Missing/hidden files, System restore error, possibly due to a Fed Ex email

Hello there, I have an anfected HP Mini 210 with XP. I have had major issues with the computer since yesterday. I've tried to fix it to the best of my abilities, and have come up short. Now, I have empty programs in my "All Programs" files, can't access system restore, strange audio, etc. Any help would be greatly appreciated. Thanks in advance, Justin.

OTL logfile created on: 8/10/2011 4:13:12 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\kenneth\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

987.38 Mb Total Physical Memory | 371.08 Mb Available Physical Memory | 37.58% Memory free
2.32 Gb Paging File | 1.73 Gb Available in Paging File | 74.47% Paging File free
Paging file location(s): C:\pagefile.sys 1476 2952 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 18.85 Gb Free Space | 12.64% Space Free | Partition Type: NTFS

Computer Name: PC106846666274 | User Name: kenneth | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/08/10 16:07:42 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\kenneth\Desktop\OTL.com
PRC - [2011/07/28 21:09:07 | 004,599,680 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2011/07/18 20:02:03 | 000,123,264 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
PRC - [2011/07/06 19:52:38 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2010/09/13 00:01:23 | 000,088,727 | ---- | M] (INCA Internet Co., Ltd.) -- C:\WINDOWS\system32\npkcmsvc.exe
PRC - [2009/10/12 02:51:52 | 000,221,266 | ---- | M] (IDT, Inc.) -- c:\Program Files\IDT\WDM\stacsv.exe
PRC - [2009/07/08 07:55:26 | 000,323,584 | ---- | M] (DeviceVM, Inc.) -- C:\SPLASH.SYS\config\DVMExportService.exe
PRC - [2009/06/04 07:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2008/04/15 08:00:00 | 001,033,728 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2011/08/10 16:07:42 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\kenneth\Desktop\OTL.com
MOD - [2010/08/23 12:12:02 | 001,054,208 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/07/18 20:02:03 | 000,123,264 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010/09/13 00:01:23 | 000,088,727 | ---- | M] (INCA Internet Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\npkcmsvc.exe -- (npkcmsvc)
SRV - [2009/10/12 02:51:52 | 000,221,266 | ---- | M] (IDT, Inc.) [Auto | Running] -- c:\Program Files\IDT\WDM\stacsv.exe -- (STacSV)
SRV - [2009/07/08 07:55:26 | 000,323,584 | ---- | M] (DeviceVM, Inc.) [Auto | Running] -- C:\SPLASH.SYS\config\DVMExportService.exe -- (DvmMDES)
SRV - [2009/06/05 20:07:28 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009/06/04 07:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)


========== Driver Services (SafeList) ==========

DRV - [2011/07/22 12:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/12 17:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011/07/06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) [Kernel | Disabled | Running] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/06/03 11:41:04 | 000,108,736 | -H-- | M] (INCA Internet Co.,Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\Npfw.sys -- (NPFW)
DRV - [2011/03/09 01:52:49 | 000,043,688 | RH-- | M] (SoftSecurity Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\JRSKD24.SYS -- (JRSKD24)
DRV - [2011/02/27 19:15:58 | 000,126,048 | -H-- | M] (Kings Information & Network) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\kcrtx86.sys -- (kcrtx86)
DRV - [2011/01/11 09:04:30 | 000,082,496 | -H-- | M] (INCA Internet Co.,Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\npfwflt.sys -- (NPFWFLT)
DRV - [2010/05/13 01:55:18 | 000,061,792 | -H-- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\npids.sys -- (NPIDS)
DRV - [2010/05/08 14:53:13 | 002,485,504 | -H-- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2009/10/30 07:49:56 | 000,176,768 | -H-- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2009/10/12 02:51:52 | 001,654,259 | -H-- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2009/09/29 06:25:26 | 000,017,624 | ---- | M] (DeviceVM, Inc.) [Kernel | System | Running] -- C:\SPLASH.SYS\config\dvmio.sys -- (DVMIO)
DRV - [2009/09/01 21:59:42 | 000,174,592 | -H-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2009/08/24 17:02:18 | 000,045,984 | -H-- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2009/08/24 17:02:06 | 000,156,816 | -H-- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2009/08/24 17:02:02 | 000,037,160 | -H-- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2009/08/24 17:01:58 | 000,991,264 | -H-- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2009/08/24 17:01:54 | 000,533,024 | -H-- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2009/04/22 05:57:18 | 003,486,080 | -H-- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2009/04/20 21:13:34 | 000,113,664 | -H-- | M] (Andrea Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud)
DRV - [2008/04/14 10:05:40 | 000,020,992 | -H-- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2007/06/25 21:39:02 | 000,035,600 | -H-- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\npkcrypt.sys -- (npkcrypt)
DRV - [2007/06/18 05:12:04 | 000,016,768 | -H-- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com/sphome.aspx?mkt={SUB_RFC1766}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@softforum.com/npKeyPro: C:\WINDOWS\system32\npKeyPro.dll (SoftForum Co., Ltd.)
FF - HKLM\Software\MozillaPlugins\@softforum.com/npxwebplugins: C:\Program Files\SoftForum\XecureWeb\ActiveX\npxwebplugin.dll (SoftForum Co., Ltd.)
FF - HKLM\Software\MozillaPlugins\@softforum.com/npxwebplugins_file: C:\Program Files\SoftForum\XecureWeb\ActiveX\npxwebplugin_file.dll (SoftForum Co., Ltd.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.7.1: C:\Documents and Settings\kenneth\Local Settings\Application Data\Yahoo!\BrowserPlus\2.7.1\Plugins\npybrowserplus_2.7.1.dll (Yahoo! Inc.)



O1 HOSTS File: ([2011/08/05 23:59:50 | 000,436,278 | RH-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15018 more lines...
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [ccleaner] C:\Program Files\CCleaner\CCleaner.exe (Piriform Ltd)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: fileresearchcenter.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: GeekPolice.net ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: majorgeeks.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([windowsupdate] http in Trusted sites)
O15 - HKCU\..Trusted Domains: superantispyware.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: windowsupdate.com ([download] http in Trusted sites)
O16 - DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} http://mpi.dacom.net/XMPI/js/LGTelecom_XMPI_20100420.cab (XacsPop Control)
O16 - DPF: {48CF826A-BFBA-4EA3-83D3-AF765DF1B1ED} http://www.webgateinc.com/nwizard/wizard/url2/viewer/wespliveviewer.cab (WespLiveViewerInstaller Class)
O16 - DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} http://mpi.dacom.net/XPayMPI/XPayMPIOCX.cab (XPayMPIOCX Control)
O16 - DPF: {6CE20149-ABE3-462E-A1B4-5B549971AA38} http://www.hikorea.go.kr/activeX/CKKeyPro/CKKeyPro3023_32k.cab (XecureCKKB Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {967386A1-409E-431A-A93A-FB5FEFF86A58} http://bank.keb.co.kr/veraport/veraport.cab (AXMObjectCtl Class)
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} http://www.superadblocker.com/activex/sabspx.cab (SABScanProcesses Class)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} http://www.g4f.go.kr/activeX/nProtect/npkcx_inca.cab (NPKCX Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} https://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab (KvpIspCtlD Control)
O16 - DPF: {F025D01A-28DC-4C14-8253-7F663864825F} http://211.57.102.21/ZaolmapClient.cab (ZaolmapClient Control)
O16 - DPF: {FFD77E35-1C34-4EAC-B5A7-414CC5D007DA} https://www.isaackorea.net/update/ansim/ilkactx.cab (AnsimPlugin Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\kenneth\Application Data\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\kenneth\Application Data\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: ctfmon.exe - hkey= - key= - File not found
MsConfig - StartUpReg: HotKeysCmds - hkey= - key= - File not found
MsConfig - StartUpReg: HP - hkey= - key= - C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe (Hewlett-Packard)
MsConfig - StartUpReg: IAAnotif - hkey= - key= - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
MsConfig - StartUpReg: IgfxTray - hkey= - key= - File not found
MsConfig - StartUpReg: IMEKRMIG6.1 - hkey= - key= - C:\WINDOWS\ime\imkr6_1\imekrmig.exe (Microsoft Corporation)
MsConfig - StartUpReg: IMJPMIG8.1 - hkey= - key= - C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: KernelFaultCheck - hkey= - key= - File not found
MsConfig - StartUpReg: lgxfsrvc - hkey= - key= - File not found
MsConfig - StartUpReg: MSPY2002 - hkey= - key= - File not found
MsConfig - StartUpReg: Persistence - hkey= - key= - File not found
MsConfig - StartUpReg: PHIME2002A - hkey= - key= - File not found
MsConfig - StartUpReg: PHIME2002ASync - hkey= - key= - File not found
MsConfig - StartUpReg: QlbCtrl.exe - hkey= - key= - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe ( Hewlett-Packard Development Company, L.P.)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
MsConfig - StartUpReg: rBYeOdOUCsrLHmV - hkey= - key= - File not found
MsConfig - StartUpReg: snp2uvc - hkey= - key= - C:\WINDOWS\vsnp2uvc.exe (Sonix)
MsConfig - StartUpReg: SpybotSD TeaTimer - hkey= - key= - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: SynTPEnh - hkey= - key= - File not found
MsConfig - StartUpReg: SysTrayApp - hkey= - key= - File not found
MsConfig - StartUpReg: WirelessAssistant - hkey= - key= - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard)
MsConfig - StartUpReg: ZumoDrive - hkey= - key= - C:\Program Files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk ()
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

SafeBootMin: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SafeBootMin: AppMgmt - File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SafeBootNet: AppMgmt - File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Program Files\Combined Community Codec Pack\Filters\FFDShow\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2011/08/10 16:09:46 | 001,915,904 | ---- | C] (AVAST Software) -- C:\Documents and Settings\kenneth\Desktop\aswMBR.exe
[2011/08/10 16:08:09 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\kenneth\Desktop\OTL.com
[2011/08/10 14:59:21 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\kenneth\Recent
[2011/08/10 12:00:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Application Data\SUPERAntiSpyware.com
[2011/08/10 11:59:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\!SASCORE
[2011/08/10 11:59:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
[2011/08/10 11:59:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/08/10 11:59:52 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2011/08/09 19:56:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/08/09 19:33:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\MpEngineStore
[2011/08/09 19:24:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations
[2011/08/09 18:54:09 | 000,222,080 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[2011/08/09 17:06:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Application Data\Malwarebytes
[2011/08/09 17:05:59 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/08/09 17:05:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/09 17:05:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/08/09 17:05:52 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/08/09 17:05:52 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/09 16:25:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2011/08/09 16:24:55 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011/08/09 16:22:06 | 003,447,576 | ---- | C] (Piriform Ltd) -- C:\Documents and Settings\kenneth\Desktop\ccsetup309.exe
[2011/08/09 12:28:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Start Menu\Programs\System Repair
[2011/08/04 13:58:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Combined Community Codec Pack
[2011/08/04 13:58:41 | 000,000,000 | ---D | C] -- C:\Program Files\Combined Community Codec Pack
[2011/07/23 22:40:21 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2011/07/19 08:58:39 | 000,000,000 | ---D | C] -- C:\Program Files\Nikon
[2011/07/19 08:58:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nikon
[2011/07/13 13:32:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Application Data\GOL_byHasbro
[2011/07/13 13:03:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\My Documents\LDW
[2011/07/13 12:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Application Data\PlayFirst
[2011/07/13 07:11:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Application Data\iWin
[2011/07/12 08:19:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\kenneth\Desktop\Games
[2010/05/08 14:54:44 | 000,196,608 | -H-- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll
[2010/05/08 14:54:41 | 000,225,280 | -H-- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/10 16:10:27 | 000,000,177 | -H-- | M] () -- C:\dvmexp.idx
[2011/08/10 16:09:46 | 001,915,904 | ---- | M] (AVAST Software) -- C:\Documents and Settings\kenneth\Desktop\aswMBR.exe
[2011/08/10 16:08:57 | 000,879,225 | ---- | M] () -- C:\Documents and Settings\kenneth\Desktop\SecurityCheck.exe
[2011/08/10 16:07:42 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\kenneth\Desktop\OTL.com
[2011/08/10 15:59:25 | 000,001,945 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2011/08/10 15:20:11 | 000,000,314 | -HS- | M] () -- C:\WINDOWS\tasks\Whsahpn.job
[2011/08/10 14:59:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/08/10 14:59:08 | 1035,411,456 | -HS- | M] () -- C:\hiberfil.sys
[2011/08/10 14:57:44 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2011/08/10 14:34:14 | 000,001,158 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/08/10 11:59:56 | 000,001,678 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/08/09 21:32:56 | 000,000,654 | ---- | M] () -- C:\Documents and Settings\kenneth\Desktop\Shortcut to iTunes.exe.lnk
[2011/08/09 20:09:58 | 000,002,404 | ---- | M] () -- C:\Documents and Settings\kenneth\Desktop\sysrestoreenable.reg
[2011/08/09 19:56:48 | 000,107,520 | RHS- | M] () -- C:\WINDOWS\System32\c_28605U.dll
[2011/08/09 19:35:40 | 000,139,776 | ---- | M] () -- C:\Documents and Settings\kenneth\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/09 18:26:15 | 000,004,926 | ---- | M] () -- C:\Documents and Settings\kenneth\My Documents\msi.reg
[2011/08/09 17:06:00 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/09 16:31:29 | 000,145,256 | ---- | M] () -- C:\Documents and Settings\kenneth\My Documents\cc_20110809_163113.reg
[2011/08/09 16:22:13 | 003,447,576 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\kenneth\Desktop\ccsetup309.exe
[2011/08/09 16:01:03 | 000,000,284 | -H-- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/08/09 12:28:29 | 000,000,336 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\P5tM1QBI6DSS92
[2011/08/09 07:21:00 | 000,000,292 | -H-- | M] () -- C:\WINDOWS\tasks\Windows Media Player.job
[2011/08/08 23:14:14 | 000,501,788 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/08/08 23:14:14 | 000,096,626 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/08/06 12:04:52 | 000,000,136 | -H-- | M] () -- C:\WINDOWS\System32\npconf.md5
[2011/08/06 12:04:35 | 000,000,255 | -H-- | M] () -- C:\WINDOWS\System32\npzupdate.conf
[2011/08/05 23:59:50 | 000,436,278 | RH-- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/07/24 07:21:21 | 000,436,064 | RH-- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20110805-235950.backup
[2011/07/21 21:41:38 | 000,000,036 | -HS- | M] () -- C:\syncguid.dat
[2011/07/13 09:40:53 | 000,333,872 | -H-- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/07/13 07:47:11 | 000,435,650 | RH-- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20110724-072121.backup
[2011/07/12 12:08:50 | 000,000,492 | ---- | M] () -- C:\Documents and Settings\kenneth\My Documents\spider.sav
[2011/07/12 09:02:11 | 000,001,492 | ---- | M] () -- C:\Documents and Settings\kenneth\Desktop\IZArc.lnk
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/10 16:08:49 | 000,879,225 | ---- | C] () -- C:\Documents and Settings\kenneth\Desktop\SecurityCheck.exe
[2011/08/10 11:59:56 | 000,001,678 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/08/09 21:32:56 | 000,000,654 | ---- | C] () -- C:\Documents and Settings\kenneth\Desktop\Shortcut to iTunes.exe.lnk
[2011/08/09 20:16:13 | 000,002,404 | ---- | C] () -- C:\Documents and Settings\kenneth\Desktop\sysrestoreenable.reg
[2011/08/09 19:56:50 | 000,000,314 | -HS- | C] () -- C:\WINDOWS\tasks\Whsahpn.job
[2011/08/09 19:56:47 | 000,107,520 | RHS- | C] () -- C:\WINDOWS\System32\c_28605U.dll
[2011/08/09 18:50:13 | 000,001,945 | ---- | C] () -- C:\WINDOWS\epplauncher.mif
[2011/08/09 18:27:26 | 000,004,926 | ---- | C] () -- C:\Documents and Settings\kenneth\My Documents\msi.reg
[2011/08/09 17:05:59 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/09 16:56:16 | 1035,411,456 | -HS- | C] () -- C:\hiberfil.sys
[2011/08/09 16:31:22 | 000,145,256 | ---- | C] () -- C:\Documents and Settings\kenneth\My Documents\cc_20110809_163113.reg
[2011/08/09 12:28:29 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\P5tM1QBI6DSS92
[2011/07/21 21:41:38 | 000,000,036 | -HS- | C] () -- C:\syncguid.dat
[2011/07/12 12:08:50 | 000,000,492 | ---- | C] () -- C:\Documents and Settings\kenneth\My Documents\spider.sav
[2011/07/12 09:02:11 | 000,001,492 | ---- | C] () -- C:\Documents and Settings\kenneth\Desktop\IZArc.lnk
[2011/05/18 13:38:42 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2011/01/31 05:05:03 | 000,027,406 | -H-- | C] () -- C:\WINDOWS\System32\teexcept.dat
[2011/01/31 05:04:46 | 000,072,272 | -H-- | C] () -- C:\WINDOWS\System32\cosa.dll
[2011/01/31 05:04:42 | 000,067,120 | -H-- | C] () -- C:\WINDOWS\System32\npnuninst.exe
[2010/12/04 03:43:12 | 000,295,705 | -H-- | C] () -- C:\WINDOWS\System32\shimg.dll
[2010/07/12 05:54:26 | 000,000,664 | -H-- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/05/11 10:05:09 | 000,139,776 | ---- | C] () -- C:\Documents and Settings\kenneth\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/09 22:05:30 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/05/08 14:54:44 | 003,486,080 | -H-- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2010/05/08 14:54:44 | 000,028,544 | -H-- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2010/05/08 14:54:44 | 000,015,497 | -H-- | C] () -- C:\WINDOWS\snp2uvc.ini
[2009/11/23 20:54:50 | 000,241,664 | -H-- | C] () -- C:\WINDOWS\System32\KvpUpCom.dll
[2009/11/21 13:03:12 | 000,028,510 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009/11/21 12:26:13 | 000,073,728 | -H-- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2009/09/27 01:49:50 | 000,362,029 | -H-- | C] () -- C:\WINDOWS\System32\sqlite3.dll
[2009/07/29 02:28:46 | 002,854,976 | -H-- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2009/06/30 04:58:20 | 000,008,192 | -H-- | C] () -- C:\WINDOWS\System32\veraportutil.dll
[2009/04/10 22:25:42 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/04/10 22:25:38 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2009/04/10 22:06:58 | 000,501,788 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2009/04/10 22:06:58 | 000,096,626 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2009/04/10 22:01:42 | 000,333,872 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/04/10 21:58:54 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/04/10 21:57:24 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/04/15 08:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/15 08:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/15 08:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/15 08:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/15 08:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/15 08:00:00 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/15 08:00:00 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/04/15 08:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2007/09/10 01:19:08 | 000,398,856 | -H-- | C] () -- C:\WINDOWS\System32\INICRYPTOSDK.dll
[2002/05/29 01:55:42 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/05/29 01:54:40 | 000,004,605 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/11/14 01:56:00 | 001,802,240 | -H-- | C] () -- C:\WINDOWS\System32\lcppn21.dll

