA Device +++++ --- User --- [MBR] 00099596daa631e57b9faf7336c07936 [bSP] 0b1806f1e01ff6695d1ad5673dee99e7 : Windows 7 MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 63 | Size: 12291 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 25173855 | Size: 101 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 25382700 | Size: 140232 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[1].txt >> RKreport[1].txt
  8. I ran a scan with malwarebytes and trojan.agent came up and i tried to remove it but it would go. Please help me. Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.07.21.09 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 Patrick :: MYPCYADIG [administrator] 7/22/2012 4:15:59 PM mbam-log-2012-07-22 (16-30-22).txt Scan type: Quick scan Scan options enabled: Memory | Startup | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: Registry | P2P Objects scanned: 186088 Time elapsed: 5 minute(s), 12 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|58762 (Trojan.Agent) -> Data: C:\PROGRA~3\LOCALS~1\Temp\msvara.cmd -> No action taken. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29 Run by Patrick at 16:33:22 on 2012-07-22 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2812.1870 [GMT -5:00] . AV: McAfee VirusScan *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: McAfee VirusScan *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} FW: McAfee Personal Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files (x86)\DVBLogic\DVBLink\DVBLinkSrv.exe C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files (x86)\Acer\Registration\GregHSRW.exe C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files (x86)\Launch Manager\LManager.exe C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe C:\Program Files (x86)\McAfee\MSK\MskSrver.exe C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Acer\Acer Updater\UpdaterService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\Air Mouse\Air Mouse\Mobile Mouse Service.exe C:\Windows\system32\wbem\unsecapp.exe C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe c:\PROGRA~2\mcafee\SITEAD~1\saui.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = mStart Page = uInternet Settings,ProxyOverride = *.local uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\PROGRA~2\mcafee\VIRUSS~1\scriptsn.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files (x86)\Megaupload\Mega Manager\MegaIEMn.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun uRun: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet uRun: [Google Update] "C:\Users\Patrick\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_257_ActiveX.exe -update activex mRun: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" mRun: [PlayMovie] "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" mRun: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe mRun: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mExplorerRun: [58762] C:\PROGRA~3\LOCALS~1\Temp\msvara.cmd StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\AIRMOU~1.LNK - C:\Program Files (x86)\Air Mouse\Air Mouse\Air Mouse.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D1E1F7ED622A0E5D.dll/cmsidewiki.html IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL DPF: Justin.tv Publisher - hxxp://www.justin.tv/plugins/justintv_publisher.CAB DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA} : DhcpNameServer = 192.168.1.254 TCP: Interfaces\{E09C7C2B-CFE1-4378-9FD8-962A5F1250FE} : DhcpNameServer = 192.168.1.254 TCP: Interfaces\{E09C7C2B-CFE1-4378-9FD8-962A5F1250FE}\14E64627F69646140573037353 : DhcpNameServer = 192.168.43.1 TCP: Interfaces\{E09C7C2B-CFE1-4378-9FD8-962A5F1250FE}\3686F696365613 : DhcpNameServer = 172.20.101.1 Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO-X64: 0x1 - No File BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~2\mcafee\VIRUSS~1\scriptsn.dll BHO-X64: scriptproxy - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll BHO-X64: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files (x86)\Megaupload\Mega Manager\MegaIEMn.dll BHO-X64: MegaIEMn - No File BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File mRun-x64: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun-x64: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED mRun-x64: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun-x64: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" mRun-x64: [PlayMovie] "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" mRun-x64: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe mRun-x64: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey mRun-x64: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\yppm9cke.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.mydtzone.com/startpage|https://mail.google.com/mail/?shva=1#|https://www.google.com/calendar/render?tab=mc&gsessionid=KyyaFjT6OOlMUBo7bbM01A|https://docs.google.com/?tab=mo&pli=1#all FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\McAfee\SiteAdvisor\NPMcFFPlg32.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\Patrick\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Users\Patrick\AppData\Roaming\Mozilla\plugins\npoctoshape.