Root Kit....Zero Access

we will be running a fix to deal with a proxy that might be causing the redirects and I will also try to get rid of the AVIRA remnants.

• Please run OTL.exe again
  
• Under the Custom Scans/Fixes box at the bottom, copy and paste in the following:

• CAREFUL NOW! You must click the Run Fix button, NOT the Run Scan!
  
• If it asks to reboot the computer, please allow that.
  
• Finally, post the contents of the log. (Located at C:\_OTL\Moved Files)

====================

Please download SpiderKill by DragonMaster Jay and save it to your Desktop.

• Right-click on SpiderKill.zip and click Extract All. Follow the prompts and read carefully, to save it to your Desktop.
  
• Double-click on the SpiderKill folder, and then double-click on SpiderKill.bat and follow all the prompts in the program.
  
• Within a minute, it will save its log titled SpiderKill.txt. Please post that in your next reply. You may have to use two or three posts to be able to fit the information in.

====================

Download and run SVCHOST Diag by DragonMaster Jay.

Post the log from it when it launches.

========== OTL ==========
Prefs.js: "127.0.0.1" removed from network.proxy.http
Prefs.js: 54828 removed from network.proxy.http_port
File boot] not found.

OTL by OldTimer - Version 3.2.45.0 log created on 06132012_101954



SpiderKill by DragonMaster Jay


Microsoft Windows [Version 6.0.6001]