========== Custom Scans ==========


< %APPDATA%\Microsoft\*.* >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %USERPROFILE%\Desktop\*.exe >
[2011/08/10 16:09:46 | 001,915,904 | ---- | M] (AVAST Software) -- C:\Documents and Settings\kenneth\Desktop\aswMBR.exe
[2011/08/09 16:22:13 | 003,447,576 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\kenneth\Desktop\ccsetup309.exe
[2011/08/10 16:08:57 | 000,879,225 | ---- | M] () -- C:\Documents and Settings\kenneth\Desktop\SecurityCheck.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\winn32\*.* >

< %USERPROFILE%\My Documents\*.exe >
[2010/10/22 07:23:15 | 002,988,400 | ---- | M] (BitTorrent, Inc.) -- C:\Documents and Settings\kenneth\My Documents\BitTorrent-7.1.exe
[2010/12/16 08:02:07 | 001,028,938 | ---- | M] () -- C:\Documents and Settings\kenneth\My Documents\soulseek.exe
[2011/07/09 17:56:12 | 021,022,914 | ---- | M] () -- C:\Documents and Settings\kenneth\My Documents\vlc-1.1.10-win32.exe
[2010/10/18 09:04:14 | 019,657,194 | ---- | M] () -- C:\Documents and Settings\kenneth\My Documents\vlc-1.1.4-win32.exe
[2011/01/04 02:35:11 | 019,985,265 | ---- | M] () -- C:\Documents and Settings\kenneth\My Documents\vlc-1.1.5-win32.exe
[2011/02/07 06:52:53 | 020,364,702 | ---- | M] () -- C:\Documents and Settings\kenneth\My Documents\vlc-1.1.7-win32.exe

< %USERPROFILE%\*.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.exe >

< %ProgramFiles%\TinyProxy. >

< %systemroot%\system32\*.* /lockedfiles >
[2011/08/09 19:56:48 | 000,107,520 | RHS- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\c_28605U.dll
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >
[2011/08/10 15:20:11 | 000,000,314 | -HS- | M] () Unable to obtain MD5 -- C:\WINDOWS\Tasks\Whsahpn.job

< %systemroot%\system32\drivers\*.* /lockedfiles >

< %PROGRAMFILES%\*. >
[2011/06/25 06:54:23 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2011/05/23 22:48:43 | 000,000,000 | ---D | M] -- C:\Program Files\Alarm
[2011/07/12 10:51:48 | 000,000,000 | ---D | M] -- C:\Program Files\Ancient Tripeaks II
[2011/07/23 22:40:22 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2011/07/09 17:53:59 | 000,000,000 | ---D | M] -- C:\Program Files\bfgclient
[2011/01/01 08:32:24 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2010/05/08 14:53:22 | 000,000,000 | ---D | M] -- C:\Program Files\Broadcom
[2011/06/11 01:06:46 | 000,000,000 | ---D | M] -- C:\Program Files\Casino Island To Go
[2011/08/09 16:25:04 | 000,000,000 | ---D | M] -- C:\Program Files\CCleaner
[2011/08/04 13:58:54 | 000,000,000 | ---D | M] -- C:\Program Files\Combined Community Codec Pack
[2011/07/19 08:58:39 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2010/05/09 05:42:46 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2010/05/09 05:42:46 | 000,000,000 | ---D | M] -- C:\Program Files\Downloaded Installations
[2011/06/29 08:38:11 | 000,000,000 | ---D | M] -- C:\Program Files\Eleven Home Edition
[2011/05/23 22:50:18 | 000,000,000 | ---D | M] -- C:\Program Files\gaming
[2010/07/13 07:59:07 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2010/05/08 14:57:10 | 000,000,000 | ---D | M] -- C:\Program Files\Hewlett-Packard
[2010/05/09 05:43:08 | 000,000,000 | ---D | M] -- C:\Program Files\HP
[2010/05/09 05:43:14 | 000,000,000 | ---D | M] -- C:\Program Files\HP Games
[2010/05/09 05:43:14 | 000,000,000 | ---D | M] -- C:\Program Files\HPQ
[2010/05/08 14:52:58 | 000,000,000 | ---D | M] -- C:\Program Files\IDT
[2011/07/19 08:58:39 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2010/05/09 05:43:14 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2011/06/25 06:56:28 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2011/01/01 08:36:51 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2011/01/02 11:18:07 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2011/07/06 16:34:48 | 000,000,000 | ---D | M] -- C:\Program Files\IZArc
[2011/02/23 20:48:33 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2011/05/29 09:01:15 | 000,000,000 | ---D | M] -- C:\Program Files\Kasparov Chessmate
[2011/08/09 17:06:02 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/05/10 00:52:20 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2010/05/09 05:43:15 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft
[2010/05/09 05:43:16 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2011/07/06 11:58:58 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2011/06/25 06:54:45 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2010/05/09 05:43:21 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2010/05/09 05:43:21 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Sync Framework
[2010/05/09 05:43:21 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio
[2010/05/18 19:53:35 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2010/05/09 05:43:21 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2010/08/12 14:02:15 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/05/09 05:43:21 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2010/05/08 19:06:03 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2010/05/09 05:43:21 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2010/05/09 05:43:21 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 6.0
[2010/05/09 05:43:21 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2011/07/19 08:58:39 | 000,000,000 | ---D | M] -- C:\Program Files\Nikon
[2010/09/13 00:01:41 | 000,000,000 | ---D | M] -- C:\Program Files\NPKI
[2010/05/08 14:57:32 | 000,000,000 | R--D | M] -- C:\Program Files\Online Services
[2010/12/22 09:56:04 | 000,000,000 | ---D | M] -- C:\Program Files\OurBabyMaker_27EI
[2010/12/15 14:00:46 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2011/02/20 07:16:44 | 000,000,000 | ---D | M] -- C:\Program Files\Picaboo X
[2011/05/29 08:51:17 | 000,000,000 | ---D | M] -- C:\Program Files\Poker Superstars III
[2011/01/01 08:14:33 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2011/07/06 18:39:47 | 000,000,000 | ---D | M] -- C:\Program Files\Ranch Rush
[2010/10/03 00:06:27 | 000,000,000 | ---D | M] -- C:\Program Files\Raptr
[2011/04/09 04:56:46 | 000,000,000 | ---D | M] -- C:\Program Files\RealArcade
[2010/05/09 05:43:23 | 000,000,000 | ---D | M] -- C:\Program Files\Realtek
[2010/05/09 05:43:23 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2010/05/09 05:43:23 | 000,000,000 | ---D | M] -- C:\Program Files\Roxio
[2011/07/10 09:59:33 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2010/09/13 00:01:44 | 000,000,000 | ---D | M] -- C:\Program Files\SoftForum
[2011/06/26 03:49:38 | 000,000,000 | ---D | M] -- C:\Program Files\Spybot - Search & Destroy
[2011/08/10 12:00:25 | 000,000,000 | ---D | M] -- C:\Program Files\SUPERAntiSpyware
[2010/05/09 05:43:24 | 000,000,000 | ---D | M] -- C:\Program Files\Synaptics
[2011/07/06 17:58:51 | 000,000,000 | ---D | M] -- C:\Program Files\Telltale Games
[2010/05/09 05:43:25 | 000,000,000 | ---D | M] -- C:\Program Files\Times Reader
[2010/05/09 05:43:25 | 000,000,000 | ---D | M] -- C:\Program Files\Uninstall Information
[2010/05/13 10:11:29 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2010/05/08 14:55:55 | 000,000,000 | ---D | M] -- C:\Program Files\WIDCOMM
[2010/05/09 05:43:25 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live
[2010/05/09 05:43:25 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live SkyDrive
[2010/05/09 05:43:25 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2010/05/09 05:43:25 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2010/05/09 05:43:25 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Sidebar
[2010/05/09 05:43:25 | 000,000,000 | ---D | M] -- C:\Program Files\WindowsUpdate
[2010/05/09 05:43:25 | 000,000,000 | ---D | M] -- C:\Program Files\xerox


< MD5 for: AGP440.SYS >
[2008/04/15 00:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\I386\sp3.cab:AGP440.sys
[2008/04/15 08:00:00 | 020,056,462 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/14 19:06:40 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2008/04/15 00:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\I386\sp3.cab:atapi.sys
[2008/04/15 08:00:00 | 020,056,462 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 19:10:32 | 000,096,512 | -H-- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: DISK.SYS >
[2008/04/15 00:00:00 | 020,056,462 | ---- | M] () .cab file -- C:\I386\sp3.cab:disk.sys
[2008/04/15 08:00:00 | 020,056,462 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
[2008/04/15 08:00:00 | 000,036,352 | -H-- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: IASTOR.SYS >
[2009/06/04 06:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009/06/04 06:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009/06/03 14:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\SwSetup\HDD\IaStor.sys
[2009/06/04 06:43:16 | 000,330,264 | -H-- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\WINDOWS\system32\drivers\iaStor.sys
[2009/06/04 06:43:16 | 000,330,264 | -H-- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\WINDOWS\system32\DRVSTORE\iaAHCI_A9394F3D35C80DCC4A81BA0CEEA79EB027D1AA6E\iaStor.sys
[2009/06/03 14:43:16 | 000,330,264 | -H-- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/15 08:00:00 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-07-13 12:33:51

< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/04/25 08:01:34 | 000,173,568 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/04/25 08:01:34 | 000,173,568 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/04/25 08:01:34 | 000,173,568 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 02:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 02:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< hklm\software\clients\startmenuinternet|command /64 /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/04/25 08:01:34 | 000,173,568 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/04/25 08:01:34 | 000,173,568 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/04/25 08:01:34 | 000,173,568 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 02:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 02:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< >

< End of report >







Last edited by Justin_mac on 10th August 2011, 9:05 pm; edited 1 time in total

OTL Extras logfile created on: 8/10/2011 4:13:12 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\kenneth\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

987.38 Mb Total Physical Memory | 371.08 Mb Available Physical Memory | 37.58% Memory free
2.32 Gb Paging File | 1.73 Gb Available in Paging File | 74.47% Paging File free
Paging file location(s): C:\pagefile.sys 1476 2952 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 18.85 Gb Free Space | 12.64% Space Free | Partition Type: NTFS

Computer Name: PC106846666274 | User Name: kenneth | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe" = C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{070D1CA1-BF29-083F-2D1B-247B26CF9434}" = Picaboo X
"{1061DF04-CF33-40B0-8360-D07C9BBEB122}" = HP Wireless Assistant
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{21FFAF37-E51A-41AB-8749-ACD1F9CF8E37}" = HP QuickWeb
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 24
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = USB Webcam
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{4414C431-245A-4AF7-8FE0-3ED2333FD8D2}" = HP MediaStream
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{491ADA37-04EE-2ECE-9F86-DDC0106047AC}" = Times Reader
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{69DAC00A-7665-4E9B-B441-093D40736429}" = HP BatteryCheck 2.10 A2
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = HP Integrated Module with Bluetooth wireless technology
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo Layers Runtime 1.10.01
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.6
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A89768CF-CD21-44FD-A723-16D5A8557415}" = NEF Codec
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CDCA645C-CA74-45A5-9261-D18BB10D4DCA}" = HP User Guides 0168
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.5
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EEA95E6C-6847-49BE-83C9-ED92D8E18983}" = HP QuickSync
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F1D7AC58-554A-4A58-B784-B61558B1449A}" = QLBCASL
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Alarm_is1" = Alarm
"Ancient Tripeaks II" = Ancient Tripeaks II
"BFGC" = Big Fish Games: Game Manager
"Broadcom 802.11 Wireless LAN Adapter" = Broadcom 802.11 Wireless LAN Adapter
"Casino Island To Go" = Casino Island To Go
"CCleaner" = CCleaner
"com.picaboo.Picaboo.A382D4714709B456C4E0088DFC1F7243AF9EBF75.1" = Picaboo X
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2011-07-30
"Fliqlo" = Fliqlo Screen Saver
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ie8" = Windows Internet Explorer 8
"Kasparov Chessmate" = Kasparov Chessmate
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSNINST" = MSN
"npkcxp" = nProtect KeyCrypt
"npnv4" = nProtect Netizen(remove only)
"PROHYBRIDR" = 2007 Microsoft Office system
"Ranch Rush1.0" = Ranch Rush
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VeraPort" = VeraPort (º¸¾È¸ðµâ°ü¸® ÇÁ·Î±×·¥)
"VLC media player" = VLC media player 1.0.5
"WildTangent hp Master Uninstall" = HP Games
"WinLiveSuite_Wave3" = Windows Live Essentials
"XecureCK" = ClientKeeper KeyPro with E2E for 32bit
"XecureWeb Control" = XecureWeb Control
"ZumoDrive" = HP CloudDrive

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.7.1

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >




aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-10 16:29:23
-----------------------------
16:29:23.640 OS Version: Windows 5.1.2600 Service Pack 3
16:29:23.640 Number of processors: 2 586 0x1C0A
16:29:23.640 ComputerName: PC106846666274 UserName: kenneth
16:29:25.765 Initialize success
16:29:36.718 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
16:29:36.718 Disk 0 Vendor: TOSHIBA_ FG01 Size: 152627MB BusType: 3
16:29:36.765 Disk 0 MBR read successfully
16:29:36.781 Disk 0 MBR scan
16:29:36.781 Disk 0 TDL4@MBR code has been found
16:29:36.796 Disk 0 MBR hidden
16:29:36.812 Disk 0 MBR [TDL4] **ROOTKIT**
16:29:36.828 Disk 0 trace - called modules:
16:29:36.843 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x861dced1]<<
16:29:36.859 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86bd5030]
16:29:36.890 3 CLASSPNP.SYS[f7561fd7] -> nt!IofCallDriver -> \Device\0000006b[0x86bcf1a8]
16:29:36.906 5 ACPI.sys[f73f8620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x86b55028]
16:29:36.921 \Driver\iaStor[0x86b6d400] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x861dced1
16:29:36.937 Scan finished successfully
16:30:18.656 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\kenneth\Desktop\MBR.dat"
16:30:18.687 The log file has been saved successfully to "C:\Documents and Settings\kenneth\Desktop\aswMBR.txt"