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ---- FIREFOX POLICIES ---- FF - user.js: yahoo.ytff.general.dontshowhpoffer - true . ============= SERVICES / DRIVERS =============== . R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?] R1 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?] R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?] R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?] R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?] R2 DVBLink Server;DVBLink Server;C:\Program Files (x86)\DVBLogic\DVBLink\DVBLinkSrv.exe [2009-7-1 135168] R2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2009-8-21 844320] R2 Greg_Service;GRegService;C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [2009-6-4 1150496] R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\Windows\system32\drivers\LMIRfsDriver.sys --> C:\Windows\system32\drivers\LMIRfsDriver.sys [?] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe [2012-2-27 103440] R2 McProxy;McAfee Proxy Service;C:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe [2009-12-25 359952] R2 McShield;McAfee Real-time Scanner;C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2009-12-25 155456] R2 MWLService;MyWinLocker Service;C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe [2009-8-6 311592] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-6-17 144640] R2 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2009-8-21 240160] R3 dvblinkcap;DVBLink Capture #1;C:\Windows\system32\DRIVERS\dvblinkcap.sys --> C:\Windows\system32\DRIVERS\dvblinkcap.sys [?] R3 dvblinkcap2;DVBLink Capture #2;C:\Windows\system32\DRIVERS\dvblinkcap2.sys --> C:\Windows\system32\DRIVERS\dvblinkcap2.sys [?] R3 dvblinkcap3;DVBLink Capture #3;C:\Windows\system32\DRIVERS\dvblinkcap3.sys --> C:\Windows\system32\DRIVERS\dvblinkcap3.sys [?] R3 dvblinkcap4;DVBLink Capture #4;C:\Windows\system32\DRIVERS\dvblinkcap4.sys --> C:\Windows\system32\DRIVERS\dvblinkcap4.sys [?] R3 dvblinktun;DVBLink Tuner #1;C:\Windows\system32\DRIVERS\dvblinktun.sys --> C:\Windows\system32\DRIVERS\dvblinktun.sys [?] R3 dvblinktun2;DVBLink Tuner #2;C:\Windows\system32\DRIVERS\dvblinktun2.sys --> C:\Windows\system32\DRIVERS\dvblinktun2.sys [?] R3 dvblinktun3;DVBLink Tuner #3;C:\Windows\system32\DRIVERS\dvblinktun3.sys --> C:\Windows\system32\DRIVERS\dvblinktun3.sys [?] R3 dvblinktun4;DVBLink Tuner #4;C:\Windows\system32\DRIVERS\dvblinktun4.sys --> C:\Windows\system32\DRIVERS\dvblinktun4.sys [?] R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?] R3 McSysmon;McAfee SystemGuards;C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe [2009-12-25 606736] R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?] R3 mfesmfk;McAfee Inc. mfesmfk;C:\Windows\system32\drivers\mfesmfk.sys --> C:\Windows\system32\drivers\mfesmfk.sys [?] R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-6 135664] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-6 135664] S3 hcwhdpvr;Hauppauge HD PVR Capture Device;C:\Windows\system32\DRIVERS\hcwhdpvr.sys --> C:\Windows\system32\DRIVERS\hcwhdpvr.sys [?] S3 jumi;%Jumi%;C:\Windows\system32\DRIVERS\jumi.sys --> C:\Windows\system32\DRIVERS\jumi.sys [?] S3 lvpepf64;Volume Adapter;C:\Windows\system32\DRIVERS\lv302a64.sys --> C:\Windows\system32\DRIVERS\lv302a64.sys [?] S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\system32\DRIVERS\lvrs64.sys --> C:\Windows\system32\DRIVERS\lvrs64.sys [?] S3 LVUSBS64;Logitech USB Monitor Filter;C:\Windows\system32\drivers\LVUSBS64.sys --> C:\Windows\system32\drivers\LVUSBS64.sys [?] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232] S3 mferkdk;McAfee Inc. mferkdk;C:\Windows\system32\drivers\mferkdk.sys --> C:\Windows\system32\drivers\mferkdk.sys [?] S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service --> C:\Windows\system32\GameMon.des -service [?] S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-6-17 50432] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?] . =============== Created Last 30 ================ . 2012-07-13 23:42:44 -------- d-----w- C:\Users\Patrick\AppData\Local\{C9012D75-005A-4D65-BD54-88428683E238} 2012-07-13 23:42:32 -------- d-----w- C:\Users\Patrick\AppData\Local\{1A99A097-D428-45A6-9910-2A06800D8C42} 2012-07-13 23:41:39 -------- d-----w- C:\Users\Patrick\AppData\Local\{5D483348-1AD9-4410-A203-4ABBD327E982} 2012-07-13 23:41:26 -------- d-----w- C:\Users\Patrick\AppData\Local\{6C4ADD03-F059-4E93-A77C-0163A05E5156} 2012-07-11 21:52:49 -------- d-sh--w- C:\$RECYCLE.BIN 2012-07-11 20:57:48 -------- d-----w- C:\Users\Patrick\AppData\Local\{A0C152D8-9AEF-4D65-B857-EA04B5D088C6} 2012-07-11 20:57:34 -------- d-----w- C:\Users\Patrick\AppData\Local\{8946BABA-EEB5-4743-A051-7C5A6036850F} 2012-07-11 18:19:34 -------- d-----w- C:\Users\Patrick\AppData\Local\{C0F4C81C-4B43-4D02-9FC8-EEBF8B45A1D3} 2012-07-11 18:19:20 -------- d-----w- C:\Users\Patrick\AppData\Local\{789956D4-0C83-42DF-A079-D55706C97942} 2012-07-11 10:44:40 -------- d-----w- C:\Users\Patrick\AppData\Local\{9037F0A1-59F3-41C6-9153-479AD39E8A01} 2012-07-11 10:44:21 -------- d-----w- C:\Users\Patrick\AppData\Local\{D79EF15C-DE3D-4C42-ADFB-CCFEFDD6E16D} 2012-07-11 09:16:40 -------- d-----w- C:\Users\Patrick\AppData\Local\{AB5A1DD3-7585-4A53-8C6C-554EADD1A579} 2012-07-11 09:16:27 -------- d-----w- C:\Users\Patrick\AppData\Local\{CF68DEBC-8226-4E1E-9B54-E5D6726FEB64} 2012-07-11 09:02:09 -------- d-----w- C:\Users\Patrick\AppData\Local\{73F04097-B915-4DFF-ACE3-0A83D51AB16A} 2012-07-11 09:01:51 -------- d-----w- C:\Users\Patrick\AppData\Local\{EBB2A6AC-AC18-48FB-9CBE-41EB5D812DDB} 