********************Drivers list********************


Volume in drive C is SQ004585V03
Volume Serial Number is 90D3-0EF7

Directory of C:\Windows\System32\Drivers

06/10/2012 03:03 PM .
06/10/2012 03:03 PM ..
11/06/2007 04:42 PM 2 1179_Toshiba_Satellite A200-A205_26890.MRK
11/02/2006 04:55 AM 53,376 1394bus.sys
01/19/2008 12:43 AM 266,808 acpi.sys
11/02/2006 05:51 AM 420,968 adp94xx.sys
11/02/2006 05:51 AM 297,576 adpahci.sys
11/02/2006 05:50 AM 98,408 adpu160m.sys
11/02/2006 05:51 AM 147,048 adpu320.sys
04/21/2011 09:16 AM 273,408 afd.sys
11/02/2006 05:49 AM 53,864 AGP440.sys
11/28/2006 07:11 PM 1,161,888 AGRSM.sys
11/02/2006 05:49 AM 14,952 aliide.sys
11/02/2006 05:49 AM 54,888 AMDAGP.SYS
11/02/2006 05:49 AM 15,464 amdide.sys
11/02/2006 04:30 AM 38,912 amdk7.sys
11/02/2006 04:30 AM 40,960 amdk8.sys
11/02/2006 05:50 AM 67,688 arc.sys
11/02/2006 05:50 AM 67,688 arcsas.sys
03/06/2012 07:01 PM 20,696 aswFsBlk.sys
03/06/2012 07:01 PM 57,688 aswMonFlt.sys
03/06/2012 07:02 PM 35,672 aswRdr.sys
03/06/2012 07:03 PM 612,184 aswSnx.sys
03/06/2012 07:03 PM 337,880 aswSP.sys
03/06/2012 07:01 PM 53,848 aswTdi.sys
01/18/2008 10:56 PM 17,408 asyncmac.sys
01/19/2008 12:41 AM 21,560 atapi.sys
01/19/2008 12:43 AM 110,136 ataport.sys
05/11/2009 12:49 PM 51,992 avgntdd.sys
06/30/2011 01:20 PM 66,616 avgntflt.sys
05/11/2009 12:49 PM 17,016 avgntmgr.sys
06/30/2011 01:20 PM 138,192 avipbb.sys
01/19/2008 12:41 AM 28,216 battc.sys
01/18/2008 10:53 PM 12,288 bdasup.sys
01/18/2008 10:49 PM 6,144 beep.sys
02/22/2011 08:51 AM 69,632 bowser.sys
11/02/2006 04:24 AM 13,568 BrFiltLo.sys
11/02/2006 04:24 AM 5,248 BrFiltUp.sys
01/18/2008 11:58 PM 93,696 bridge.sys
11/02/2006 04:25 AM 71,808 BrSerId.sys
11/02/2006 04:24 AM 62,336 BrSerWdm.sys
11/02/2006 04:24 AM 12,160 BrUsbMdm.sys
11/02/2006 04:24 AM 11,904 BrUsbSer.sys
11/02/2006 04:55 AM 39,936 bthmodem.sys
01/18/2008 10:28 PM 70,144 cdfs.sys
10/04/2006 10:42 PM 2,432 cdr4_xp.sys
10/04/2006 10:42 PM 2,560 cdralw2k.sys
01/18/2008 10:49 PM 67,072 cdrom.sys
11/02/2006 04:55 AM 35,328 circlass.sys
01/19/2008 12:43 AM 127,544 Classpnp.sys
01/18/2008 10:32 PM 14,208 CmBatt.sys
11/02/2006 05:49 AM 16,488 cmdide.sys
01/19/2008 12:41 AM 20,792 compbatt.sys
01/19/2008 12:42 AM 36,408 crashdmp.sys
11/02/2006 05:49 AM 22,632 crcdisk.sys
11/02/2006 04:30 AM 38,912 crusoe.sys
12/11/2007 05:47 PM 50 DCX.LOG
04/14/2011 10:24 AM 75,264 dfsc.sys
01/19/2008 12:42 AM 55,352 disk.sys
01/18/2008 10:49 PM 19,968 Diskdump.sys
11/02/2006 05:50 AM 71,272 djsvs.sys
01/18/2008 11:53 PM 130,048 drmk.sys
01/18/2008 10:53 PM 5,632 drmkaud.sys
01/19/2008 12:41 AM 29,240 Dumpata.sys
01/18/2008 10:36 PM 13,312 dxapi.sys
01/18/2008 10:36 PM 76,288 dxg.sys
08/01/2008 09:01 PM 625,152 dxgkrnl.sys
11/02/2006 03:30 AM 117,760 E1G60I32.sys
01/19/2008 12:42 AM 143,416 ecache.sys
11/02/2006 05:51 AM 316,520 elxstor.sys
01/28/2011 05:00 PM en-US
06/08/2012 01:18 AM etc