Results of screen317's Security Check version 0.99.18
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 24
Out of date Java installed!
Adobe Flash Player
Adobe Reader X (10.1.0)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Malwarebytes' Anti-Malware mbamservice.exe
``````````End of Log````````````

Hi,

How to fix TDL4

Re-run aswMBR.exe

• Click [Scan]
  
• On completion of the scan
  
• Click the [Fix] for TDL4 (MBRoot):

Once you are done with that, please do the following:

Please download TDSSKiller from here and save it to your Desktop.

• Doubleclick TDSSKiller.exe to run the tool
  
• Click the Start Scan button
  
• After the scan has finished, click the Close button
  
• Click the Report button and copy/paste the contents of it into your next reply

Note:It will also create a log in the C:\ directory.

Hello!! Here's the TDSSKILLER report:


2011/08/11 23:52:15.0656 3792 TDSS rootkit removing tool 2.5.15.0 Aug 11 2011 16:32:13
2011/08/11 23:52:16.0125 3792 ================================================================================
2011/08/11 23:52:16.0140 3792 SystemInfo:
2011/08/11 23:52:16.0140 3792
2011/08/11 23:52:16.0140 3792 OS Version: 5.1.2600 ServicePack: 3.0
2011/08/11 23:52:16.0140 3792 Product type: Workstation
2011/08/11 23:52:16.0140 3792 ComputerName: PC106846666274
2011/08/11 23:52:16.0140 3792 UserName: kenneth
2011/08/11 23:52:16.0140 3792 Windows directory: C:\WINDOWS
2011/08/11 23:52:16.0140 3792 System windows directory: C:\WINDOWS
2011/08/11 23:52:16.0140 3792 Processor architecture: Intel x86
2011/08/11 23:52:16.0140 3792 Number of processors: 2
2011/08/11 23:52:16.0140 3792 Page size: 0x1000
2011/08/11 23:52:16.0140 3792 Boot type: Normal boot
2011/08/11 23:52:16.0140 3792 ================================================================================
2011/08/11 23:52:16.0812 3792 Initialize success
2011/08/11 23:52:18.0750 2204 ================================================================================
2011/08/11 23:52:18.0750 2204 Scan started
2011/08/11 23:52:18.0750 2204 Mode: Manual;
2011/08/11 23:52:18.0750 2204 ================================================================================
2011/08/11 23:52:20.0406 2204 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2011/08/11 23:52:20.0468 2204 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/08/11 23:52:20.0484 2204 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/08/11 23:52:20.0546 2204 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2011/08/11 23:52:20.0734 2204 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/08/11 23:52:20.0937 2204 AESTAud (822d53766d57c90c437536232ece9023) C:\WINDOWS\system32\drivers\AESTAud.sys
2011/08/11 23:52:21.0000 2204 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/08/11 23:52:21.0171 2204 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/08/11 23:52:21.0343 2204 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2011/08/11 23:52:21.0375 2204 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2011/08/11 23:52:21.0531 2204 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2011/08/11 23:52:21.0578 2204 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2011/08/11 23:52:21.0781 2204 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2011/08/11 23:52:21.0828 2204 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2011/08/11 23:52:22.0031 2204 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2011/08/11 23:52:22.0078 2204 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2011/08/11 23:52:22.0281 2204 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2011/08/11 23:52:22.0312 2204 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2011/08/11 23:52:22.0484 2204 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2011/08/11 23:52:22.0687 2204 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/08/11 23:52:22.0843 2204 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/08/11 23:52:22.0906 2204 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/08/11 23:52:23.0093 2204 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/08/11 23:52:23.0265 2204 BCM43XX (fbc6cc35f139fb4130e55476c2a2460c) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
2011/08/11 23:52:23.0484 2204 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/08/11 23:52:23.0593 2204 btaudio (37a82e22af9fc86c428a5f3c3851dcc1) C:\WINDOWS\system32\drivers\btaudio.sys
2011/08/11 23:52:23.0781 2204 BTDriver (2f9f111d31aa3fbbe5781d829a4524e6) C:\WINDOWS\system32\DRIVERS\btport.sys
2011/08/11 23:52:23.0890 2204 BTKRNL (9f704f40cd50ae05bbfc492c0342e765) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
2011/08/11 23:52:24.0078 2204 BTWDNDIS (485020a1e1fc5c51a800ca69c618d881) C:\WINDOWS\system32\DRIVERS\btwdndis.sys
2011/08/11 23:52:24.0140 2204 BTWUSB (1166cb501e1c34750a91600579efeab3) C:\WINDOWS\system32\Drivers\btwusb.sys
2011/08/11 23:52:24.0390 2204 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2011/08/11 23:52:24.0625 2204 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/08/11 23:52:24.0781 2204 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/08/11 23:52:24.0843 2204 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2011/08/11 23:52:25.0015 2204 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/08/11 23:52:25.0203 2204 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/08/11 23:52:25.0250 2204 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/08/11 23:52:25.0468 2204 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/08/11 23:52:25.0640 2204 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2011/08/11 23:52:25.0812 2204 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/08/11 23:52:25.0890 2204 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2011/08/11 23:52:26.0078 2204 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2011/08/11 23:52:26.0218 2204 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2011/08/11 23:52:26.0296 2204 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/08/11 23:52:26.0375 2204 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/08/11 23:52:26.0562 2204 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/08/11 23:52:26.0734 2204 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/08/11 23:52:26.0906 2204 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/08/11 23:52:26.0968 2204 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2011/08/11 23:52:27.0156 2204 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/08/11 23:52:27.0281 2204 DVMIO (8cf55015b2a443ee869c90cab31fd435) C:\SPLASH.SYS\config\dvmio.sys
2011/08/11 23:52:27.0468 2204 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/08/11 23:52:27.0531 2204 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/08/11 23:52:27.0578 2204 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/08/11 23:52:27.0625 2204 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/08/11 23:52:27.0765 2204 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/08/11 23:52:27.0953 2204 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/08/11 23:52:28.0125 2204 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/08/11 23:52:28.0312 2204 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/08/11 23:52:28.0375 2204 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/08/11 23:52:28.0546 2204 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/08/11 23:52:28.0734 2204 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/08/11 23:52:28.0781 2204 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2011/08/11 23:52:28.0968 2204 HpqKbFiltr (35956140e686d53bf676cf0c778880fc) C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys
2011/08/11 23:52:29.0046 2204 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/08/11 23:52:29.0234 2204 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/08/11 23:52:29.0281 2204 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2011/08/11 23:52:29.0437 2204 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/08/11 23:52:29.0734 2204 ialm (970cbce15d48ed19ca760e46a2538ec1) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
2011/08/11 23:52:30.0187 2204 iaStor (d483687eace0c065ee772481a96e05f5) C:\WINDOWS\system32\DRIVERS\iaStor.sys
2011/08/11 23:52:30.0296 2204 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/08/11 23:52:30.0468 2204 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2011/08/11 23:52:30.0546 2204 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/08/11 23:52:30.0718 2204 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/08/11 23:52:30.0875 2204 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/08/11 23:52:30.0921 2204 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/08/11 23:52:31.0078 2204 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/08/11 23:52:31.0265 2204 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/08/11 23:52:31.0328 2204 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/08/11 23:52:31.0500 2204 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/08/11 23:52:31.0687 2204 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/08/11 23:52:31.0750 2204 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/08/11 23:52:31.0906 2204 kcrtx86 (cbbc332b9a94d9eb16e3328b50760587) C:\WINDOWS\system32\kcrtx86.sys
2011/08/11 23:52:32.0078 2204 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/08/11 23:52:32.0265 2204 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/08/11 23:52:32.0359 2204 MBAMProtector (eca00eed9ab95489007b0ef84c7149de) C:\WINDOWS\system32\drivers\mbam.sys
2011/08/11 23:52:32.0578 2204 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/08/11 23:52:32.0750 2204 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/08/11 23:52:32.0921 2204 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/08/11 23:52:32.0968 2204 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/08/11 23:52:33.0140 2204 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/08/11 23:52:33.0296 2204 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2011/08/11 23:52:33.0343 2204 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/08/11 23:52:33.0515 2204 MRxSmb (0dc719e9b15e902346e87e9dcd5751fa) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/08/11 23:52:33.0718 2204 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/08/11 23:52:33.0796 2204 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/08/11 23:52:33.0968 2204 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/08/11 23:52:34.0000 2204 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/08/11 23:52:34.0187 2204 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/08/11 23:52:34.0265 2204 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/08/11 23:52:34.0437 2204 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/08/11 23:52:34.0609 2204 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/08/11 23:52:34.0671 2204 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/08/11 23:52:34.0859 2204 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/08/11 23:52:35.0046 2204 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/08/11 23:52:35.0218 2204 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/08/11 23:52:35.0281 2204 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/08/11 23:52:35.0437 2204 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/08/11 23:52:35.0484 2204 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/08/11 23:52:35.0671 2204 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/08/11 23:52:35.0906 2204 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/08/11 23:52:35.0968 2204 NPFW (9aba8f91057be63b1d8fa2a7048b220c) C:\WINDOWS\system32\NPFW.SYS
2011/08/11 23:52:36.0125 2204 NPFWFLT (9f48e1a0dcc32d6653d2f189fa801ab0) C:\WINDOWS\system32\NPFWFLT.SYS
2011/08/11 23:52:36.0296 2204 NPIDS (7705fd2929f4e7e0c2986590dcc7483f) C:\WINDOWS\system32\NPIDS.SYS
2011/08/11 23:52:36.0375 2204 npkcrypt (975f4d4252df1ae0cd49fabbd4dc8a6b) C:\WINDOWS\system32\npkcrypt.sys
2011/08/11 23:52:36.0562 2204 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/08/11 23:52:36.0781 2204 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/08/11 23:52:36.0937 2204 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/08/11 23:52:37.0109 2204 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/08/11 23:52:37.0312 2204 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
2011/08/11 23:52:37.0359 2204 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/08/11 23:52:37.0531 2204 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/08/11 23:52:37.0593 2204 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/08/11 23:52:37.0812 2204 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/08/11 23:52:37.0984 2204 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/08/11 23:52:38.0281 2204 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2011/08/11 23:52:38.0453 2204 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2011/08/11 23:52:38.0562 2204 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/08/11 23:52:38.0765 2204 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/08/11 23:52:38.0968 2204 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/08/11 23:52:39.0015 2204 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2011/08/11 23:52:39.0218 2204 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2011/08/11 23:52:39.0531 2204 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2011/08/11 23:52:39.0765 2204 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2011/08/11 23:52:40.0078 2204 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2011/08/11 23:52:40.0265 2204 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/08/11 23:52:40.0531 2204 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/08/11 23:52:40.0765 2204 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/08/11 23:52:41.0078 2204 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/08/11 23:52:41.0375 2204 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/08/11 23:52:41.0562 2204 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/08/11 23:52:41.0796 2204 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/08/11 23:52:42.0000 2204 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/08/11 23:52:42.0218 2204 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/08/11 23:52:42.0453 2204 RSUSBSTOR (f9541f3b59da30423f2f76ef443c07fc) C:\WINDOWS\system32\Drivers\RtsUStor.sys
2011/08/11 23:52:42.0546 2204 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
2011/08/11 23:52:42.0734 2204 RTLE8023xp (387c8f70e992efa3d25816ecc1ab2b8b) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
2011/08/11 23:52:43.0015 2204 SASDIFSV (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/08/11 23:52:43.0093 2204 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
2011/08/11 23:52:43.0312 2204 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/08/11 23:52:43.0406 2204 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
2011/08/11 23:52:43.0625 2204 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/08/11 23:52:43.0890 2204 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2011/08/11 23:52:44.0078 2204 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/08/11 23:52:44.0281 2204 SNP2UVC (30a542ab1302567c961e33a41d53a7c6) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys
2011/08/11 23:52:44.0812 2204 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2011/08/11 23:52:45.0015 2204 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/08/11 23:52:45.0359 2204 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/08/11 23:52:45.0593 2204 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/08/11 23:52:45.0828 2204 STHDA (a804878dc23e23c24620ea9de4678ee7) C:\WINDOWS\system32\drivers\sthda.sys
2011/08/11 23:52:46.0046 2204 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/08/11 23:52:46.0109 2204 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/08/11 23:52:46.0281 2204 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/08/11 23:52:46.0359 2204 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2011/08/11 23:52:46.0546 2204 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2011/08/11 23:52:46.0718 2204 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2011/08/11 23:52:46.0906 2204 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2011/08/11 23:52:47.0187 2204 SynTP (c6e720d3f5fb8290d01acfb63e14b606) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2011/08/11 23:52:47.0515 2204 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/08/11 23:52:47.0906 2204 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/08/11 23:52:48.0171 2204 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/08/11 23:52:48.0359 2204 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/08/11 23:52:48.0546 2204 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/08/11 23:52:48.0875 2204 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
2011/08/11 23:52:49.0062 2204 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/08/11 23:52:49.0125 2204 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2011/08/11 23:52:49.0343 2204 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/08/11 23:52:49.0578 2204 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys
2011/08/11 23:52:49.0718 2204 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/08/11 23:52:50.0062 2204 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/08/11 23:52:50.0375 2204 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/08/11 23:52:50.0515 2204 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/08/11 23:52:50.0656 2204 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/08/11 23:52:50.0859 2204 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/08/11 23:52:50.0937 2204 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/08/11 23:52:51.0015 2204 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2011/08/11 23:52:51.0203 2204 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/08/11 23:52:51.0265 2204 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/08/11 23:52:51.0328 2204 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/08/11 23:52:51.0515 2204 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/08/11 23:52:51.0750 2204 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/08/11 23:52:51.0968 2204 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/08/11 23:52:52.0109 2204 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/08/11 23:52:52.0234 2204 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
2011/08/11 23:52:52.0546 2204 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/08/11 23:52:52.0671 2204 MBR (0x1B8) (a00aa10c4a88fc5bbb6e341fed7b6ac3) \Device\Harddisk0\DR0
2011/08/11 23:52:52.0875 2204 MBR (0x1B8) (76f6867e4e28ed065e32dccec9b3e079) \Device\Harddisk1\DR2
2011/08/11 23:52:54.0312 2204 Boot (0x1200) (8b66bc6329267ae295215369a103d70c) \Device\Harddisk0\DR0\Partition0
2011/08/11 23:52:54.0343 2204 ================================================================================
2011/08/11 23:52:54.0343 2204 Scan finished
2011/08/11 23:52:54.0343 2204 ================================================================================
2011/08/11 23:52:54.0421 2036 Detected object count: 0
2011/08/11 23:52:54.0421 2036 Actual detected object count: 0

Heres Answr report:


23:23:32.296 OS Version: Windows 5.1.2600 Service Pack 3
23:23:32.296 Number of processors: 2 586 0x1C0A
23:23:32.296 ComputerName: PC106846666274 UserName: kenneth
23:23:35.250 Initialize success
23:23:45.078 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
23:23:45.078 Disk 0 Vendor: TOSHIBA_ FG01 Size: 152627MB BusType: 3