2012-07-11 08:28:43 -------- d-----w- C:\TDSSKiller_Quarantine 2012-07-11 08:11:13 3147264 ----a-w- C:\Windows\System32\win32k.sys 2012-07-11 07:30:42 -------- d-----w- C:\Users\Patrick\AppData\Local\{580AA3BC-8939-44E5-A927-CA81E6D2F66C} 2012-07-11 07:30:23 -------- d-----w- C:\Users\Patrick\AppData\Local\{EEE30319-6879-4322-9711-122E1328624C} 2012-07-11 07:17:27 -------- d-----w- C:\Users\Patrick\AppData\Local\{9CA68046-8753-4102-840B-37157B95C4B3} 2012-07-11 07:17:10 -------- d-----w- C:\Users\Patrick\AppData\Local\{C4889019-5237-4FB8-ABC5-AC2F21390A1D} 2012-07-11 06:16:52 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys 2012-07-11 06:16:49 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys 2012-07-11 00:49:35 -------- d-----w- C:\Users\Patrick\AppData\Local\{01013834-02E5-4392-A743-464BDDBD6EF6} 2012-07-11 00:49:21 -------- d-----w- C:\Users\Patrick\AppData\Local\{0C363A0D-6181-4E36-A36C-42BD1D466D7F} 2012-07-11 00:27:36 -------- d-----w- C:\Users\Patrick\AppData\Local\{B2159F49-5536-466B-B908-2B1DF9C1162E} 2012-07-11 00:27:24 -------- d-----w- C:\Users\Patrick\AppData\Local\{A46910BB-C141-44C2-B4BB-03214CF399A3} 2012-07-10 22:15:55 -------- d-----w- C:\Users\Patrick\AppData\Local\{E3B5E006-EEBC-4D5E-A7FE-F1ECB839017A} 2012-07-10 22:15:33 -------- d-----w- C:\Users\Patrick\AppData\Local\{C439CCF2-CE02-461E-B6E3-255C0AFCD429} 2012-07-09 22:45:54 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA% 2012-07-09 21:06:31 -------- d-----w- C:\Users\Patrick\AppData\Local\{10E73D9D-2C59-4263-95F0-FC6EDAD6A106} 2012-07-09 21:06:16 -------- d-----w- C:\Users\Patrick\AppData\Local\{5BE8095B-6571-46A0-B25E-3CBCC0CF7926} 2012-07-08 15:35:01 -------- d-----w- C:\Users\Patrick\AppData\Local\{64D5610A-8B24-4E87-A0C9-5EF1B355C842} 2012-07-08 15:34:29 -------- d-----w- C:\Users\Patrick\AppData\Local\{4478E0BF-3731-4B28-B964-EFDD224FC6A9} 2012-07-07 22:47:42 -------- d-----w- C:\Users\Patrick\AppData\Local\{14E30936-4868-4B06-8CF9-54C03D8EB650} 2012-07-07 22:47:24 -------- d-----w- C:\Users\Patrick\AppData\Local\{BE7AFDA7-1684-43E0-954B-E1E807B44BCA} 2012-07-07 00:09:59 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-07-07 00:05:45 -------- d-----w- C:\Users\Patrick\AppData\Local\{C37781DE-714C-4179-BFA8-B2CC70378D71} 2012-07-07 00:05:30 -------- d-----w- C:\Users\Patrick\AppData\Local\{6D0689A1-A829-4F53-839C-9775365EF412} 2012-07-06 20:54:41 -------- d-----w- C:\Users\Patrick\AppData\Local\{938D3DAE-09E6-4C55-9AB5-0003C501A52F} 2012-07-06 20:54:25 -------- d-----w- C:\Users\Patrick\AppData\Local\{2E3820BA-E625-467E-8A1C-117CD91174B8} 2012-07-06 00:34:17 -------- d-----w- C:\Users\Patrick\AppData\Local\{37D2520D-2A25-4A50-8492-BB8DE751256A} 2012-07-06 00:34:02 -------- d-----w- C:\Users\Patrick\AppData\Local\{3441BA36-36C2-4117-9E7C-1357D9882E26} 2012-07-05 22:32:38 -------- d-----w- C:\Users\Patrick\AppData\Local\{FDCA8EAA-0061-456A-AAD5-E8C253C1AC0B} 2012-07-05 22:32:25 -------- d-----w- C:\Users\Patrick\AppData\Local\{B972F97F-8A82-42E5-A24E-8993CA55F8F0} 2012-07-05 19:58:16 -------- d-----w- C:\Users\Patrick\AppData\Local\{9241D156-0379-46D1-A8B7-F8F6739E8630} 2012-07-05 19:57:39 -------- d-----w- C:\Users\Patrick\AppData\Local\{7A04AECD-7F52-4FFA-82D2-8A579457D0EC} 2012-07-04 23:29:46 -------- d-----w- C:\Users\Patrick\AppData\Local\{60607F63-6508-4423-8136-A7C88836C66C} 2012-07-04 23:29:32 -------- d-----w- C:\Users\Patrick\AppData\Local\{4FFFBF54-ED2F-4C68-9CDD-8321C0729060} 2012-07-03 22:42:03 -------- d-----w- C:\Users\Patrick\AppData\Local\{770CD80F-D25B-45E8-926A-A77892117046} 2012-07-03 22:41:49 -------- d-----w- C:\Users\Patrick\AppData\Local\{8763851A-CF20-457F-9E0B-738CD44A8090} 2012-07-02 23:36:06 -------- d-----w- C:\Users\Patrick\AppData\Local\{AF35CE74-B339-4CB5-85A7-7895E47A6F2B} 2012-07-02 23:35:48 -------- d-----w- C:\Users\Patrick\AppData\Local\{DA981DCD-7BAA-47A2-BB67-F55AAFBCC6BC} 2012-07-02 19:41:32 -------- d-----w- C:\Users\Patrick\AppData\Local\{6EF22011-3A98-41A1-876C-76F9B20FBD64} 2012-07-02 19:41:12 -------- d-----w- C:\Users\Patrick\AppData\Local\{DEBED675-4DC3-41FF-90DE-B71F63D636AA} 2012-07-02 19:20:57 -------- d-----w- C:\Users\Patrick\AppData\Local\{064D1814-1DC5-4966-8A84-432744B1D80F} 2012-07-02 19:20:24 -------- d-----w- C:\Users\Patrick\AppData\Local\{9A5409B6-867C-4E7D-94DD-20E16EC2BD8E} 2012-07-01 19:20:13 -------- d-----w- C:\Users\Patrick\AppData\Local\{5CB2CC3A-6564-4B16-88FC-2C532FB91563} 2012-07-01 19:20:00 -------- d-----w- C:\Users\Patrick\AppData\Local\{D33D7A15-1027-4DF5-BAD2-13595F41CBCF} 2012-07-01 04:52:50 -------- d-----w- C:\Users\Patrick\AppData\Local\{E490AB90-8D06-483A-81D9-4F86A7C1A22B} 2012-07-01 04:52:35 -------- d-----w- C:\Users\Patrick\AppData\Local\{7519F929-C332-4D62-A538-6916196D8236} 2012-07-01 01:10:49 -------- d-----w- C:\Users\Patrick\AppData\Local\{C7F7A059-D0D6-46D7-9497-850105A49501} 2012-07-01 01:10:36 -------- d-----w- C:\Users\Patrick\AppData\Local\{2790055B-CF0C-4D4E-B4EA-A4F6C8A578D0} 2012-06-30 08:41:14 -------- d-----w- C:\Users\Patrick\AppData\Local\{FAC85988-E4FF-4F62-98DC-2A5299454832} 2012-06-30 08:40:59 -------- d-----w- C:\Users\Patrick\AppData\Local\{29BECB78-8DD7-47D4-ACE1-B38D7FB78DE0} 2012-06-30 08:30:24 -------- d-----w- C:\Users\Patrick\AppData\Local\{1D2939C0-B286-44FA-B093-5E25681F8FAB} 2012-06-30 08:29:52 -------- d-----w- C:\Users\Patrick\AppData\Local\{0F582AAD-C748-45AF-B8F5-8C156D3CA722} 2012-06-29 22:35:48 -------- d-----w- C:\Users\Patrick\AppData\Local\{08DB040D-09D4-4E6D-B6FB-B8505D57CC97} 2012-06-29 22:35:28 -------- d-----w- C:\Users\Patrick\AppData\Local\{F77D8AAB-7B07-4121-9020-5840ABA60885} 2012-06-27 00:32:13 -------- d-----w- C:\Users\Patrick\AppData\Local\{9041B08F-A188-437C-B9D1-67F20ED73008} 2012-06-27 00:31:57 -------- d-----w- C:\Users\Patrick\AppData\Local\{168D3202-B300-41CA-B986-D69357CBEECA} 2012-06-26 22:28:11 -------- d-----w- C:\Users\Patrick\AppData\Local\{D27A1578-8B41-4DD8-A0E4-1E7BBDA479F8} 2012-06-26 22:27:56 -------- d-----w- C:\Users\Patrick\AppData\Local\{602C18A7-F480-40E5-8B06-43B734ED9CB9} 2012-06-26 21:40:12 -------- d-----w- C:\Users\Patrick\AppData\Local\{18AB0261-A29B-468F-94F9-E86E5A70CBF4} 2012-06-26 21:39:47 -------- d-----w- C:\Users\Patrick\AppData\Local\{4A00B971-4CC8-4835-BBCF-1F258BF57287} 2012-06-25 05:03:17 -------- d-----w- C:\Users\Patrick\AppData\Local\{81EA8777-7E8D-4673-B2FF-05F4EC9EF337} 2012-06-25 05:03:00 -------- d-----w- C:\Users\Patrick\AppData\Local\{E4A54573-A0F6-4D6C-95A4-5ECE97DB8E70} 2012-06-24 05:14:46 -------- d-----w- C:\Users\Patrick\AppData\Local\{4B13F648-39FB-4AC7-BE9F-513F5F8997D0} 2012-06-24 05:14:33 -------- d-----w- C:\Users\Patrick\AppData\Local\{5F5CBD1F-A142-4B2A-B395-FB66BBDCA2FA} 2012-06-24 03:14:16 -------- d-----w- C:\Users\Patrick\AppData\Local\{BA60B74D-DECF-4EFD-8CE1-315E8F28B505} 2012-06-24 03:14:00 -------- d-----w- C:\Users\Patrick\AppData\Local\{CB00734F-2A1A-4834-A967-228FD44D8BDD} 2012-06-24 01:07:25 2622464 ----a-w- C:\Windows\System32\wucltux.dll 2012-06-24 01:07:03 99840 ----a-w- C:\Windows\System32\wudriver.dll 2012-06-24 01:06:43 36864 ----a-w- C:\Windows\System32\wuapp.exe 2012-06-24 01:06:43 186752 ----a-w- C:\Windows\System32\wuwebv.dll 2012-06-24 00:44:09 -------- d-----w- C:\Users\Patrick\AppData\Local\{759D575A-1C09-4F2A-8654-7847A314B1B7} 2012-06-24 00:43:50 -------- d-----w- C:\Users\Patrick\AppData\Local\{8065C7BD-0C5A-4167-889C-EEFE3E686647} 2012-06-23 06:30:38 -------- d-----w- C:\Users\Patrick\AppData\Local\{96AC50F4-7D01-4415-A7C5-A937E8469714} 2012-06-23 06:30:26 -------- d-----w- C:\Users\Patrick\AppData\Local\{27B07E0B-076B-487C-8DBF-531E7D0879E6} 2012-06-23 05:06:10 -------- d-----w- C:\Users\Patrick\AppData\Local\{3B13F67D-695B-4254-9894-DBCDAA75E23E} 2012-06-23 05:05:53 -------- d-----w- C:\Users\Patrick\AppData\Local\{45137A30-3A46-4589-9901-344728756DD4} . ==================== Find3M ==================== . 2012-07-07 00:09:59 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-06-06 05:50:50 2003968 ----a-w- C:\Windows\System32\msxml6.dll 2012-06-06 05:50:50 1880064 ----a-w- C:\Windows\System32\msxml3.dll 2012-06-06 05:09:46 1389568 ----a-w- C:\Windows\SysWow64\msxml6.dll 2012-06-06 05:09:46 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll 2012-06-02 12:12:17 2311680 ----a-w- C:\Windows\System32\jscript9.dll 2012-06-02 12:05:28 1392128 ----a-w- C:\Windows\System32\wininet.dll 2012-06-02 12:04:50 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl 2012-06-02 12:01:40 173056 ----a-w- C:\Windows\System32\ieUnatt.exe 2012-06-02 11:57:08 2382848 ----a-w- C:\Windows\System32\mshtml.tlb 2012-06-02 08:33:25 1800192 ----a-w- C:\Windows\SysWow64\jscript9.dll 2012-06-02 08:25:08 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll 2012-06-02 08:25:03 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-06-02 08:20:33 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-06-02 08:16:52 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2012-06-02 05:38:26 95088 ----a-w- C:\Windows\System32\drivers\ksecdd.sys 2012-06-02 05:38:24 152432 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys 2012-06-02 05:37:45 459216 ----a-w- C:\Windows\System32\drivers\cng.sys 2012-06-02 05:27:02 340992 ----a-w- C:\Windows\System32\schannel.dll 2012-06-02 05:27:00 307200 ----a-w- C:\Windows\System32\ncrypt.dll 2012-06-02 04:48:39 22016 ----a-w- C:\Windows\SysWow64\secur32.dll 2012-06-02 04:48:35 225280 ----a-w- C:\Windows\SysWow64\schannel.dll 2012-06-02 04:47:31 219136 ----a-w- C:\Windows\SysWow64\ncrypt.dll 2012-06-02 04:42:51 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll 2012-05-04 10:52:22 5505392 ----a-w- C:\Windows\System32\ntoskrnl.exe 2012-05-04 10:08:16 3958128 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:08:15 3902320 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-05-02 05:32:43 208896 ----a-w- C:\Windows\System32\profsvc.dll 2012-04-28 03:50:40 204800 ----a-w- C:\Windows\System32\drivers\rdpwd.sys 2012-04-26 05:34:38 76288 ----a-w- C:\Windows\System32\rdpwsx.dll 2012-04-26 05:34:37 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll 2012-04-26 05:28:32 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe 2012-04-24 05:59:45 182272 ----a-w- C:\Windows\System32\cryptsvc.dll 2012-04-24 05:59:45 1460224 ----a-w- C:\Windows\System32\crypt32.dll 2012-04-24 05:59:45 140288 ----a-w- C:\Windows\System32\cryptnet.dll 2012-04-24 04:47:04 139264 ----a-w- C:\Windows\SysWow64\cryptsvc.dll 2012-04-24 04:47:04 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll 2012-04-24 04:47:03 1156608 ----a-w- C:\Windows\SysWow64\crypt32.dll . ============= FINISH: 16:35:58.66 =============== Attach DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 12/25/2009 10:40:57 PM System Uptime: 7/22/2012 4:13:49 PM (0 hours ago) . Motherboard: Acer | | Aspire 5532 Processor: AMD Athlon Processor TF-20 | Socket S1G1 | 1600/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 137 GiB total, 45.74 GiB free. D: is CDROM () E: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1} Description: LogMeIn Kernel Information Provider Device ID: ROOT\LEGACY_LMIINFO\0000 Manufacturer: Name: LogMeIn Kernel Information Provider PNP Device ID: ROOT\LEGACY_LMIINFO\0000 Service: LMIInfo . ==== System Restore Points =================== . RP227: 7/11/2012 3:54:19 PM - OTL Restore Point - 7/11/2012 3:54:19 PM RP228: 7/20/2012 5:19:31 PM - Scheduled Checkpoint . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) AC3Filter (remove only) Acer Arcade Deluxe Acer Assist Acer ePower Management Acer eRecovery Management Acer Games Acer GridVista Acer Registration Acer ScreenSaver Acer Updater Acrobat.com Adobe AIR Adobe Flash Media Live Encoder 3.1 Adobe Flash Player 10 Plugin Adobe Flash Player 11 ActiveX Adobe Reader 9.1 MUI Adobe Shockwave Player 11.6 AMD USB Filter Driver Apple Application Support Apple Software Update ArcSoft TotalMedia Extreme Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver AudibleManager AviSynth 2.5 CadStd Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish Compatibility Pack for the 2007 Office system D3DX10 DAEMON Tools Lite DivX Web Player DVBLink for HDPVR DVBLink Server eBay Worldwide eSobi v2 Google Chrome Google Update Helper Hauppauge WinTV IR Blaster Hauppauge WinTV Scheduler Identity Card Java 6 Update 29 Java SE Development Kit 6 Update 21 Junk Mail filter update Launch Manager Malwarebytes Anti-Malware version 1.62.0.1300 McAfee Security Scan Plus McAfee SecurityCenter Mega Manager Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Excel MUI (English) 2007 Microsoft Office Home and Student 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Suite Activation Assistant Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Works Mobile Mouse Server Mozilla Firefox 4.0.1 (x86 en-US) MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MyWinLocker Near Reality Norton Online Backup NTI Backup Now 5 NTI Backup Now Standard NTI Media Maker 8 NVIDIA PhysX v8.10.29 Octoshape Streaming Services Project64 1.6 QuickTime Realtek High Definition Audio Driver Realtek USB 2.0 Card Reader Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition Soldier Front TeamSpeak 2 RC2 Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) VC80CRTRedist - 8.0.50727.762 Ventrilo Client VLC media player 2.0.1 Welcome Center Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mail Windows Live Messenger Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources WinRAR 4.01 (32-bit) Yahoo! Messenger Yahoo! Software Update . ==== Event Viewer Messages From Past Week ======== . 7/22/2012 4:21:12 PM, Error: Service Control Manager [7003] - The McAfee Personal Firewall Service service depends the following service: MpsSvc. This service might not be installed. 7/22/2012 4:14:55 PM, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147024891 7/22/2012 4:14:55 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: %%-2147024891 7/22/2012 4:14:50 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service. 7/22/2012 4:14:11 PM, Error: Service Control Manager [7000] - The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the path specified. 7/22/2012 4:13:55 PM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter 7/22/2012 4:13:55 PM, Error: atikmdag [43029] - Display is not active 7/21/2012 1:06:16 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start. 7/21/2012 1:06:15 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 7/21/2012 1:06:15 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 7/21/2012 1:06:14 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89} 7/21/2012 1:06:14 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E} 7/21/2012 1:06:13 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 7/21/2012 1:06:04 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 7/21/2012 1:05:55 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD archlp DfsC discache mfehidk MPFP mwlPSDFilter mwlPSDNServ mwlPSDVDisk NetBIOS NetBT nsiproxy Psched rdbss spldr Tcpip tdx vwififlt Wanarpv6 WfpLwf ws2ifsl 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The Reliable Multicast Protocol service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 7/21/2012 1:05:55 PM, Error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 7/18/2012 7:19:28 PM, Error: Service Control Manager [7038] - The lmhosts service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: The request is not supported. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 7/18/2012 7:19:28 PM, Error: Service Control Manager [7000] - The TCP/IP NetBIOS Helper service failed to start due to the following error: The service did not start due to a logon failure. . ==== End Of File ===========================
  9. Thank you very much. My system is running like normal. No more redirects.