01/18/2008 10:28 PM 136,192 exfat.sys
01/18/2008 10:28 PM 143,360 fastfat.sys
11/02/2006 04:51 AM 25,088 fdc.sys
01/19/2008 12:42 AM 58,936 fileinfo.sys
01/18/2008 10:30 PM 27,648 filetrace.sys
11/02/2006 04:51 AM 20,480 flpydisk.sys
01/19/2008 12:42 AM 192,056 fltMgr.sys
01/18/2008 10:27 PM 12,800 fs_rec.sys
11/20/2006 02:11 AM 7,168 FwLnk.sys
01/19/2008 12:43 AM 101,432 FWPKCLNT.SYS
11/02/2006 05:50 AM 58,984 GAGP30KX.SYS
09/18/2006 05:26 PM 3,440,660 gm.dls
09/18/2006 05:26 PM 646 gmreadme.txt
01/18/2008 09:30 PM 53,760 hdaudbus.sys
11/02/2006 03:36 AM 235,520 HdAudio.sys
11/02/2006 04:55 AM 29,184 hidbth.sys
01/18/2008 10:53 PM 38,912 hidclass.sys
11/02/2006 04:55 AM 21,504 hidir.sys
01/18/2008 10:53 PM 25,472 hidparse.sys
01/18/2008 10:53 PM 12,288 hidusb.sys
11/02/2006 05:50 AM 37,480 HpCISSs.sys
02/20/2010 05:18 PM 411,136 http.sys
11/02/2006 05:49 AM 16,488 i2omgmt.sys
11/02/2006 05:49 AM 27,752 i2omp.sys
01/18/2008 10:49 PM 54,784 i8042prt.sys
11/02/2006 05:51 AM 232,040 iaStorV.sys
09/13/2007 07:23 PM 1,925,632 igdkmd32.sys
11/02/2006 05:50 AM 41,576 iirsp.sys
01/19/2008 12:41 AM 17,976 intelide.sys
01/18/2008 10:27 PM 41,472 intelppm.sys
01/18/2008 10:56 PM 47,616 ipfltdrv.sys
11/02/2006 04:42 AM 65,536 IPMIDrv.sys
01/18/2008 10:56 PM 100,864 ipnat.sys
01/18/2008 10:55 PM 95,744 irda.sys
01/18/2008 10:55 PM 13,312 irenum.sys
11/02/2006 05:50 AM 47,208 isapnp.sys
11/02/2006 05:50 AM 35,944 iteatapi.sys
11/02/2006 05:50 AM 35,944 iteraid.sys
01/19/2008 12:41 AM 35,384 kbdclass.sys
01/18/2008 10:49 PM 15,872 kbdhid.sys
11/09/2006 02:32 AM 219,264 KR10I.sys
11/09/2006 02:31 AM 211,072 KR10N.sys
09/27/2006 08:06 AM 479,488 kr3npxp.sys
01/18/2008 10:49 PM 148,992 ks.sys
06/15/2009 02:20 PM 439,896 ksecdd.sys
01/18/2008 10:55 PM 47,104 lltdio.sys
11/02/2006 05:50 AM 65,640 lsi_fc.sys
11/02/2006 05:50 AM 65,640 lsi_sas.sys
11/02/2006 05:50 AM 65,640 lsi_scsi.sys
01/18/2008 10:30 PM 84,480 luafv.sys
04/04/2012 03:56 PM 22,344 mbam.sys
01/18/2008 10:50 PM 18,944 mcd.sys
11/02/2006 05:49 AM 28,776 megasas.sys
01/18/2008 10:57 PM 31,744 modem.sys
01/18/2008 10:52 PM 41,984 monitor.sys
01/19/2008 12:41 AM 34,360 mouclass.sys
01/18/2008 10:49 PM 15,872 mouhid.sys
01/19/2008 12:42 AM 57,400 mountmgr.sys
11/02/2006 05:50 AM 78,952 mpio.sys
01/18/2008 10:54 PM 64,000 mpsdrv.sys
11/02/2006 05:49 AM 33,384 Mraid35x.sys
01/18/2008 10:28 PM 110,080 mrxdav.sys
04/29/2011 08:49 AM 105,984 mrxsmb.sys
07/06/2011 10:56 AM 213,504 mrxsmb10.sys
04/29/2011 08:49 AM 79,360 mrxsmb20.sys
01/19/2008 12:41 AM 28,728 msahci.sys
11/02/2006 05:50 AM 80,488 msdsm.sys
01/18/2008 10:28 PM 22,528 msfs.sys
01/05/2008 04:31 AM 3 MsftWdf_Kernel_01007_Inbox_Critical.Wdf
11/06/2007 06:30 PM 0 Msft_Kernel_SynTP_01000.Wdf
03/01/2011 03:45 PM 0 Msft_User_WpdFs_01_00_00.Wdf
01/19/2008 12:41 AM 16,440 msisadrv.sys
01/19/2008 12:42 AM 181,304 msiscsi.sys
01/18/2008 10:49 PM 8,192 mskssrv.sys