23:23:45.109 Disk 0 MBR read successfully
23:23:45.125 Disk 0 MBR scan
23:23:45.140 Disk 0 Windows VISTA default MBR code
23:23:45.156 Disk 0 scanning sectors +312560640
23:23:45.234 Disk 0 scanning C:\WINDOWS\system32\drivers
23:23:54.390 Service scanning
23:23:56.109 Modules scanning
23:24:18.984 Disk 0 trace - called modules:
23:24:19.046 ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys
23:24:19.062 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86b7cab8]
23:24:19.078 3 CLASSPNP.SYS[f758dfd7] -> nt!IofCallDriver -> \Device\0000006d[0x86b36190]
23:24:19.093 5 ACPI.sys[f7424620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x86b55028]
23:24:19.125 Scan finished successfully
23:25:01.546 Verifying
23:25:11.593 Disk 0 Windows 501 MBR fixed successfully
23:26:09.890 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\kenneth\Desktop\MBR.dat"
23:26:09.921 The log file has been saved successfully to "C:\Documents and Settings\kenneth\Desktop\aswMBR.txtFIXEDLOG.txt"



Last edited by Justin_mac on 12th August 2011, 3:54 am; edited 1 time in total

I just noticed that I hit "FixMbr" instead of "Fix"...is this a terrible thing?? The fix button wasnt lit up.

It's fine. The rootkit was removed.

Please download ComboFix from BleepingComputer.com

Alternate link: GeeksToGo.com

Alternate link: Forospyware.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
  
• Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

• Click on Yes, to continue scanning for malware.
  
• When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.
  

Heres the Combofix:

ComboFix 11-08-12.01 - kenneth 08/12/2011 23:08:17.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.987.676 [GMT -4:00]
Running from: c:\documents and settings\kenneth\desktop\commy.exe
Command switches used :: /stepdel
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\dayi.ime
.
.
((((((((((((((((((((((((( Files Created from 2011-07-13 to 2011-08-13 )))))))))))))))))))))))))))))))
.
.
2011-08-13 03:06 . 2011-08-13 03:06 -------- d-----w- C:\commy
2011-08-11 14:45 . 2011-08-11 14:55 -------- d-----w- C:\clambo
2011-08-11 14:43 . 2011-08-11 15:05 -------- d-----w- C:\ComboFix
2011-08-10 21:01 . 2011-08-12 03:35 -------- d-----w- c:\documents and settings\kenneth\Application Data\Media Player Classic
2011-08-10 16:00 . 2011-08-10 16:00 -------- d-----w- c:\documents and settings\kenneth\Application Data\SUPERAntiSpyware.com
2011-08-10 15:59 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\!SASCORE
2011-08-10 15:59 . 2011-08-10 16:00 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-08-10 15:59 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-09 23:56 . 2011-08-09 23:56 107520 --sha-r- c:\windows\system32\c_28605U.dll
2011-08-09 23:33 . 2011-08-10 01:43 -------- d-----w- c:\windows\system32\MpEngineStore
2011-08-09 23:24 . 2011-08-09 23:24 -------- d-----w- c:\windows\Downloaded Installations
2011-08-09 22:54 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-08-09 21:06 . 2011-08-09 21:06 -------- d-----w- c:\documents and settings\kenneth\Application Data\Malwarebytes
2011-08-09 21:05 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-09 21:05 . 2011-08-09 21:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-09 21:05 . 2011-08-09 21:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-09 21:05 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-09 20:24 . 2011-08-09 20:25 -------- d-----w- c:\program files\CCleaner
2011-08-09 14:55 . 2011-08-10 14:26 -------- d-----w- c:\documents and settings\Administrator
2011-08-09 05:53 . 2011-08-12 15:26 610286 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2011-08-06 15:50 . 2008-04-14 04:17 25856 ---ha-w- c:\windows\system32\drivers\usbprint.sys
2011-08-06 15:48 . 2008-04-14 04:15 60032 ---ha-w- c:\windows\system32\drivers\USBAUDIO.sys
2011-08-04 17:58 . 2011-08-04 17:58 -------- d-----w- c:\program files\Combined Community Codec Pack
2011-07-24 02:40 . 2011-07-24 02:40 -------- d-----w- c:\program files\Apple Software Update
2011-07-19 12:58 . 2011-07-19 12:58 -------- d-----w- c:\program files\Nikon
2011-07-19 12:58 . 2011-07-19 12:58 -------- d-----w- c:\program files\Common Files\Nikon
2011-07-19 12:58 . 2005-04-03 21:02 753664 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
2011-07-19 12:58 . 2005-04-03 21:02 69714 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
2011-07-19 12:58 . 2005-04-03 21:01 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
2011-07-19 12:58 . 2005-04-03 21:00 184320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
2011-07-19 12:58 . 2005-04-03 20:59 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2011-07-19 12:58 . 2011-07-19 12:58 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
2011-07-19 12:58 . 2011-07-19 12:58 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-03 15:41 . 2011-01-31 09:05 108736 ---ha-w- c:\windows\system32\Npfw.sys
2011-06-02 14:02 . 2010-05-02 05:22 1858944 ---ha-w- c:\windows\system32\win32k.sys
2011-06-01 12:09 . 2011-01-31 09:04 1069340 ---ha-w- c:\windows\system32\NPDownV.exe
2011-05-26 17:17 . 2011-01-31 09:05 233792 ---ha-w- c:\windows\system32\nPFW.dll
2011-05-26 12:07 . 2011-01-31 09:05 2244379 ---ha-w- c:\windows\system32\npmonz.exe
2011-05-16 13:45 . 2011-05-16 13:45 7040 ----a-w- c:\windows\system32\sabprocenum.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-11_15.20.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-13 03:20 . 2011-08-13 03:20 16384 c:\windows\temp\Perflib_Perfdata_2fc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]
@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"
[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]
@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"
[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]
@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"
[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]
@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"
[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]
@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"
[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 07:25 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-06 07:25 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2011-07-25 17:59 2585408 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-15 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-01 21:07 173592 ---ha-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP]
2009-07-13 19:54 589104 ----a-w- c:\program files\Hewlett-Packard\HP QuickSync\QuickSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-06-04 11:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-01 21:07 141336 ---ha-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
2008-04-15 04:00 44032 ---ha-w- c:\windows\ime\imkr6_1\imekrmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2008-04-15 04:00 208952 ---ha-w- c:\windows\ime\imjp8_1\imjpmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 08:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 23:52 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2011-07-06 23:52 1047656 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2008-04-15 04:00 59392 ---ha-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-01 21:07 141336 ---ha-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2008-04-15 04:00 455168 ---ha-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2008-04-15 04:00 455168 ---ha-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2009-08-20 02:46 322104 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 08:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2uvc]
2009-03-10 08:31 684032 ---ha-w- c:\windows\vsnp2uvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 07:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 05:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-07-29 01:09 4599680 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-11-03 18:57 1594664 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
2009-10-12 06:51 495708 ------w- c:\program files\IDT\WDM\sttray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WirelessAssistant]
2009-09-01 02:41 499768 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZumoDrive]
2010-05-08 18:57 1733 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
.
R1 DVMIO;DVMIO;c:\splash.sys\config\dvmio.sys [9/29/2009 6:25 AM 17624]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 12:27 PM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 5:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [7/18/2011 8:02 PM 123264]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\splash.sys\config\DVMExportService.exe [7/8/2009 7:55 AM 323584]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/9/2011 5:05 PM 366640]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [11/21/2009 12:24 PM 113664]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/9/2011 5:05 PM 22712]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [11/21/2009 12:29 PM 228408]
S3 kcrtx86;kcrtx86;c:\windows\system32\kcrtx86.sys [12/5/2010 11:13 PM 126048]
S3 NPFW;NPFW;c:\windows\system32\Npfw.sys [1/31/2011 5:05 AM 108736]
S3 NPFWFLT;NPFWFLT;c:\windows\system32\npfwflt.sys [1/31/2011 5:05 AM 82496]
S3 NPIDS;NPIDS;c:\windows\system32\npids.sys [1/31/2011 5:05 AM 61792]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [11/21/2009 12:24 PM 174592]
S3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys --> c:\windows\system32\drivers\WPRO_40_1340.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2011-08-12 c:\windows\Tasks\Windows Media Player.job
- c:\progra~1\WINDOW~3\wmplayer.exe [2008-04-15 12:00]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
Trusted Zone: fileresearchcenter.com\www
Trusted Zone: GeekPolice.net\www
Trusted Zone: majorgeeks.com
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: superantispyware.com\www
Trusted Zone: windowsupdate.com\download
DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} - hxxp://mpi.dacom.net/XMPI/js/LGTelecom_XMPI_20100420.cab
DPF: {48CF826A-BFBA-4EA3-83D3-AF765DF1B1ED} - hxxp://www.webgateinc.com/nwizard/wizard/url2/viewer/wespliveviewer.cab
DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} - hxxp://mpi.dacom.net/XPayMPI/XPayMPIOCX.cab
DPF: {967386A1-409E-431A-A93A-FB5FEFF86A58} - hxxp://bank.keb.co.kr/veraport/veraport.cab
DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
DPF: {F025D01A-28DC-4C14-8253-7F663864825F} - hxxp://211.57.102.21/ZaolmapClient.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-12 23:21
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-926436163-56185295-3562427831-1005\Software\SecuROM\License information*]
"datasecu"=hex:d8,85,4d,9c,d6,07,ac,b6,b9,ed,6b,ce,84,6f,00,67,e2,1a,37,bc,c6,
06,0a,a8,29,b4,ef,84,dc,9e,6d,4f,8e,ff,37,2e,2a,2d,7c,4f,01,04,22,70,6e,db,\
"rkeysecu"=hex:f1,f7,b4,86,a4,7d,83,2c,b1,96,b9,4a,5c,c5,db,1a
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(888)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(3512)
c:\windows\system32\WININET.dll
c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\idt\wdm\STacSV.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\npkcmsvc.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-08-12 23:28:03 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-13 03:27
ComboFix2.txt 2011-08-12 16:23
ComboFix3.txt 2011-08-11 15:55
ComboFix4.txt 2011-08-11 15:27
.
Pre-Run: 25,842,798,592 bytes free
Post-Run: 25,881,739,264 bytes free
.
- - End Of File - - B9EEEDA0F17EEB6DAA1C9136D4B42419

Hi,

Re-running ComboFix to remove infections:

1. Close any open browsers.
   
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
3. Open notepad and copy/paste the text in the quotebox below into it:
   

   
   File::
   c:\windows\system32\c_28605U.dll
   
   

4. Save this as CFScript.txt, in the same location as ComboFix.exe
   
   
   
   
5. Referring to the picture above, drag CFScript into ComboFix.exe
   
6. When finished, it shall produce a log for you at C:\ComboFix.txt
   
7. Please post the contents of the log in your next reply.

ComboFix 11-08-14.02 - kenneth 08/14/2011 11:10:55.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.987.535 [GMT -4:00]
Running from: c:\documents and settings\kenneth\Desktop\Security\commy.exe
Command switches used :: c:\documents and settings\kenneth\Desktop\Security\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\kenneth\Application Data\PriceGong
c:\documents and settings\kenneth\Application Data\PriceGong\Data\1.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\2256.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\a.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\b.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\c.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\d.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\e.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\f.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\g.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\h.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\i.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\j.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\k.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\l.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\m.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\kenneth\Application Data\PriceGong\Data\n.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\o.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\p.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\q.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\r.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\s.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\t.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\u.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\v.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\w.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\wlu.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\x.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\y.txt
c:\documents and settings\kenneth\Application Data\PriceGong\Data\z.txt
c:\windows\system32\JRSKD24.SYS
c:\windows\system32\npz.ocx
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_JRSKD24
-------\Service_JRSKD24
.
.
((((((((((((((((((((((((( Files Created from 2011-07-14 to 2011-08-14 )))))))))))))))))))))))))))))))
.
.
2011-08-14 01:38 . 2011-08-14 01:38 -------- d-----w- C:\extensions
2011-08-14 01:38 . 2011-08-14 01:38 -------- d-----w- c:\program files\Conduit
2011-08-14 01:38 . 2011-08-14 01:50 -------- d-----w- c:\documents and settings\kenneth\Local Settings\Application Data\BitTorrentBar
2011-08-14 01:38 . 2011-08-14 01:38 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-08-14 01:38 . 2011-08-14 01:49 -------- d-----w- c:\documents and settings\kenneth\Local Settings\Application Data\Conduit
2011-08-14 01:37 . 2011-08-14 01:37 -------- d-----w- c:\program files\BitTorrent
2011-08-13 15:37 . 2011-07-13 00:39 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{048A6AA9-C6D1-4A7D-814D-BC53612CBF28}\mpengine.dll
2011-08-13 15:36 . 2011-08-13 15:36 -------- d-----w- c:\program files\Microsoft Security Client
2011-08-13 15:11 . 2011-06-24 14:10 139656 ------w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-13 15:11 . 2011-07-08 14:02 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-13 15:01 . 2011-08-13 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
2011-08-13 14:51 . 2011-08-13 14:51 -------- d-----w- c:\documents and settings\kenneth\Application Data\Uniblue
2011-08-13 14:51 . 2011-08-13 14:51 -------- d-----w- c:\program files\Uniblue
2011-08-13 14:50 . 2011-08-13 14:50 -------- d-----w- c:\documents and settings\kenneth\Local Settings\Application Data\PackageAware
2011-08-13 03:06 . 2011-08-13 03:06 -------- d-----w- C:\commy
2011-08-11 14:45 . 2011-08-11 14:55 -------- d-----w- C:\clambo
2011-08-11 14:43 . 2011-08-11 15:05 -------- d-----w- C:\ComboFix
2011-08-10 21:01 . 2011-08-12 03:35 -------- d-----w- c:\documents and settings\kenneth\Application Data\Media Player Classic
2011-08-10 16:00 . 2011-08-10 16:00 -------- d-----w- c:\documents and settings\kenneth\Application Data\SUPERAntiSpyware.com
2011-08-10 15:59 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\!SASCORE
2011-08-10 15:59 . 2011-08-10 16:00 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-08-10 15:59 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-09 23:56 . 2011-08-09 23:56 107520 --sha-r- c:\windows\system32\c_28605U.dll
2011-08-09 23:33 . 2011-08-10 01:43 -------- d-----w- c:\windows\system32\MpEngineStore
2011-08-09 23:24 . 2011-08-09 23:24 -------- d-----w- c:\windows\Downloaded Installations
2011-08-09 22:54 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-08-09 21:06 . 2011-08-09 21:06 -------- d-----w- c:\documents and settings\kenneth\Application Data\Malwarebytes
2011-08-09 21:05 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-09 21:05 . 2011-08-09 21:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-09 21:05 . 2011-08-09 21:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-09 21:05 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-09 20:24 . 2011-08-09 20:25 -------- d-----w- c:\program files\CCleaner
2011-08-09 14:55 . 2011-08-10 14:26 -------- d-----w- c:\documents and settings\Administrator
2011-08-06 15:50 . 2008-04-14 04:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2011-08-06 15:48 . 2008-04-14 04:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2011-08-04 17:58 . 2011-08-04 17:58 -------- d-----w- c:\program files\Combined Community Codec Pack
2011-07-24 02:40 . 2011-07-24 02:40 -------- d-----w- c:\program files\Apple Software Update
2011-07-19 12:58 . 2011-07-19 12:58 -------- d-----w- c:\program files\Nikon
2011-07-19 12:58 . 2011-07-19 12:58 -------- d-----w- c:\program files\Common Files\Nikon
2011-07-19 12:58 . 2005-04-03 21:02 753664 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
2011-07-19 12:58 . 2005-04-03 21:02 69714 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
2011-07-19 12:58 . 2005-04-03 21:01 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
2011-07-19 12:58 . 2005-04-03 21:00 184320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
2011-07-19 12:58 . 2005-04-03 20:59 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2011-07-19 12:58 . 2011-07-19 12:58 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
2011-07-19 12:58 . 2011-07-19 12:58 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2010-05-10 02:11 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-15 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2008-04-15 12:00 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2010-06-11 07:17 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36 . 2010-06-11 07:17 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 18:36 . 2009-03-07 20:34 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 12:05 . 2009-03-07 20:35 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-15 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-03 15:41 . 2011-01-31 09:05 108736 ----a-w- c:\windows\system32\Npfw.sys
2011-06-02 14:02 . 2010-05-02 05:22 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-06-01 21:39 . 2011-01-31 09:04 1069340 ----a-w- c:\windows\system32\NPDownV.exe
2011-05-26 17:17 . 2011-01-31 09:05 233792 ----a-w- c:\windows\system32\nPFW.dll
2011-05-26 12:07 . 2011-01-31 09:05 2244379 ----a-w- c:\windows\system32\npmonz.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-11_15.20.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-14 15:23 . 2011-08-14 15:23 16384 c:\windows\temp\Perflib_Perfdata_48c.dat