  10. ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=2952fc9b8a32ce4ebc753d59ba13da0c # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-07-11 11:33:30 # local_time=2012-07-11 06:33:30 (-0600, Central Daylight Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=5121 16776893 100 82 80184802 94045973 0 0 # compatibility_mode=5893 16776574 66 85 93572982 93587899 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=198864 # found=9 # cleaned=9 # scan_time=5161 C:\Qoobox\Quarantine\C\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\00000008.@.vir Win64/Agent.BA trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000000.@.vir Win64/Sirefef.AE trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000032.@.vir a variant of Win32/Sirefef.FD trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000064.@.vir Win64/Sirefef.AN trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\Qoobox\Quarantine\C\Windows\System32\services.exe.vir Win64/Patched.B.Gen trojan (deleted - quarantined) 00000000000000000000000000000000 C C:\Users\Patrick\Downloads\reginout_setup.exe multiple threats (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\_OTL\MovedFiles\07112012_155322\C_Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000000.@ Win64/Sirefef.AE trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\_OTL\MovedFiles\07112012_155322\C_Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000032.@ a variant of Win32/Sirefef.FD trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\_OTL\MovedFiles\07112012_155322\C_Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000064.@ Win64/Sirefef.AN trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
  11. <p>ok it is done. here is the log.</p> <p> </p> <p> </p> <div>ESETSmartInstaller@High as CAB hook log:</div> <div>OnlineScanner64.ocx - registred OK</div> <div>OnlineScanner.ocx - registred OK</div> <div># version=7</div> <div># iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</div> <div># OnlineScanner.ocx=1.0.0.6583</div> <div># api_version=3.0.2</div> <div># EOSSerial=2952fc9b8a32ce4ebc753d59ba13da0c</div> <div># end=finished</div> <div># remove_checked=true</div> <div># archives_checked=false</div> <div># unwanted_checked=true</div> <div># unsafe_checked=false</div> <div># antistealth_checked=true</div> <div># utc_time=2012-07-11 11:33:30</div> <div># local_time=2012-07-11 06:33:30 (-0600, Central Daylight Time)</div> <div># country="United States"</div> <div># lang=1033</div> <div># osver=6.1.7600 NT </div> <div># compatibility_mode=5121 16776893 100 82 80184802 94045973 0 0</div> <div># compatibility_mode=5893 16776574 66 85 93572982 93587899 0 0</div> <div># compatibility_mode=8192 67108863 100 0 0 0 0 0</div> <div># scanned=198864</div> <div># found=9</div> <div># cleaned=9</div> <div># scan_time=5161</div> <div>C:\Qoobox\Quarantine\C\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\00000008.@.vir<span class="Apple-tab-span" style="white-space:pre"> </span>Win64/Agent.BA trojan (cleaned by deleting - quarantined)<span class="Apple-tab-span" style="white-space:pre"> </span>00000000000000000000000000000000<span class="Apple-tab-span" style="white-space:pre"> </span>C</div> <div>C:\Qoobox\Quarantine\C\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000000.@.vir<span class="Apple-tab-span" style="white-space:pre"> </span>Win64/Sirefef.AE trojan (cleaned by deleting - quarantined)<span class="Apple-tab-span" style="white-space:pre"> </span>00000000000000000000000000000000<span class="Apple-tab-span" style="white-space:pre"> </span>C</div> <div>C:\Qoobox\Quarantine\C\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000032.@.vir<span class="Apple-tab-span" style="white-space:pre"> </span>a variant of Win32/Sirefef.FD trojan (cleaned by deleting - quarantined)<span class="Apple-tab-span" style="white-space:pre"> </span>00000000000000000000000000000000<span class="Apple-tab-span" style="white-space:pre"> </span>C</div> <div>C:\Qoobox\Quarantine\C\Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000064.@.vir<span class="Apple-tab-span" style="white-space:pre"> </span>Win64/Sirefef.AN trojan (cleaned by deleting - quarantined)<span class="Apple-tab-span" style="white-space:pre"> </span>00000000000000000000000000000000<span class="Apple-tab-span" style="white-space:pre"> </span>C</div> <div>C:\Qoobox\Quarantine\C\Windows\System32\services.exe.vir<span class="Apple-tab-span" style="white-space:pre"> </span>Win64/Patched.B.Gen trojan (deleted - quarantined)<span class="Apple-tab-span" style="white-space:pre"> </span>00000000000000000000000000000000<span class="Apple-tab-span" style="white-space:pre"> </span>C</div> <div>C:\Users\Patrick\Downloads\reginout_setup.exe<span class="Apple-tab-span" style="white-space:pre"> </span>multiple threats (cleaned by deleting - quarantined)<span class="Apple-tab-span" style="white-space:pre"> </span>00000000000000000000000000000000<span class="Apple-tab-span" style="white-space:pre"> </span>C</div> <div>C:\_OTL\MovedFiles\07112012_155322\C_Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000000.@<span class="Apple-tab-span" style="white-space:pre"> </span>Win64/Sirefef.AE trojan (cleaned by deleting - quarantined)<span class="Apple-tab-span" style="white-space:pre"> </span>00000000000000000000000000000000<span class="Apple-tab-span" style="white-space:pre"> </span>C</div> <div>C:\_OTL\MovedFiles\07112012_155322\C_Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000032.@<span class="Apple-tab-span" style="white-space:pre"> </span>a variant of Win32/Sirefef.FD trojan (cleaned by deleting - quarantined)<span class="Apple-tab-span" style="white-space:pre"> </span>00000000000000000000000000000000<span class="Apple-tab-span" style="white-space:pre"> </span>C</div> <div>C:\_OTL\MovedFiles\07112012_155322\C_Windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000064.@<span class="Apple-tab-span" style="white-space:pre"> </span>Win64/Sirefef.AN trojan (cleaned by deleting - quarantined)<span class="Apple-tab-span" style="white-space:pre"> </span>00000000000000000000000000000000<span class="Apple-tab-span" style="white-space:pre"> </span>C</div> <div> </div>