+ 2009-04-11 02:06 . 2011-08-14 13:54 97170 c:\windows\system32\perfc009.dat
- 2009-03-07 20:31 . 2011-04-25 16:11 66560 c:\windows\system32\mshtmled.dll
+ 2009-03-07 20:31 . 2011-06-23 18:36 66560 c:\windows\system32\mshtmled.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 55296 c:\windows\system32\msfeedsbs.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 55296 c:\windows\system32\msfeedsbs.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 25600 c:\windows\system32\jsproxy.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 25600 c:\windows\system32\jsproxy.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 12800 c:\windows\system32\dllcache\xpshims.dll
- 2009-03-07 20:31 . 2011-04-25 16:11 66560 c:\windows\system32\dllcache\mshtmled.dll
+ 2009-03-07 20:31 . 2011-06-23 18:36 66560 c:\windows\system32\dllcache\mshtmled.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2009-03-07 20:34 . 2011-04-25 16:11 43520 c:\windows\system32\dllcache\licmgr10.dll
+ 2009-03-07 20:34 . 2011-06-23 18:36 43520 c:\windows\system32\dllcache\licmgr10.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2011-08-13 18:31 . 2011-08-13 18:31 27136 c:\windows\Installer\add744.msi
+ 2011-08-13 18:30 . 2011-08-13 18:30 22016 c:\windows\Installer\add73f.msi
+ 2009-11-21 16:45 . 2011-08-13 15:13 35088 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-11-21 16:45 . 2011-07-13 12:28 35088 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-11-21 16:45 . 2011-08-13 15:13 18704 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\mspicons.exe
- 2009-11-21 16:45 . 2011-07-13 12:28 18704 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\mspicons.exe
- 2009-11-21 16:45 . 2011-07-13 12:28 20240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\cagicon.exe
+ 2009-11-21 16:45 . 2011-08-13 15:13 20240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\cagicon.exe
+ 2011-08-13 15:12 . 2011-04-25 16:11 12800 c:\windows\ie8updates\KB2559049-IE8\xpshims.dll
+ 2011-08-13 15:12 . 2011-04-25 16:11 66560 c:\windows\ie8updates\KB2559049-IE8\mshtmled.dll
+ 2011-08-13 15:12 . 2011-04-25 16:11 55296 c:\windows\ie8updates\KB2559049-IE8\msfeedsbs.dll
+ 2011-08-13 15:12 . 2011-04-25 16:11 43520 c:\windows\ie8updates\KB2559049-IE8\licmgr10.dll
+ 2011-08-13 15:12 . 2011-04-25 16:11 25600 c:\windows\ie8updates\KB2559049-IE8\jsproxy.dll
+ 2011-08-13 17:13 . 2011-08-13 17:13 47616 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLiveWriter\47e0dd4fe04c9e5ac5191967d85d6931\WindowsLiveWriter.ni.exe
+ 2011-08-13 17:17 . 2011-08-13 17:17 99840 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\8379dc38b3fd1cbcb00b46e92b086848\WindowsLive.Writer.Api.ni.dll
+ 2011-08-13 17:28 . 2011-08-13 17:28 37888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\343c52b741531ce9ae874ea7508831a7\System.Windows.Presentation.ni.dll
+ 2011-08-13 17:27 . 2011-08-13 17:27 36864 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\246110974e3c48733458819b07464b23\System.Web.DynamicData.Design.ni.dll
+ 2011-08-13 17:19 . 2011-08-13 17:19 94208 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\ace861fe8dbf146c3e449abaa7691e9f\System.ComponentModel.DataAnnotations.ni.dll
+ 2011-08-13 15:22 . 2011-08-13 15:22 47104 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\40ee65aacd9d7472cd6f8dddbfca604b\PresentationFontCache.ni.exe
+ 2011-08-13 15:18 . 2011-08-13 15:18 39424 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\12c424eed7ee0e9c017bf72ff09eb78c\PresentationCFFRasterizer.ni.dll
+ 2011-08-13 17:25 . 2011-08-13 17:25 55296 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\f9c514544c8e23220493cd42a0e20678\Microsoft.Vsa.ni.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2009-03-07 20:34 . 2011-06-23 18:36 105984 c:\windows\system32\url.dll
- 2009-03-07 20:34 . 2009-03-07 20:34 105984 c:\windows\system32\url.dll
+ 2009-04-11 02:06 . 2011-08-14 13:54 502690 c:\windows\system32\perfh009.dat
+ 2010-06-11 07:17 . 2011-06-23 18:36 206848 c:\windows\system32\occache.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 206848 c:\windows\system32\occache.dll
- 2011-01-31 09:04 . 2010-04-21 01:50 512284 c:\windows\system32\npcopyv.exe
+ 2011-01-31 09:04 . 2010-04-21 14:50 512284 c:\windows\system32\npcopyv.exe
+ 2010-06-11 07:17 . 2011-06-23 18:36 611840 c:\windows\system32\mstime.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 611840 c:\windows\system32\mstime.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 602112 c:\windows\system32\msfeeds.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 602112 c:\windows\system32\msfeeds.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 184320 c:\windows\system32\iepeers.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 184320 c:\windows\system32\iepeers.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 387584 c:\windows\system32\iedkcs32.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 387584 c:\windows\system32\iedkcs32.dll
- 2010-06-11 07:17 . 2011-04-25 12:01 173568 c:\windows\system32\ie4uinit.exe
+ 2010-06-11 07:17 . 2011-06-23 12:05 173568 c:\windows\system32\ie4uinit.exe
+ 2011-04-18 17:18 . 2011-04-18 17:18 165648 c:\windows\system32\drivers\MpFilter.sys
+ 2010-06-18 17:45 . 2011-06-20 17:44 293376 c:\windows\system32\dllcache\winsrv.dll
- 2010-06-18 17:45 . 2011-04-26 11:07 293376 c:\windows\system32\dllcache\winsrv.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 916480 c:\windows\system32\dllcache\wininet.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 916480 c:\windows\system32\dllcache\wininet.dll
+ 2009-03-07 20:34 . 2011-06-23 18:36 105984 c:\windows\system32\dllcache\url.dll
- 2009-03-07 20:34 . 2009-03-07 20:34 105984 c:\windows\system32\dllcache\url.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 206848 c:\windows\system32\dllcache\occache.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 206848 c:\windows\system32\dllcache\occache.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 611840 c:\windows\system32\dllcache\mstime.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 611840 c:\windows\system32\dllcache\mstime.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 602112 c:\windows\system32\dllcache\msfeeds.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 602112 c:\windows\system32\dllcache\msfeeds.dll
+ 2010-05-10 02:11 . 2011-07-15 13:29 456320 c:\windows\system32\dllcache\mrxsmb.sys
- 2010-05-10 02:11 . 2011-04-29 16:19 456320 c:\windows\system32\dllcache\mrxsmb.sys
+ 2010-06-11 07:17 . 2011-06-23 18:36 247808 c:\windows\system32\dllcache\ieproxy.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 247808 c:\windows\system32\dllcache\ieproxy.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 184320 c:\windows\system32\dllcache\iepeers.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 184320 c:\windows\system32\dllcache\iepeers.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 743424 c:\windows\system32\dllcache\iedvtool.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 743424 c:\windows\system32\dllcache\iedvtool.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 387584 c:\windows\system32\dllcache\iedkcs32.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 387584 c:\windows\system32\dllcache\iedkcs32.dll
- 2010-06-11 07:17 . 2011-04-25 12:01 173568 c:\windows\system32\dllcache\ie4uinit.exe
+ 2010-06-11 07:17 . 2011-06-23 12:05 173568 c:\windows\system32\dllcache\ie4uinit.exe
+ 2011-08-14 00:07 . 2011-08-13 22:39 144824 c:\windows\pchealth\helpctr\Config\Cache\Personal_32_1033.dat
+ 2011-08-13 15:36 . 2011-08-13 15:36 785920 c:\windows\Installer\ed4ff.msi
+ 2011-08-13 15:36 . 2011-08-13 15:36 483840 c:\windows\Installer\ed4f9.msi
+ 2011-08-13 15:36 . 2011-08-13 15:36 301056 c:\windows\Installer\ed4f4.msi
+ 2009-11-21 16:45 . 2011-08-13 15:13 888080 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\wordicon.exe
- 2009-11-21 16:45 . 2011-07-13 12:28 888080 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-11-21 16:45 . 2011-08-13 15:13 272648 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pubs.exe
- 2009-11-21 16:45 . 2011-07-13 12:28 272648 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-11-21 16:45 . 2011-08-13 15:13 922384 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pptico.exe
- 2009-11-21 16:45 . 2011-07-13 12:28 922384 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pptico.exe
- 2009-11-21 16:45 . 2011-07-13 12:28 845584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-11-21 16:45 . 2011-08-13 15:13 845584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\outicon.exe
- 2009-11-21 16:45 . 2011-07-13 12:28 217864 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\misc.exe
+ 2009-11-21 16:45 . 2011-08-13 15:13 217864 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\misc.exe
+ 2011-08-13 15:12 . 2011-04-25 16:11 916480 c:\windows\ie8updates\KB2559049-IE8\wininet.dll
+ 2011-08-13 15:12 . 2009-03-07 20:34 105984 c:\windows\ie8updates\KB2559049-IE8\url.dll
+ 2011-08-13 15:12 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2559049-IE8\spuninst\updspapi.dll
+ 2011-08-13 15:12 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2559049-IE8\spuninst\spuninst.exe
+ 2011-08-13 15:12 . 2011-04-25 16:11 206848 c:\windows\ie8updates\KB2559049-IE8\occache.dll
+ 2011-08-13 15:12 . 2011-04-25 16:11 611840 c:\windows\ie8updates\KB2559049-IE8\mstime.dll
+ 2011-08-13 15:12 . 2011-04-25 16:11 602112 c:\windows\ie8updates\KB2559049-IE8\msfeeds.dll
+ 2011-08-13 15:12 . 2011-04-25 16:11 247808 c:\windows\ie8updates\KB2559049-IE8\ieproxy.dll
+ 2011-08-13 15:12 . 2011-04-25 16:11 184320 c:\windows\ie8updates\KB2559049-IE8\iepeers.dll
+ 2011-08-13 15:12 . 2011-04-25 16:11 743424 c:\windows\ie8updates\KB2559049-IE8\iedvtool.dll
+ 2011-08-13 15:12 . 2011-04-25 16:11 387584 c:\windows\ie8updates\KB2559049-IE8\iedkcs32.dll
+ 2011-08-13 15:12 . 2011-04-25 12:01 173568 c:\windows\ie8updates\KB2559049-IE8\ie4uinit.exe
- 2010-05-10 02:11 . 2011-04-29 16:19 456320 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2010-05-10 02:11 . 2011-07-15 13:29 456320 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2011-08-13 17:18 . 2011-08-13 17:18 321536 c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\cc14c69205b984edba1db26fd5e421ac\WsatConfig.ni.exe
+ 2011-08-13 17:17 . 2011-08-13 17:17 633856 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLiveLocal.Wr#\be230222afc4ac16af2745c66a9b5014\WindowsLiveLocal.WriterPlugin.ni.dll
+ 2011-08-13 17:14 . 2011-08-13 17:14 152064 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\fc0df76553f27dbe81b44e1feff6241a\WindowsLive.Writer.HtmlParser.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 258048 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\f56e04e5688b837d1da24f16c7bd23c1\WindowsLive.Writer.Mshtml.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 851968 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\ed2c16c41895f3ca9a221c54ef0afb95\WindowsLive.Writer.BlogClient.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 428032 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\b732fc4a98715dc49365641879c7cde0\WindowsLive.Writer.Localization.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 119296 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\b6a4d3bddbbafbcc633e7d09a3b3b7c0\WindowsLive.Writer.FileDestinations.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 117760 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\b2fa3d80779829ca0d29b039eba7b6c8\WindowsLive.Writer.Instrumentation.ni.dll
+ 2011-08-13 17:13 . 2011-08-13 17:13 843776 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\b1408a406bf6cedf6dabd8bb91b10933\WindowsLive.Writer.Controls.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 108544 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\a46a0c3a6f9cdd29bc9e1518ddfff1cf\WindowsLive.Writer.Passport.ni.dll
+ 2011-08-13 17:14 . 2011-08-13 17:14 174080 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\8c5e2af7f9432f5937528be8eca7e74f\WindowsLive.Writer.BrowserControl.ni.dll
+ 2011-08-13 17:14 . 2011-08-13 17:14 319488 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\6303299e64ab859f46036cfbf2426d11\WindowsLive.Writer.Interop.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 594944 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\51cf4e293cd48162a780437877102c77\WindowsLive.Writer.HtmlEditor.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 322048 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\17a0bb4a638ab04b49710aa1976adfbd\WindowsLive.Writer.SpellChecker.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 118784 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\03b22b0e79cac36b7d600f7759fcea32\WindowsLive.Writer.Extensibility.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 145920 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Client\6ccef8f8ef1459d95a24a40f6ca4e138\WindowsLive.Client.ni.dll
+ 2011-08-13 15:25 . 2011-08-13 15:25 240128 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\39ce0c9c9cc294c0ee26c4ff01522961\WindowsFormsIntegration.ni.dll
+ 2011-08-13 15:25 . 2011-08-13 15:25 447488 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\431e918aee8da919f5b9e3a5195ccf93\UIAutomationClient.ni.dll
+ 2011-08-13 17:29 . 2011-08-13 17:29 400896 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\946eefb99bc116ee68e0e7c69a5a8a5c\System.Xml.Linq.ni.dll
+ 2011-08-13 17:27 . 2011-08-13 17:27 129536 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\a82eef3128b9527dc05b3c8667e713bc\System.Web.Routing.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 202240 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\203c148c913357bfc2ae9d209101f2b3\System.Web.RegularExpressions.ni.dll
+ 2011-08-13 17:27 . 2011-08-13 17:27 859648 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\f89fe39468ea6faf71c4257c89cf3c54\System.Web.Extensions.Design.ni.dll
+ 2011-08-13 17:27 . 2011-08-13 17:27 328704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\2314ff800782dc85224e69e802a073f7\System.Web.Entity.ni.dll
+ 2011-08-13 17:27 . 2011-08-13 17:27 301056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\f690a8f5d784a5bb20f2cbaa7277eb6c\System.Web.Entity.Design.ni.dll
+ 2011-08-13 17:27 . 2011-08-13 17:27 547328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\c5c96400424b85536443623f96f64581\System.Web.DynamicData.ni.dll
+ 2011-08-13 17:26 . 2011-08-13 17:26 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\5f8e87b47465a038403e73012c6d102a\System.Web.Abstractions.ni.dll
+ 2011-08-13 17:16 . 2011-08-13 17:16 627200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\846dd505f97805f00999ee26aec9bf75\System.Transactions.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\70a1400affdc775d7c7398e036359286\System.ServiceProcess.ni.dll
+ 2011-08-13 17:14 . 2011-08-13 17:14 679936 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\de9cd25ccb24bcf8a0316756e766721f\System.Security.ni.dll
+ 2011-08-13 17:14 . 2011-08-13 17:14 311296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\21248037960cf6dfa2ce401d355bd6c9\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2011-08-13 17:16 . 2011-08-13 17:16 771584 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b7e0214a811f81e09041864081139641\System.Runtime.Remoting.ni.dll
+ 2011-08-13 17:26 . 2011-08-13 17:26 621056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\480ea914e13fe41cdd8fb542bb1f7e81\System.Net.ni.dll
+ 2011-08-13 17:25 . 2011-08-13 17:25 998400 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\6e563a58e6fc0117070d5b8fd59e4e1b\System.Management.ni.dll
+ 2011-08-13 17:25 . 2011-08-13 17:25 330752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\dc72c7581f1b3794c0ea595ba02ff7ad\System.Management.Instrumentation.ni.dll
+ 2011-08-13 17:09 . 2011-08-13 17:09 381440 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\fcf8612a210d1f76e0b37dc8467b4696\System.IO.Log.ni.dll
+ 2011-08-13 17:09 . 2011-08-13 17:09 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\ec017b5a95d02fccaefd835490ef1e14\System.IdentityModel.Selectors.ni.dll
+ 2011-08-13 17:16 . 2011-08-13 17:16 280064 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\75f452279422a7898e840ee5768c9d2e\System.EnterpriseServices.Wrapper.dll
+ 2011-08-13 17:16 . 2011-08-13 17:16 627712 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\75f452279422a7898e840ee5768c9d2e\System.EnterpriseServices.ni.dll
+ 2011-08-13 15:24 . 2011-08-13 15:24 208384 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\f7cd3d07c15366b76fe4c38d24455d6b\System.Drawing.Design.ni.dll
+ 2011-08-13 17:25 . 2011-08-13 17:25 881152 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\822c996e6ad4901219b7de399a6f78bf\System.DirectoryServices.AccountManagement.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 455680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\1ffe911e62f482e42be2c4428bd08c10\System.DirectoryServices.Protocols.ni.dll
+ 2011-08-13 17:25 . 2011-08-13 17:25 354816 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\e1c009b2c9becdb732a2ea45f32a46b8\System.Data.Services.Design.ni.dll
+ 2011-08-13 17:24 . 2011-08-13 17:24 939008 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\1defd94e1662a4478ccf2cd0b1b4e6a6\System.Data.Services.Client.ni.dll
+ 2011-08-13 17:24 . 2011-08-13 17:24 756736 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\04267c1dbdcdd8ec37e1518126767ead\System.Data.Entity.Design.ni.dll
+ 2011-08-13 17:19 . 2011-08-13 17:19 135680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\f2a6d41b3f6e26eea6dcac9298aa637b\System.Data.DataSetExtensions.ni.dll
+ 2011-08-13 17:14 . 2011-08-13 17:14 971264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\77df2cd21a5b85a1605b335aa9ad9d44\System.Configuration.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\585e68739b2a8aff61ee6b2786513245\System.Configuration.Install.ni.dll
+ 2011-08-13 17:19 . 2011-08-13 17:19 633856 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\fbf6ef12d1456058acde29f2640092fb\System.AddIn.ni.dll
+ 2011-08-13 17:18 . 2011-08-13 17:18 366080 c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\896e42071939e038008b0bbbfed1213c\SMSvcHost.ni.exe
+ 2011-08-13 17:18 . 2011-08-13 17:18 256000 c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\ca07e9cf488af1290d2340d682574a24\SMDiagnostics.ni.dll
+ 2011-08-13 17:18 . 2011-08-13 17:18 320512 c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\a5aa977dd575a6beb3a416bd480b98a7\ServiceModelReg.ni.exe
+ 2011-08-13 15:23 . 2011-08-13 15:23 224768 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\f52e48f55258d0a04fbab3a1f93752e9\PresentationFramework.Classic.ni.dll
+ 2011-08-13 15:23 . 2011-08-13 15:23 368128 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\cf812b99f587ab514afb36fa9d4c1567\PresentationFramework.Aero.ni.dll
+ 2011-08-13 15:23 . 2011-08-13 15:23 539648 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\b7795999cc67f3a6cec40f5b24005e00\PresentationFramework.Luna.ni.dll
+ 2011-08-13 15:23 . 2011-08-13 15:23 258048 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\09f5af61ea2af04eb32c04b3091ffc86\PresentationFramework.Royale.ni.dll
+ 2011-08-13 17:18 . 2011-08-13 17:18 133632 c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\2d89c7b72bc8e527b26d5b6f3b931012\MSBuild.ni.exe
+ 2011-08-13 17:18 . 2011-08-13 17:18 386560 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\39e9d172f0cf5eec30b1b67212cc032b\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2011-08-13 17:19 . 2011-08-13 17:19 144384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\f1b0ec3ccde9142e67ac681fb521ac66\Microsoft.Build.Utilities.ni.dll
+ 2011-08-13 17:19 . 2011-08-13 17:19 175104 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\9250f038410f0d6432e3ccb0b046862b\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2011-08-13 17:18 . 2011-08-13 17:18 839680 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\a4672179aba638cd78bdfe268391b47b\Microsoft.Build.Engine.ni.dll
+ 2011-08-13 17:18 . 2011-08-13 17:18 222720 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\37db660a84ee52b61a7ca55812581bbd\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2011-08-13 17:18 . 2011-08-13 17:18 410112 c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\fe9a21b94803f74697bb42b9d1fdea5b\ComSvcConfig.ni.exe
+ 2011-08-13 17:09 . 2011-08-13 17:09 842240 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\f160c8e40b60edd47ae74b0b911fece1\AspNetMMCExt.ni.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2011-06-23 15:13 . 2011-06-23 15:13 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 1212416 c:\windows\system32\urlmon.dll
+ 2010-06-11 07:17 . 2011-07-25 15:17 5969920 c:\windows\system32\mshtml.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 1991680 c:\windows\system32\iertutil.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 1991680 c:\windows\system32\iertutil.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 1212416 c:\windows\system32\dllcache\urlmon.dll
+ 2010-06-11 07:17 . 2011-07-25 15:17 5969920 c:\windows\system32\dllcache\mshtml.dll
- 2010-06-11 07:17 . 2011-04-25 16:11 1991680 c:\windows\system32\dllcache\iertutil.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 1991680 c:\windows\system32\dllcache\iertutil.dll
- 2011-01-17 23:09 . 2011-01-17 23:09 3182592 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2011-04-29 01:50 . 2011-04-29 01:50 3182592 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2011-05-02 04:06 . 2011-05-02 04:06 2705920 c:\windows\Installer\25e9f7.msp
+ 2011-07-27 11:42 . 2011-07-27 11:42 4985856 c:\windows\Installer\25e9f0.msp
+ 2009-11-21 16:45 . 2011-08-13 15:13 1172240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\xlicons.exe
- 2009-11-21 16:45 . 2011-07-13 12:28 1172240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\xlicons.exe
- 2009-11-21 16:45 . 2011-07-13 12:28 1165584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-11-21 16:45 . 2011-08-13 15:13 1165584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\accicons.exe
+ 2011-08-13 15:12 . 2011-04-25 16:11 1211904 c:\windows\ie8updates\KB2559049-IE8\urlmon.dll
+ 2011-08-13 15:12 . 2011-05-30 22:19 5964800 c:\windows\ie8updates\KB2559049-IE8\mshtml.dll
+ 2011-08-13 15:12 . 2011-04-25 16:11 1991680 c:\windows\ie8updates\KB2559049-IE8\iertutil.dll
+ 2011-08-13 17:13 . 2011-08-13 17:13 6392832 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\cc51b3dd4d9c89a2c0c1280de68948ce\WindowsLive.Writer.PostEditor.ni.dll
+ 2011-08-13 17:14 . 2011-08-13 17:14 2002432 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\95c198599047f7c9253cd76b5abd8d10\WindowsLive.Writer.CoreServices.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 1105920 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\7d8a845118aca7d541ce818b367540f8\WindowsLive.Writer.ApplicationFramework.ni.dll
+ 2011-08-13 15:18 . 2011-08-13 15:18 3325440 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\fd6e0cd6f124a6d041ef1b4c9a5f080b\WindowsBase.ni.dll
+ 2011-08-13 15:25 . 2011-08-13 15:25 1049600 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\162600dde59fbaa0c048a949158ecba3\UIAutomationClientsideProviders.ni.dll
+ 2011-08-13 15:18 . 2011-08-13 15:18 7950848 c:\windows\assembly\NativeImages_v2.0.50727_32\System\e6c79e1d71b0c9000afd7e5e439b5c54\System.ni.dll
+ 2011-08-13 15:25 . 2011-08-13 15:25 5450752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\10154dcad2d62f226af2fd4211460a4b\System.Xml.ni.dll
+ 2011-08-13 17:29 . 2011-08-13 17:29 1356288 c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\22229a30650a9afbac984e1093898b13\System.WorkflowServices.ni.dll
+ 2011-08-13 17:29 . 2011-08-13 17:29 1908224 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\4d6b3cc1fc7a4788612241af7966715a\System.Workflow.Runtime.ni.dll
+ 2011-08-13 17:28 . 2011-08-13 17:28 4514304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\e4c9853af945c9cfede19f3faf18af6e\System.Workflow.ComponentModel.ni.dll
+ 2011-08-13 17:28 . 2011-08-13 17:28 2992640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\ab4b50c7c789e46a485903365765fde8\System.Workflow.Activities.ni.dll
+ 2011-08-13 17:16 . 2011-08-13 17:16 1840640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\a2392c995b1bb6b63079091259222357\System.Web.Services.ni.dll
+ 2011-08-13 17:28 . 2011-08-13 17:28 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\3da92a0b9b8ac97e11ca8bf4df671a78\System.Web.Mobile.ni.dll
+ 2011-08-13 17:27 . 2011-08-13 17:27 2405376 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\01f4d6aa3299a41b8578b7e96afdcfb1\System.Web.Extensions.ni.dll
+ 2011-08-13 15:24 . 2011-08-13 15:24 1917952 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\e1208f0d981c420fc59f806bfbaa713b\System.Speech.ni.dll
+ 2011-08-13 17:26 . 2011-08-13 17:26 1706496 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\27e1b8dfd5e1ccf2c5b9efc51f674c69\System.ServiceModel.Web.ni.dll
+ 2011-08-13 17:10 . 2011-08-13 17:10 2345472 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\dece01bd9e9c32e47630fdfc78d3bd32\System.Runtime.Serialization.ni.dll
+ 2011-08-13 15:24 . 2011-08-13 15:24 1035776 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\90b444d02047ef27921153d46967ef0e\System.Printing.ni.dll
+ 2011-08-13 17:09 . 2011-08-13 17:09 1070080 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\a50e2fc92db32751857fb8d297f9d7bc\System.IdentityModel.ni.dll
+ 2011-08-13 15:24 . 2011-08-13 15:24 1587200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\7ed09623172a292eaee51e2e3bcaf784\System.Drawing.ni.dll
+ 2011-08-13 17:16 . 2011-08-13 17:16 1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\259ecf480769f4e60514b7ae2abaa6f1\System.DirectoryServices.ni.dll
+ 2011-08-13 17:14 . 2011-08-13 17:14 1801216 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\71cf3eb40fc38e6ac8fba09e872d2878\System.Deployment.ni.dll
+ 2011-08-13 15:24 . 2011-08-13 15:24 6616576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\db2d84e279807592a680ef4135e9fe9a\System.Data.ni.dll
+ 2011-08-13 17:14 . 2011-08-13 17:14 2510336 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\0b16305773369cf740c6a2b1f1d785b2\System.Data.SqlXml.ni.dll
+ 2011-08-13 17:24 . 2011-08-13 17:24 1328128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\c1b9b8ce390548dcca661a5e6a908408\System.Data.Services.ni.dll
+ 2011-08-13 17:17 . 2011-08-13 17:17 1115136 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\c729750d54f6e7427230622bcccd4709\System.Data.OracleClient.ni.dll
+ 2011-08-13 15:24 . 2011-08-13 15:24 2516480 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\571af34939797a7c1cd05b0b925a45bf\System.Data.Linq.ni.dll
+ 2011-08-13 17:24 . 2011-08-13 17:24 9924096 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\2b58cc071d6bf0c741e91f86c09de5d7\System.Data.Entity.ni.dll
+ 2011-08-13 15:23 . 2011-08-13 15:23 2295296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\e54e013315849f5e34d8f2a8e7fdb450\System.Core.ni.dll
+ 2011-08-13 15:23 . 2011-08-13 15:23 2128896 c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\24ab0cacc77e8696ceff3157942a2de4\ReachFramework.ni.dll
+ 2011-08-13 15:23 . 2011-08-13 15:23 1657856 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\fac1ca86f4fea17de40d7fdaba38563e\PresentationUI.ni.dll
+ 2011-08-13 15:18 . 2011-08-13 15:18 1451008 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\b187becbc388c4ce7f33ede4da76e7b1\PresentationBuildTasks.ni.dll
+ 2011-08-13 17:19 . 2011-08-13 17:19 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\c6b19db2534042d435ede580f92bc75c\Microsoft.VisualBasic.ni.dll
+ 2011-08-13 17:18 . 2011-08-13 17:18 1093120 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\08594c4ba9ea0253a836fe1d8d341984\Microsoft.Transactions.Bridge.ni.dll
+ 2011-08-13 17:25 . 2011-08-13 17:25 2332160 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\345abd035c9378667b1cac54c1f21c97\Microsoft.JScript.ni.dll
+ 2011-08-13 17:19 . 2011-08-13 17:19 1966080 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\906cd5555b79e4e0486dc8ef2a748b13\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2011-08-13 17:19 . 2011-08-13 17:19 1620992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\7baff7d694394aaba490082c88d48fd2\Microsoft.Build.Tasks.ni.dll
+ 2011-08-13 17:18 . 2011-08-13 17:18 1888768 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\235a22e1ae9742bb724d411629dd99d5\Microsoft.Build.Engine.ni.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 3182592 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 3182592 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2011-06-23 15:13 . 2011-06-23 15:13 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2011-06-23 15:13 . 2011-06-23 15:13 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2011-08-13 15:16 . 2011-08-13 15:16 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2011-06-23 15:14 . 2011-06-23 15:14 4550656 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2011-08-13 15:17 . 2011-08-13 15:17 4550656 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 11081728 c:\windows\system32\ieframe.dll
- 2010-06-11 07:17 . 2011-04-26 04:41 11081728 c:\windows\system32\ieframe.dll
- 2010-06-11 07:17 . 2011-04-26 04:41 11081728 c:\windows\system32\dllcache\ieframe.dll
+ 2010-06-11 07:17 . 2011-06-23 18:36 11081728 c:\windows\system32\dllcache\ieframe.dll
+ 2011-08-13 15:12 . 2011-04-26 04:41 11081728 c:\windows\ie8updates\KB2559049-IE8\ieframe.dll
+ 2011-08-13 15:25 . 2011-08-13 15:25 12430848 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d00cc387e462e4c3cdcd112b137cac87\System.Windows.Forms.ni.dll
+ 2011-08-13 17:16 . 2011-08-13 17:16 11800576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\40893760431f8f0dcce3e18630e45b23\System.Web.ni.dll
+ 2011-08-13 17:12 . 2011-08-13 17:12 17403904 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\e3a0205acab2215fbad7927d9d483aeb\System.ServiceModel.ni.dll
+ 2011-08-13 15:24 . 2011-08-13 15:24 10683392 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\63ad0cd9b5e038c8e2e41415657db8fc\System.Design.ni.dll
+ 2011-08-13 15:23 . 2011-08-13 15:23 14328320 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\704556e34128441ea9f1a81cc89f8a79\PresentationFramework.ni.dll
+ 2011-08-13 15:22 . 2011-08-13 15:22 12215808 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\5f332c48d03eca57419c4f0e884092ee\PresentationCore.ni.dll
.
-- Snapshot reset to current date --
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBitT.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-03-28 16:22 176936 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
2011-03-28 16:22 176936 ----a-w- c:\program files\BitTorrentBar\prxtbBitT.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "c:\program files\BitTorrentBar\prxtbBitT.dll" [2011-03-28 176936]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{88C7F2AA-F93F-432C-8F0E-B7D85967A527}"= "c:\program files\BitTorrentBar\prxtbBitT.dll" [2011-03-28 176936]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]
@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"
[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]
@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"
[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]
@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"
[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]
@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"
[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]
@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"
[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent"="c:\program files\BitTorrent\BitTorrent.exe" [2011-08-14 402808]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\C:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 07:25 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-06 07:25 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2011-07-25 17:59 2585408 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-15 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-01 21:07 173592 ----a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP]
2009-07-13 19:54 589104 ----a-w- c:\program files\Hewlett-Packard\HP QuickSync\QuickSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-06-04 11:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-01 21:07 141336 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
2008-04-15 04:00 44032 ----a-w- c:\windows\ime\imkr6_1\imekrmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2008-04-15 04:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 08:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 23:52 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2011-07-06 23:52 1047656 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2008-04-15 04:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-01 21:07 141336 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2008-04-15 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2008-04-15 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2009-08-20 02:46 322104 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 08:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2uvc]
2009-03-10 08:31 684032 ----a-w- c:\windows\vsnp2uvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 07:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 05:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-07-29 01:09 4599680 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-11-03 18:57 1594664 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
2009-10-12 06:51 495708 ------w- c:\program files\IDT\WDM\sttray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WirelessAssistant]
2009-09-01 02:41 499768 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZumoDrive]
2010-05-08 18:57 1733 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
.
R1 DVMIO;DVMIO;c:\splash.sys\config\dvmio.sys [9/29/2009 6:25 AM 17624]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 12:27 PM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 5:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [7/18/2011 8:02 PM 123264]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\splash.sys\config\DVMExportService.exe [7/8/2009 7:55 AM 323584]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/9/2011 5:05 PM 366640]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [11/21/2009 12:24 PM 113664]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/9/2011 5:05 PM 22712]
S1 MpKsl4d2eedcc;MpKsl4d2eedcc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{048A6AA9-C6D1-4A7D-814D-BC53612CBF28}\MpKsl4d2eedcc.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{048A6AA9-C6D1-4A7D-814D-BC53612CBF28}\MpKsl4d2eedcc.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/13/2011 2:30 PM 136176]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [11/21/2009 12:29 PM 228408]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8/13/2011 2:30 PM 136176]
S3 kcrtx86;kcrtx86;c:\windows\system32\kcrtx86.sys [12/5/2010 11:13 PM 126048]
S3 NPFW;NPFW;c:\windows\system32\Npfw.sys [1/31/2011 5:05 AM 108736]
S3 NPFWFLT;NPFWFLT;c:\windows\system32\npfwflt.sys [1/31/2011 5:05 AM 82496]
S3 NPIDS;NPIDS;c:\windows\system32\npids.sys [1/31/2011 5:05 AM 61792]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [11/21/2009 12:24 PM 174592]
S3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys --> c:\windows\system32\drivers\WPRO_40_1340.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2011-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-13 18:29]
.
2011-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-13 18:29]
.
2011-08-14 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2011-08-14 c:\windows\Tasks\Windows Media Player.job
- c:\progra~1\WINDOW~3\wmplayer.exe [2008-04-15 12:00]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
Trusted Zone: fileresearchcenter.com\www
Trusted Zone: GeekPolice.net\www
Trusted Zone: majorgeeks.com
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: superantispyware.com\www
Trusted Zone: windowsupdate.com\download
Trusted Zone: yahoo.com\login
TCP: DhcpNameServer = 192.168.2.1
DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} - hxxp://mpi.dacom.net/XMPI/js/LGTelecom_XMPI_20100420.cab
DPF: {48CF826A-BFBA-4EA3-83D3-AF765DF1B1ED} - hxxp://www.webgateinc.com/nwizard/wizard/url2/viewer/wespliveviewer.cab
DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} - hxxp://mpi.dacom.net/XPayMPI/XPayMPIOCX.cab
DPF: {967386A1-409E-431A-A93A-FB5FEFF86A58} - hxxp://bank.keb.co.kr/veraport/veraport.cab
DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
DPF: {F025D01A-28DC-4C14-8253-7F663864825F} - hxxp://211.57.102.21/ZaolmapClient.cab
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}\bm_installer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-14 11:23
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-926436163-56185295-3562427831-1005\Software\SecuROM\License information*]
"datasecu"=hex:d8,85,4d,9c,d6,07,ac,b6,b9,ed,6b,ce,84,6f,00,67,e2,1a,37,bc,c6,
06,0a,a8,29,b4,ef,84,dc,9e,6d,4f,8e,ff,37,2e,2a,2d,7c,4f,01,04,22,70,6e,db,\
"rkeysecu"=hex:f1,f7,b4,86,a4,7d,83,2c,b1,96,b9,4a,5c,c5,db,1a
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(904)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(1780)
c:\windows\system32\WININET.dll
c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\idt\wdm\STacSV.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\npkcmsvc.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-08-14 11:29:20 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-14 15:29
ComboFix2.txt 2011-08-13 03:28
ComboFix3.txt 2011-08-12 16:23
ComboFix4.txt 2011-08-11 15:55
ComboFix5.txt 2011-08-14 15:09
.
Pre-Run: 25,460,928,512 bytes free
Post-Run: 25,532,878,848 bytes free
.
- - End Of File - - 17DCF77C8B76E207AA5EE20E63696101

Hi,

Why did you install Bit torrent today?

Hello, my girlfriend put it on, its off and here is a new report. Thanks!!

ComboFix 11-08-15.08 - kenneth 08/15/2011 19:29:24.7.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.987.507 [GMT -4:00]
Running from: c:\documents and settings\kenneth\Desktop\Security\commy.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((( Files Created from 2011-07-15 to 2011-08-15 )))))))))))))))))))))))))))))))
.
.
2011-08-15 17:16 . 2011-08-15 17:16 -------- d-----w- c:\documents and settings\kenneth\Tracing
2011-08-15 17:10 . 2011-08-15 17:10 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A7A86F68-F018-4936-AFD7-63BC3565756C}\MpKsl81017479.sys
2011-08-15 17:09 . 2011-07-13 00:39 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A7A86F68-F018-4936-AFD7-63BC3565756C}\mpengine.dll
2011-08-14 16:12 . 2011-07-13 00:39 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-08-14 01:38 . 2011-08-14 01:38 -------- d-----w- C:\extensions
2011-08-14 01:38 . 2011-08-14 01:38 -------- d-----w- c:\program files\Conduit
2011-08-14 01:38 . 2011-08-15 23:24 -------- d-----w- c:\documents and settings\kenneth\Local Settings\Application Data\BitTorrentBar
2011-08-14 01:38 . 2011-08-14 01:38 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-08-14 01:38 . 2011-08-15 23:24 -------- d-----w- c:\documents and settings\kenneth\Local Settings\Application Data\Conduit