  12. I am on my iPod right now posting. I just wanted to make sure you didn't go offline and to tell you that im still online. I am doing the est scan right. It has found 6 threats so far. Is that bad? Thank you again soo much for helping me.
  13. ok i figured it out. heres the log. ComboFix 12-07-11.03 - Patrick 07/11/2012 16:37:15.1.1 - x64 MINIMAL Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2812.1970 [GMT -5:00] Running from: c:\users\Patrick\Desktop\ComboFix.exe AV: McAfee VirusScan *Disabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637} FW: McAfee Personal Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} SP: McAfee VirusScan *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\@ c:\windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\L\00000004.@ c:\windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\L\1afb2d56 c:\windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\L\201d3dde c:\windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\00000004.@ c:\windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\00000008.@ c:\windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\000000cb.@ c:\windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000000.@ c:\windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000032.@ c:\windows\Installer\{52a689ea-4d72-da20-a8af-379893955118}\U\80000064.@ . . ((((((((((((((((((((((((( Files Created from 2012-06-11 to 2012-07-11 ))))))))))))))))))))))))))))))) . . 2012-07-11 21:46 . 2012-07-11 21:46 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp 2012-07-11 21:46 . 2012-07-11 21:46 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-07-11 08:50 . 2012-07-11 08:50 -------- d-----w- C:\_OTL 2012-07-11 08:28 . 2012-07-11 08:28 -------- d-----w- C:\TDSSKiller_Quarantine 2012-07-11 08:11 . 2012-06-12 03:02 3147264 ----a-w- c:\windows\system32\win32k.sys 2012-07-11 06:16 . 2010-12-20 23:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2012-07-11 06:16 . 2012-04-04 20:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-07-09 22:45 . 2012-07-09 22:45 -------- d-sh--w- c:\windows\SysWow64\%APPDATA% 2012-07-09 22:01 . 2012-07-09 22:01 -------- d-----w- c:\programdata\Local Settings 2012-07-07 00:09 . 2012-07-07 00:09 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-24 01:07 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-24 01:07 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-24 01:07 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll 2012-06-24 01:07 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll 2012-06-24 01:07 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll 2012-06-24 01:07 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll 2012-06-24 01:07 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll 2012-06-24 01:06 . 2012-06-02 20:19 186752 ----a-w- c:\windows\system32\wuwebv.dll 2012-06-24 01:06 . 2012-06-02 20:15 36864 ----a-w- c:\windows\system32\wuapp.exe 2012-06-14 04:13 . 2012-04-28 03:50 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-07 00:09 . 2011-06-18 20:26 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2009-08-06 17:18 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408] "Messenger (Yahoo!)"="c:\progra~2\Yahoo!\MESSEN~1\YahooMessenger.exe" [2011-06-16 6276408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] "NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-24 588648] "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-07-28 1157128] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-30 98304] "ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-08-01 128296] "PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-08-05 181480] "Acer Assist Launcher"="c:\program files (x86)\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568] "mcagent_exe"="c:\program files (x86)\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008] "ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-07-06 421888] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Air Mouse.lnk - c:\program files (x86)\Air Mouse\Air Mouse\Air Mouse.exe [2011-9-3 1106432] McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R1 archlp;archlp;SysWOW64\drivers\archlp.sys [x] R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576] R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016] R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-07-29 203264] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 DVBLink Server;DVBLink Server;c:\program files (x86)\DVBLogic\DVBLink\DVBLinkSrv.exe [2009-07-01 135168] R2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-08-06 844320] R2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-06-04 1150496] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 