2011-08-14 01:38 . 2011-08-15 23:24 -------- d-----w- c:\program files\BitTorrentBar
2011-08-13 15:36 . 2011-08-13 15:36 -------- d-----w- c:\program files\Microsoft Security Client
2011-08-13 15:11 . 2011-06-24 14:10 139656 ------w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-13 15:11 . 2011-07-08 14:02 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-13 15:01 . 2011-08-13 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
2011-08-13 14:51 . 2011-08-13 14:51 -------- d-----w- c:\documents and settings\kenneth\Application Data\Uniblue
2011-08-13 14:51 . 2011-08-13 14:51 -------- d-----w- c:\program files\Uniblue
2011-08-13 14:50 . 2011-08-13 14:50 -------- d-----w- c:\documents and settings\kenneth\Local Settings\Application Data\PackageAware
2011-08-13 03:06 . 2011-08-13 03:06 -------- d-----w- C:\commy
2011-08-11 14:45 . 2011-08-11 14:55 -------- d-----w- C:\clambo
2011-08-11 14:43 . 2011-08-11 15:05 -------- d-----w- C:\ComboFix
2011-08-10 21:01 . 2011-08-12 03:35 -------- d-----w- c:\documents and settings\kenneth\Application Data\Media Player Classic
2011-08-10 16:00 . 2011-08-10 16:00 -------- d-----w- c:\documents and settings\kenneth\Application Data\SUPERAntiSpyware.com
2011-08-10 15:59 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\!SASCORE
2011-08-10 15:59 . 2011-08-10 16:00 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-08-10 15:59 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-09 23:56 . 2011-08-09 23:56 107520 --sha-r- c:\windows\system32\c_28605U.dll
2011-08-09 23:33 . 2011-08-10 01:43 -------- d-----w- c:\windows\system32\MpEngineStore
2011-08-09 23:24 . 2011-08-09 23:24 -------- d-----w- c:\windows\Downloaded Installations
2011-08-09 22:54 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-08-09 21:06 . 2011-08-09 21:06 -------- d-----w- c:\documents and settings\kenneth\Application Data\Malwarebytes
2011-08-09 21:05 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-09 21:05 . 2011-08-09 21:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-09 21:05 . 2011-08-09 21:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-09 21:05 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-09 20:24 . 2011-08-09 20:25 -------- d-----w- c:\program files\CCleaner
2011-08-09 14:55 . 2011-08-10 14:26 -------- d-----w- c:\documents and settings\Administrator
2011-08-06 15:50 . 2008-04-14 04:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2011-08-06 15:48 . 2008-04-14 04:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2011-08-04 17:58 . 2011-08-04 17:58 -------- d-----w- c:\program files\Combined Community Codec Pack
2011-07-24 02:40 . 2011-07-24 02:40 -------- d-----w- c:\program files\Apple Software Update
2011-07-19 12:58 . 2011-07-19 12:58 -------- d-----w- c:\program files\Nikon
2011-07-19 12:58 . 2011-07-19 12:58 -------- d-----w- c:\program files\Common Files\Nikon
2011-07-19 12:58 . 2005-04-03 21:02 753664 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
2011-07-19 12:58 . 2005-04-03 21:02 69714 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
2011-07-19 12:58 . 2005-04-03 21:01 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
2011-07-19 12:58 . 2005-04-03 21:00 184320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
2011-07-19 12:58 . 2005-04-03 20:59 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2011-07-19 12:58 . 2011-07-19 12:58 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
2011-07-19 12:58 . 2011-07-19 12:58 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2010-05-10 02:11 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-15 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2008-04-15 12:00 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2010-06-11 07:17 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36 . 2010-06-11 07:17 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 18:36 . 2009-03-07 20:34 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 12:05 . 2009-03-07 20:35 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-15 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-03 15:41 . 2011-01-31 09:05 108736 ----a-w- c:\windows\system32\Npfw.sys
2011-06-02 14:02 . 2010-05-02 05:22 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-06-01 21:39 . 2011-01-31 09:04 1069340 ----a-w- c:\windows\system32\NPDownV.exe
2011-05-26 17:17 . 2011-01-31 09:05 233792 ----a-w- c:\windows\system32\nPFW.dll
2011-05-26 12:07 . 2011-01-31 09:05 2244379 ----a-w- c:\windows\system32\npmonz.exe
.
.
((((((((((((((((((((((((((((( SnapShot_2011-08-14_15.23.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-15 15:12 . 2011-08-15 15:12 16384 c:\windows\temp\Perflib_Perfdata_624.dat
+ 2009-04-11 02:06 . 2011-08-15 15:17 97170 c:\windows\system32\perfc009.dat
- 2009-04-11 02:06 . 2011-08-14 13:54 97170 c:\windows\system32\perfc009.dat
+ 2009-04-11 02:06 . 2011-08-15 15:17 502690 c:\windows\system32\perfh009.dat
- 2009-04-11 02:06 . 2011-08-14 13:54 502690 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]
@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"
[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]
@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"
[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]
@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"
[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]
@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"
[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]
@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"
[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\C:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 07:25 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-06 07:25 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2011-07-25 17:59 2585408 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-15 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-01 21:07 173592 ----a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP]
2009-07-13 19:54 589104 ----a-w- c:\program files\Hewlett-Packard\HP QuickSync\QuickSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-06-04 11:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-01 21:07 141336 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
2008-04-15 04:00 44032 ----a-w- c:\windows\ime\imkr6_1\imekrmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2008-04-15 04:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 08:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 23:52 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2011-07-06 23:52 1047656 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2008-04-15 04:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-01 21:07 141336 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2008-04-15 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2008-04-15 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2009-08-20 02:46 322104 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 08:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2uvc]
2009-03-10 08:31 684032 ----a-w- c:\windows\vsnp2uvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 07:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 05:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-07-29 01:09 4599680 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-11-03 18:57 1594664 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
2009-10-12 06:51 495708 ------w- c:\program files\IDT\WDM\sttray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WirelessAssistant]
2009-09-01 02:41 499768 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZumoDrive]
2010-05-08 18:57 1733 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
.
R1 DVMIO;DVMIO;c:\splash.sys\config\dvmio.sys [9/29/2009 6:25 AM 17624]
R1 MpKsl81017479;MpKsl81017479;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A7A86F68-F018-4936-AFD7-63BC3565756C}\MpKsl81017479.sys [8/15/2011 1:10 PM 28752]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 12:27 PM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 5:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [7/18/2011 8:02 PM 123264]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\splash.sys\config\DVMExportService.exe [7/8/2009 7:55 AM 323584]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/9/2011 5:05 PM 366640]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [11/21/2009 12:24 PM 113664]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/9/2011 5:05 PM 22712]
S1 MpKsl4d2eedcc;MpKsl4d2eedcc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{048A6AA9-C6D1-4A7D-814D-BC53612CBF28}\MpKsl4d2eedcc.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{048A6AA9-C6D1-4A7D-814D-BC53612CBF28}\MpKsl4d2eedcc.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/13/2011 2:30 PM 136176]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [11/21/2009 12:29 PM 228408]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8/13/2011 2:30 PM 136176]
S3 kcrtx86;kcrtx86;c:\windows\system32\kcrtx86.sys [12/5/2010 11:13 PM 126048]
S3 NPFW;NPFW;c:\windows\system32\Npfw.sys [1/31/2011 5:05 AM 108736]
S3 NPFWFLT;NPFWFLT;c:\windows\system32\npfwflt.sys [1/31/2011 5:05 AM 82496]
S3 NPIDS;NPIDS;c:\windows\system32\npids.sys [1/31/2011 5:05 AM 61792]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [11/21/2009 12:24 PM 174592]
S3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys --> c:\windows\system32\drivers\WPRO_40_1340.sys [?]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSL81017479
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2011-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-13 18:29]
.
2011-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-13 18:29]
.
2011-08-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2011-08-15 c:\windows\Tasks\Windows Media Player.job
- c:\progra~1\WINDOW~3\wmplayer.exe [2008-04-15 12:00]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
Trusted Zone: fileresearchcenter.com\www
Trusted Zone: GeekPolice.net\www
Trusted Zone: majorgeeks.com
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: superantispyware.com\www
Trusted Zone: windowsupdate.com\download
Trusted Zone: yahoo.com\login
TCP: DhcpNameServer = 192.168.2.1
DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} - hxxp://mpi.dacom.net/XMPI/js/LGTelecom_XMPI_20100420.cab
DPF: {48CF826A-BFBA-4EA3-83D3-AF765DF1B1ED} - hxxp://www.webgateinc.com/nwizard/wizard/url2/viewer/wespliveviewer.cab
DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} - hxxp://mpi.dacom.net/XPayMPI/XPayMPIOCX.cab
DPF: {967386A1-409E-431A-A93A-FB5FEFF86A58} - hxxp://bank.keb.co.kr/veraport/veraport.cab
DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
DPF: {F025D01A-28DC-4C14-8253-7F663864825F} - hxxp://211.57.102.21/ZaolmapClient.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-15 19:38
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-926436163-56185295-3562427831-1005\Software\SecuROM\License information*]
"datasecu"=hex:d8,85,4d,9c,d6,07,ac,b6,b9,ed,6b,ce,84,6f,00,67,e2,1a,37,bc,c6,
06,0a,a8,29,b4,ef,84,dc,9e,6d,4f,8e,ff,37,2e,2a,2d,7c,4f,01,04,22,70,6e,db,\
"rkeysecu"=hex:f1,f7,b4,86,a4,7d,83,2c,b1,96,b9,4a,5c,c5,db,1a
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(896)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(2016)
c:\windows\system32\WININET.dll
c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2011-08-15 19:42:05
ComboFix-quarantined-files.txt 2011-08-15 23:42
ComboFix2.txt 2011-08-15 15:18
ComboFix3.txt 2011-08-14 15:29
ComboFix4.txt 2011-08-13 03:28
ComboFix5.txt 2011-08-15 23:28
.
Pre-Run: 27,137,822,720 bytes free
Post-Run: 27,139,067,904 bytes free
.
- - End Of File - - 829354ED96A11CF17578243F6FA94C9C

Hi,
Re-running ComboFix to remove infections:

1. Close any open browsers.
   
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
3. Open notepad and copy/paste the text in the quotebox below into it:
   

   
   Folder::
   c:\program files\Conduit
   c:\documents and settings\kenneth\Local Settings\Application Data\BitTorrentBar
   c:\documents and settings\kenneth\Local Settings\Application Data\Conduit
   c:\program files\BitTorrentBar
   
   File::
   c:\windows\system32\ConduitEngine.tmp
   c:\windows\system32\c_28605U.dll
   
   DDS::
   DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} - hxxp://mpi.dacom.net/XMPI/js/LGTelecom_XMPI_20100420.cab
   DPF: {48CF826A-BFBA-4EA3-83D3-AF765DF1B1ED} - hxxp://www.webgateinc.com/nwizard/wizard/url2/viewer/wespliveviewer.cab
   DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} - hxxp://mpi.dacom.net/XPayMPI/XPayMPIOCX.cab
   DPF: {967386A1-409E-431A-A93A-FB5FEFF86A58} - hxxp://bank.keb.co.kr/veraport/veraport.cab
   DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
   DPF: {F025D01A-28DC-4C14-8253-7F663864825F} - hxxp://211.57.102.21/ZaolmapClient.cab
   
   

4. Save this as CFScript.txt, in the same location as ComboFix.exe
   
   
   
   
5. Referring to the picture above, drag CFScript into ComboFix.exe
   
6. When finished, it shall produce a log for you at C:\ComboFix.txt
   
7. Please post the contents of the log in your next reply.

ComboFix 11-08-15.08 - kenneth 08/15/2011 22:55:50.8.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.987.636 [GMT -4:00]
Running from: c:\documents and settings\kenneth\Desktop\Security\commy.exe
Command switches used :: c:\documents and settings\kenneth\Desktop\Security\CFScript.txt,2.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\windows\system32\c_28605U.dll"
"c:\windows\system32\ConduitEngine.tmp"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\kenneth\Local Settings\Application Data\BitTorrentBar
c:\documents and settings\kenneth\Local Settings\Application Data\BitTorrentBar\ldrtbBitT.dll
c:\documents and settings\kenneth\Local Settings\Application Data\BitTorrentBar\tbBitT.dll
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\AppNotification.js
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\close.png
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\like.png
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next.png
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next_hover.png
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\powered-by.png
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev.png
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev_hover.png
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\settings.png
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Thumbs.db
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\initialNotification.html
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\main.html
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyle.css
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyleIE9.css
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\sampleNotification.html
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\DialogsAPI.js
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\PIE.htc
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\settings.js
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\version.txt
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\DynamicDialogs.zip
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_1182482_1178159_CA.xml
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_909619_905414_CA.xml
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Community Alerts\LanguagePacks\en.xml
c:\documents and settings\kenneth\Local Settings\Application Data\Conduit\Toolbar\Facebook\http___facebook_conduit-services_com_Settings_ashx_locale=en&browserType=IE&toolbarVersion=6_3_5_3.xml
c:\program files\BitTorrentBar
c:\program files\BitTorrentBar\prxtbBitT.dll
c:\program files\Conduit
c:\program files\Conduit\Community Alerts\Alert0.dll
c:\windows\system32\c_28605U.dll
c:\windows\system32\ConduitEngine.tmp
.
Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\ERDNT\cache\userinit.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-07-16 to 2011-08-16 )))))))))))))))))))))))))))))))
.
.
2011-08-15 23:52 . 2011-07-13 00:39 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{36FD5E77-7BAA-4A40-9912-04A8CB78AEC0}\mpengine.dll
2011-08-15 17:16 . 2011-08-15 17:16 -------- d-----w- c:\documents and settings\kenneth\Tracing
2011-08-14 16:12 . 2011-07-13 00:39 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-08-14 01:38 . 2011-08-14 01:38 -------- d-----w- C:\extensions
2011-08-13 15:36 . 2011-08-13 15:36 -------- d-----w- c:\program files\Microsoft Security Client
2011-08-13 15:11 . 2011-06-24 14:10 139656 ------w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-13 15:11 . 2011-07-08 14:02 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-13 15:01 . 2011-08-13 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
2011-08-13 14:51 . 2011-08-13 14:51 -------- d-----w- c:\documents and settings\kenneth\Application Data\Uniblue
2011-08-13 14:51 . 2011-08-13 14:51 -------- d-----w- c:\program files\Uniblue
2011-08-13 14:50 . 2011-08-13 14:50 -------- d-----w- c:\documents and settings\kenneth\Local Settings\Application Data\PackageAware
2011-08-13 03:06 . 2011-08-13 03:06 -------- d-----w- C:\commy
2011-08-11 14:45 . 2011-08-11 14:55 -------- d-----w- C:\clambo
2011-08-11 14:43 . 2011-08-11 15:05 -------- d-----w- C:\ComboFix
2011-08-10 21:01 . 2011-08-12 03:35 -------- d-----w- c:\documents and settings\kenneth\Application Data\Media Player Classic
2011-08-10 16:00 . 2011-08-10 16:00 -------- d-----w- c:\documents and settings\kenneth\Application Data\SUPERAntiSpyware.com
2011-08-10 15:59 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\!SASCORE
2011-08-10 15:59 . 2011-08-10 16:00 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-08-10 15:59 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-09 23:33 . 2011-08-10 01:43 -------- d-----w- c:\windows\system32\MpEngineStore
2011-08-09 23:24 . 2011-08-09 23:24 -------- d-----w- c:\windows\Downloaded Installations
2011-08-09 22:54 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-08-09 21:06 . 2011-08-09 21:06 -------- d-----w- c:\documents and settings\kenneth\Application Data\Malwarebytes
2011-08-09 21:05 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-09 21:05 . 2011-08-09 21:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-09 21:05 . 2011-08-09 21:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-09 21:05 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-09 20:24 . 2011-08-09 20:25 -------- d-----w- c:\program files\CCleaner
2011-08-09 14:55 . 2011-08-10 14:26 -------- d-----w- c:\documents and settings\Administrator
2011-08-06 15:50 . 2008-04-14 04:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2011-08-06 15:48 . 2008-04-14 04:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2011-08-04 17:58 . 2011-08-04 17:58 -------- d-----w- c:\program files\Combined Community Codec Pack
2011-07-24 02:40 . 2011-07-24 02:40 -------- d-----w- c:\program files\Apple Software Update
2011-07-19 12:58 . 2011-07-19 12:58 -------- d-----w- c:\program files\Nikon
2011-07-19 12:58 . 2011-07-19 12:58 -------- d-----w- c:\program files\Common Files\Nikon
2011-07-19 12:58 . 2005-04-03 21:02 753664 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
2011-07-19 12:58 . 2005-04-03 21:02 69714 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
2011-07-19 12:58 . 2005-04-03 21:01 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
2011-07-19 12:58 . 2005-04-03 21:00 184320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
2011-07-19 12:58 . 2005-04-03 20:59 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2011-07-19 12:58 . 2011-07-19 12:58 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
2011-07-19 12:58 . 2011-07-19 12:58 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2010-05-10 02:11 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-15 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2008-04-15 12:00 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2010-06-11 07:17 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36 . 2010-06-11 07:17 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 18:36 . 2009-03-07 20:34 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 12:05 . 2009-03-07 20:35 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-15 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-03 15:41 . 2011-01-31 09:05 108736 ----a-w- c:\windows\system32\Npfw.sys
2011-06-02 14:02 . 2010-05-02 05:22 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-06-01 21:39 . 2011-01-31 09:04 1069340 ----a-w- c:\windows\system32\NPDownV.exe
2011-05-26 17:17 . 2011-01-31 09:05 233792 ----a-w- c:\windows\system32\nPFW.dll
2011-05-26 12:07 . 2011-01-31 09:05 2244379 ----a-w- c:\windows\system32\npmonz.exe
.
.
((((((((((((((((((((((((((((( SnapShot_2011-08-14_15.23.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-16 03:07 . 2011-08-16 03:07 16384 c:\windows\temp\Perflib_Perfdata_60c.dat
+ 2009-04-11 02:06 . 2011-08-15 15:17 97170 c:\windows\system32\perfc009.dat
- 2009-04-11 02:06 . 2011-08-14 13:54 97170 c:\windows\system32\perfc009.dat
+ 2009-04-11 02:06 . 2011-08-15 15:17 502690 c:\windows\system32\perfh009.dat
- 2009-04-11 02:06 . 2011-08-14 13:54 502690 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]
@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"
[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]
@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"
[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]
@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"
[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]
@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"
[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]
@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"
[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\C:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 07:25 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-06 07:25 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2011-07-25 17:59 2585408 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-15 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-01 21:07 173592 ----a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP]
2009-07-13 19:54 589104 ----a-w- c:\program files\Hewlett-Packard\HP QuickSync\QuickSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-06-04 11:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-01 21:07 141336 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
2008-04-15 04:00 44032 ----a-w- c:\windows\ime\imkr6_1\imekrmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2008-04-15 04:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 08:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 23:52 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2011-07-06 23:52 1047656 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2008-04-15 04:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-01 21:07 141336 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2008-04-15 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2008-04-15 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2009-08-20 02:46 322104 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 08:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2uvc]
2009-03-10 08:31 684032 ----a-w- c:\windows\vsnp2uvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 07:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 05:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-07-29 01:09 4599680 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-11-03 18:57 1594664 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
2009-10-12 06:51 495708 ------w- c:\program files\IDT\WDM\sttray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WirelessAssistant]
2009-09-01 02:41 499768 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZumoDrive]
2010-05-08 18:57 1733 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
.
R1 DVMIO;DVMIO;c:\splash.sys\config\dvmio.sys [9/29/2009 6:25 AM 17624]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 12:27 PM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 5:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [7/18/2011 8:02 PM 123264]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\splash.sys\config\DVMExportService.exe [7/8/2009 7:55 AM 323584]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/9/2011 5:05 PM 366640]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [11/21/2009 12:24 PM 113664]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/9/2011 5:05 PM 22712]
S1 MpKsl4d2eedcc;MpKsl4d2eedcc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{048A6AA9-C6D1-4A7D-814D-BC53612CBF28}\MpKsl4d2eedcc.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{048A6AA9-C6D1-4A7D-814D-BC53612CBF28}\MpKsl4d2eedcc.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/13/2011 2:30 PM 136176]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [11/21/2009 12:29 PM 228408]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8/13/2011 2:30 PM 136176]
S3 kcrtx86;kcrtx86;c:\windows\system32\kcrtx86.sys [12/5/2010 11:13 PM 126048]
S3 NPFW;NPFW;c:\windows\system32\Npfw.sys [1/31/2011 5:05 AM 108736]
S3 NPFWFLT;NPFWFLT;c:\windows\system32\npfwflt.sys [1/31/2011 5:05 AM 82496]
S3 NPIDS;NPIDS;c:\windows\system32\npids.sys [1/31/2011 5:05 AM 61792]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [11/21/2009 12:24 PM 174592]
S3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys --> c:\windows\system32\drivers\WPRO_40_1340.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2011-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-13 18:29]
.
2011-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-13 18:29]
.
2011-08-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2011-08-15 c:\windows\Tasks\Windows Media Player.job
- c:\progra~1\WINDOW~3\wmplayer.exe [2008-04-15 12:00]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
Trusted Zone: fileresearchcenter.com\www
Trusted Zone: GeekPolice.net\www
Trusted Zone: majorgeeks.com
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: superantispyware.com\www
Trusted Zone: windowsupdate.com\download
Trusted Zone: yahoo.com\login
TCP: DhcpNameServer = 192.168.2.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-15 23:08
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-926436163-56185295-3562427831-1005\Software\SecuROM\License information*]
"datasecu"=hex:d8,85,4d,9c,d6,07,ac,b6,b9,ed,6b,ce,84,6f,00,67,e2,1a,37,bc,c6,
06,0a,a8,29,b4,ef,84,dc,9e,6d,4f,8e,ff,37,2e,2a,2d,7c,4f,01,04,22,70,6e,db,\
"rkeysecu"=hex:f1,f7,b4,86,a4,7d,83,2c,b1,96,b9,4a,5c,c5,db,1a
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(896)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(3008)
c:\windows\system32\WININET.dll
c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\idt\wdm\STacSV.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\npkcmsvc.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-08-15 23:13:34 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-16 03:13
ComboFix2.txt 2011-08-15 23:42
ComboFix3.txt 2011-08-15 15:18
ComboFix4.txt 2011-08-14 15:29
ComboFix5.txt 2011-08-16 02:54
.
Pre-Run: 27,141,632,000 bytes free
Post-Run: 27,143,716,864 bytes free
.
- - End Of File - - DD61AD13E4BE31933527288C7949FFA2

Hi,

Could you please re-run ComboFix without the script?

ComboFix 11-08-17.03 - kenneth 08/17/2011 23:20:19.9.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.987.541 [GMT -4:00]
Running from: c:\documents and settings\kenneth\Desktop\Security\commy.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\etc\hosts.txt
.
.
((((((((((((((((((((((((( Files Created from 2011-07-18 to 2011-08-18 )))))))))))))))))))))))))))))))
.
.
2011-08-18 03:13 . 2011-08-18 03:13 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{03AD8D2B-7445-4BA6-B567-B9FBF30F13AF}\MpKsl2d830f2e.sys
2011-08-17 04:27 . 2011-07-13 00:39 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{03AD8D2B-7445-4BA6-B567-B9FBF30F13AF}\mpengine.dll
2011-08-15 17:16 . 2011-08-16 15:29 -------- d-----w- c:\documents and settings\kenneth\Tracing
2011-08-14 16:12 . 2011-07-13 00:39 6881616 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-08-14 01:38 . 2011-08-14 01:38 -------- d-----w- C:\extensions
2011-08-13 15:36 . 2011-08-13 15:36 -------- d-----w- c:\program files\Microsoft Security Client
2011-08-13 15:11 . 2011-06-24 14:10 139656 ------w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-13 15:11 . 2011-07-08 14:02 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-13 15:01 . 2011-08-13 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
2011-08-13 14:51 . 2011-08-13 14:51 -------- d-----w- c:\documents and settings\kenneth\Application Data\Uniblue
2011-08-13 14:51 . 2011-08-13 14:51 -------- d-----w- c:\program files\Uniblue
2011-08-13 14:50 . 2011-08-13 14:50 -------- d-----w- c:\documents and settings\kenneth\Local Settings\Application Data\PackageAware
2011-08-13 03:06 . 2011-08-13 03:06 -------- d-----w- C:\commy
2011-08-11 14:45 . 2011-08-11 14:55 -------- d-----w- C:\clambo
2011-08-11 14:43 . 2011-08-11 15:05 -------- d-----w- C:\ComboFix
2011-08-10 21:01 . 2011-08-12 03:35 -------- d-----w- c:\documents and settings\kenneth\Application Data\Media Player Classic
2011-08-10 16:00 . 2011-08-10 16:00 -------- d-----w- c:\documents and settings\kenneth\Application Data\SUPERAntiSpyware.com
2011-08-10 15:59 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\!SASCORE
2011-08-10 15:59 . 2011-08-10 16:00 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-08-10 15:59 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-09 23:33 . 2011-08-10 01:43 -------- d-----w- c:\windows\system32\MpEngineStore
2011-08-09 23:24 . 2011-08-09 23:24 -------- d-----w- c:\windows\Downloaded Installations
2011-08-09 22:54 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-08-09 21:06 . 2011-08-09 21:06 -------- d-----w- c:\documents and settings\kenneth\Application Data\Malwarebytes
2011-08-09 21:05 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-09 21:05 . 2011-08-09 21:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-09 21:05 . 2011-08-09 21:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-09 21:05 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-09 20:24 . 2011-08-09 20:25 -------- d-----w- c:\program files\CCleaner
2011-08-09 14:55 . 2011-08-10 14:26 -------- d-----w- c:\documents and settings\Administrator
2011-08-06 15:50 . 2008-04-14 04:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2011-08-06 15:48 . 2008-04-14 04:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2011-08-04 17:58 . 2011-08-04 17:58 -------- d-----w- c:\program files\Combined Community Codec Pack
2011-07-24 02:40 . 2011-07-24 02:40 -------- d-----w- c:\program files\Apple Software Update
2011-07-19 12:58 . 2011-07-19 12:58 -------- d-----w- c:\program files\Nikon
2011-07-19 12:58 . 2011-07-19 12:58 -------- d-----w- c:\program files\Common Files\Nikon
2011-07-19 12:58 . 2005-04-03 21:02 753664 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
2011-07-19 12:58 . 2005-04-03 21:02 69714 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
2011-07-19 12:58 . 2005-04-03 21:01 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
2011-07-19 12:58 . 2005-04-03 21:00 184320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
2011-07-19 12:58 . 2005-04-03 20:59 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2011-07-19 12:58 . 2011-07-19 12:58 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
2011-07-19 12:58 . 2011-07-19 12:58 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2010-05-10 02:11 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-15 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2008-04-15 12:00 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2010-06-11 07:17 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36 . 2010-06-11 07:17 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 18:36 . 2009-03-07 20:34 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 12:05 . 2009-03-07 20:35 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-15 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-03 15:41 . 2011-01-31 09:05 108736 ----a-w- c:\windows\system32\Npfw.sys
2011-06-02 14:02 . 2010-05-02 05:22 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-06-01 21:39 . 2011-01-31 09:04 1069340 ----a-w- c:\windows\system32\NPDownV.exe
2011-05-26 17:17 . 2011-01-31 09:05 233792 ----a-w- c:\windows\system32\nPFW.dll
2011-05-26 12:07 . 2011-01-31 09:05 2244379 ----a-w- c:\windows\system32\npmonz.exe
.
.
((((((((((((((((((((((((((((( SnapShot_2011-08-14_15.23.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-18 03:13 . 2011-08-18 03:13 16384 c:\windows\temp\Perflib_Perfdata_630.dat
+ 2009-04-11 02:06 . 2011-08-18 03:17 97170 c:\windows\system32\perfc009.dat
- 2009-04-11 02:06 . 2011-08-14 13:54 97170 c:\windows\system32\perfc009.dat
+ 2009-04-11 02:06 . 2011-08-18 03:17 502690 c:\windows\system32\perfh009.dat
- 2009-04-11 02:06 . 2011-08-14 13:54 502690 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]
@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"
[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]
@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"
[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]
@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"
[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]
@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"
[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]
@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"
[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]
2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\C:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 07:25 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-06 07:25 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2011-07-25 17:59 2585408 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-15 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-01 21:07 173592 ----a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP]
2009-07-13 19:54 589104 ----a-w- c:\program files\Hewlett-Packard\HP QuickSync\QuickSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-06-04 11:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-01 21:07 141336 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
2008-04-15 04:00 44032 ----a-w- c:\windows\ime\imkr6_1\imekrmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2008-04-15 04:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 08:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-07-06 23:52 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2011-07-06 23:52 1047656 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2008-04-15 04:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-01 21:07 141336 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2008-04-15 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2008-04-15 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2009-08-20 02:46 322104 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 08:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2uvc]
2009-03-10 08:31 684032 ----a-w- c:\windows\vsnp2uvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 07:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 05:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-07-29 01:09 4599680 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-11-03 18:57 1594664 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
2009-10-12 06:51 495708 ------w- c:\program files\IDT\WDM\sttray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WirelessAssistant]
2009-09-01 02:41 499768 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZumoDrive]
2010-05-08 18:57 1733 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
.
R1 DVMIO;DVMIO;c:\splash.sys\config\dvmio.sys [9/29/2009 6:25 AM 17624]
R1 MpKsl2d830f2e;MpKsl2d830f2e;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{03AD8D2B-7445-4BA6-B567-B9FBF30F13AF}\MpKsl2d830f2e.sys [8/17/2011 11:13 PM 28752]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 12:27 PM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 5:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [7/18/2011 8:02 PM 123264]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\splash.sys\config\DVMExportService.exe [7/8/2009 7:55 AM 323584]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/9/2011 5:05 PM 366640]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [11/21/2009 12:24 PM 113664]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/9/2011 5:05 PM 22712]
S1 MpKsl4d2eedcc;MpKsl4d2eedcc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{048A6AA9-C6D1-4A7D-814D-BC53612CBF28}\MpKsl4d2eedcc.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{048A6AA9-C6D1-4A7D-814D-BC53612CBF28}\MpKsl4d2eedcc.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/13/2011 2:30 PM 136176]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [11/21/2009 12:29 PM 228408]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8/13/2011 2:30 PM 136176]
S3 kcrtx86;kcrtx86;c:\windows\system32\kcrtx86.sys [12/5/2010 11:13 PM 126048]
S3 NPFW;NPFW;c:\windows\system32\Npfw.sys [1/31/2011 5:05 AM 108736]
S3 NPFWFLT;NPFWFLT;c:\windows\system32\npfwflt.sys [1/31/2011 5:05 AM 82496]
S3 NPIDS;NPIDS;c:\windows\system32\npids.sys [1/31/2011 5:05 AM 61792]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [11/21/2009 12:24 PM 174592]
S3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys --> c:\windows\system32\drivers\WPRO_40_1340.sys [?]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSL2D830F2E
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2011-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-13 18:29]
.
2011-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-13 18:29]
.
2011-08-18 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2011-08-16 c:\windows\Tasks\Windows Media Player.job
- c:\progra~1\WINDOW~3\wmplayer.exe [2008-04-15 12:00]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
Trusted Zone: fileresearchcenter.com\www
Trusted Zone: GeekPolice.net\www
Trusted Zone: majorgeeks.com
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: superantispyware.com\www
Trusted Zone: windowsupdate.com\download
Trusted Zone: yahoo.com\login
TCP: DhcpNameServer = 192.168.2.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-17 23:30
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-926436163-56185295-3562427831-1005\Software\SecuROM\License information*]
"datasecu"=hex:d8,85,4d,9c,d6,07,ac,b6,b9,ed,6b,ce,84,6f,00,67,e2,1a,37,bc,c6,
06,0a,a8,29,b4,ef,84,dc,9e,6d,4f,8e,ff,37,2e,2a,2d,7c,4f,01,04,22,70,6e,db,\
"rkeysecu"=hex:f1,f7,b4,86,a4,7d,83,2c,b1,96,b9,4a,5c,c5,db,1a
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(892)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2011-08-17 23:33:51
ComboFix-quarantined-files.txt 2011-08-18 03:33
ComboFix2.txt 2011-08-16 03:13
ComboFix3.txt 2011-08-15 23:42
ComboFix4.txt 2011-08-15 15:18
ComboFix5.txt 2011-08-18 03:19
.
Pre-Run: 26,485,575,680 bytes free
Post-Run: 26,501,967,872 bytes free
.
- - End Of File - - 8516EFE41C95A3511E74882A0E665F5D

Hi,

Please download Malwarebytes Anti-Malware from Here.


Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.