135664] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files (x86)\McAfee\SiteAdvisor\McSACore.exe [2012-01-13 103440] R2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-08-06 311592] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640] R2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160] R3 dump_wmimmc;dump_wmimmc;c:\ijji\ENGLISH\u_sf\GameGuard\dump_wmimmc.sys [x] R3 dvblinkcap;DVBLink Capture 39A16CF1D2D85F6F7A968981EE9B99511F32CC46;c:\windows\system32\DRIVERS\dvblinkcap.sys [2009-05-04 18608] R3 dvblinkcap2;DVBLink Capture 454A65853766664A35602CB9F5C0D12CAE31EA2F37D729C7360EE9AB;c:\windows\system32\DRIVERS\dvblinkcap2.sys [2009-05-04 18608] R3 dvblinkcap3;DVBLink Capture A7BD1C44C58FD1378C13AA43CB1B848B1302D908598A62281224518D10373E70;c:\windows\system32\DRIVERS\dvblinkcap3.sys [2009-05-04 18608] R3 dvblinkcap4;DVBLink Capture B28D17A1EBD894FCA3AFB1EA0EC40D9AD7BBB02E97C180E2FED7CFDC89BBBB0073E3D79F5FDE39EE80A7E060B6211843;c:\windows\system32\DRIVERS\dvblinkcap4.sys [2009-05-04 18608] R3 dvblinktun;DVBLink Tuner B80EC7464A7658949D5BFD306EE25AF644FCFE67;c:\windows\system32\DRIVERS\dvblinktun.sys [2009-05-04 20784] R3 dvblinktun2;DVBLink Tuner 13E436F7285F837B06C484A7CDC45FEAA0D50C11A1EC92DE192BC201;c:\windows\system32\DRIVERS\dvblinktun2.sys [2009-05-04 20784] R3 dvblinktun3;DVBLink Tuner 22E8A099F6626A869E8B3F08F1B728E9623E08FFA775B78513EE17E5C8080678;c:\windows\system32\DRIVERS\dvblinktun3.sys [2009-05-04 20784] R3 dvblinktun4;DVBLink Tuner 64113C0133109F21D4F8C5E284FAF7865AFB3EB7A6FFA3D1C536FB414753D37991117EF0B0D24DC8A021A0F52A5CD08D;c:\windows\system32\DRIVERS\dvblinktun4.sys [2009-05-04 20784] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 135664] R3 hcwhdpvr;Hauppauge HD PVR Capture Device;c:\windows\system32\DRIVERS\hcwhdpvr.sys [2010-04-24 189440] R3 jumi;%Jumi%;c:\windows\system32\DRIVERS\jumi.sys [2010-06-03 15160] R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [2009-07-27 58880] R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys [2008-07-26 15768] R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2008-07-26 790424] R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys [2008-07-26 50072] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x] R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-08-10 222208] R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-01 1255736] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-07-05 254528] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-04-03 34872] . . Contents of the 'Scheduled Tasks' folder . 2012-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 05:33] . 2012-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-06 05:33] . 2012-07-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3794066387-2219636134-70439330-1000Core.job - c:\users\Patrick\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-18 05:33] . 2012-07-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3794066387-2219636134-70439330-1000UA.job - c:\users\Patrick\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-18 05:33] . 2012-06-15 c:\windows\Tasks\McDefragTask.job - c:\progra~2\mcafee\mqc\QcConsol.exe [2009-12-25 18:22] . 2012-07-01 c:\windows\Tasks\McQcTask.job - c:\progra~2\mcafee\mqc\QcConsol.exe [2009-12-25 18:22] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2009-08-06 17:19 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112] "Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-08-06 828960] "mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-08-06 349480] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Supplementary Scan ------- . uStart Page = uLocal Page = c:\windows\system32\blank.htm mStart Page = mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D1E1F7ED622A0E5D.dll/cmsidewiki.html TCP: DhcpNameServer = 192.168.1.254 DPF: Justin.tv Publisher - hxxp://www.justin.tv/plugins/justintv_publisher.CAB FF - ProfilePath - c:\users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\yppm9cke.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.mydtzone.com/startpage|https://mail.google.com/mail/?shva=1#|https://www.google.com/calendar/render?tab=mc&gsessionid=KyyaFjT6OOlMUBo7bbM01A|https://docs.google.com/?tab=mo&pli=1#all FF - user.js: yahoo.ytff.general.dontshowhpoffer - true . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Explorer_Run-58762 - c:\progra~3\LOCALS~1\Temp\msvara.cmd Toolbar-Locked - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe HKLM-Run-LogMeIn GUI - c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe AddRemove-Adobe Flash Player Plugin - c:\windows\SysWOW64\Macromed\Flash\FlashUtil10t_Plugin.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-3794066387-2219636134-70439330-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-3794066387-2219636134-70439330-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-07-11 16:51:06 ComboFix-quarantined-files.txt 2012-07-11 21:51 . Pre-Run: 48,632,557,568 bytes free Post-Run: 48,064,548,864 bytes free . - - End Of File - - B443427C8A559AA28EE47765F7550763
  14. ok i went on internet explorer and i downloaded combofix and saved it as combofix.exe. i quit everything and dbl clicked it. i clicked run and the after that a warning came up and said do not run in compatibility mode doing it could damage your cpu. I clicked ok. i waited for a while and nothing came up. Please what should i do?