01/18/2008 10:49 PM 5,888 mspclock.sys
01/18/2008 10:49 PM 5,504 mspqm.sys
01/19/2008 12:42 AM 163,384 msrpc.sys
01/19/2008 12:41 AM 31,288 mssmbios.sys
01/18/2008 10:49 PM 6,016 mstee.sys
01/19/2008 12:42 AM 49,720 mup.sys
01/19/2008 12:43 AM 529,464 ndis.sys
01/18/2008 10:56 PM 20,992 ndistapi.sys
01/18/2008 10:55 PM 16,896 ndisuio.sys
01/18/2008 10:56 PM 121,344 ndiswan.sys
01/18/2008 10:56 PM 49,664 ndproxy.sys
01/18/2008 10:55 PM 35,840 netbios.sys
01/18/2008 10:55 PM 184,320 netbt.sys
01/19/2008 12:42 AM 223,288 netio.sys
11/02/2006 05:50 AM 45,160 nfrd960.sys
01/18/2008 10:28 PM 34,816 npfs.sys
01/18/2008 10:55 PM 16,384 nsiproxy.sys
01/19/2008 12:43 AM 1,081,912 ntfs.sys
11/02/2006 03:36 AM 20,608 ntrigdigi.sys
01/18/2008 10:49 PM 4,608 null.sys
11/02/2006 05:50 AM 88,680 nvraid.sys
11/02/2006 05:50 AM 40,040 nvstor.sys
11/02/2006 05:50 AM 106,600 NV_AGP.SYS
05/19/2008 10:07 PM 148,480 nwifi.sys
11/02/2006 04:55 AM 62,080 ohci1394.sys
04/04/2008 09:21 PM 72,192 pacer.sys
11/02/2006 04:51 AM 79,360 parport.sys
01/19/2008 12:42 AM 56,376 partmgr.sys
11/02/2006 04:51 AM 8,704 parvdm.sys
01/19/2008 12:42 AM 151,096 pci.sys
11/02/2006 05:49 AM 13,416 pciide.sys
01/19/2008 12:42 AM 45,112 pciidex.sys
11/02/2006 05:51 AM 167,528 pcmcia.sys
11/02/2006 05:04 AM 878,080 PEAuth.sys
01/18/2008 10:53 PM 167,936 portcls.sys
11/02/2006 04:30 AM 38,400 processr.sys
09/27/2006 05:53 PM 36,560 pxhelp20.sys
11/02/2006 05:51 AM 900,712 ql2300.sys
11/02/2006 05:50 AM 106,088 ql40xx.sys
01/18/2008 10:56 PM 31,232 qwavedrv.sys
01/18/2008 10:56 PM 11,776 rasacd.sys
01/18/2008 10:56 PM 76,288 rasl2tp.sys
01/18/2008 10:56 PM 41,472 raspppoe.sys
01/18/2008 10:56 PM 62,976 raspptp.sys
01/18/2008 10:56 PM 69,120 rassstp.sys
01/18/2008 10:28 PM 224,768 rdbss.sys
01/18/2008 11:01 PM 6,144 RDPCDD.sys
11/02/2006 05:03 AM 242,688 rdpdr.sys
01/18/2008 11:01 PM 6,144 RDPENCDD.sys
01/18/2008 11:01 PM 181,248 rdpwd.sys
05/09/2008 09:33 PM 113,664 rmcast.sys
01/18/2008 10:56 PM 33,280 RNDISMP.sys
01/18/2008 10:57 PM 8,192 rootmdm.sys
01/18/2008 10:55 PM 60,416 rspndr.sys
03/12/2007 01:27 PM 176 RTHDAEQ0.dat
03/12/2007 01:27 PM 176 RTHDAEQ1.dat
03/15/2007 01:29 PM 176 RTHDAEQ2.dat
03/15/2007 01:29 PM 176 RTHDAEQ3.dat
04/25/2007 09:03 PM 1,771,944 RTKVHDA.sys
06/01/2007 05:07 PM 252,416 rtl8187B.sys
11/02/2006 03:30 AM 44,544 Rtlh86.sys
11/02/2006 05:50 AM 76,392 sbp2port.sys
01/19/2008 12:42 AM 142,904 scsiport.sys
11/06/2007 06:02 PM 82,432 sdbus.sys
11/02/2006 02:37 AM 20,480 secdrv.sys
11/02/2006 04:51 AM 17,920 serenum.sys
11/02/2006 04:51 AM 83,456 serial.sys
01/18/2008 10:49 PM 19,968 sermouse.sys
11/02/2006 04:51 AM 13,312 sffdisk.sys
11/02/2006 04:51 AM 12,800 sffp_mmc.sys
11/02/2006 04:51 AM 12,800 sffp_sd.sys
11/02/2006 04:51 AM 13,312 sfloppy.sys
10/01/2011 09:30 AM 579,944 Sftfslh.sys
10/01/2011 09:30 AM 194,408 Sftplaylh.sys
10/01/2011 09:30 AM 21,864 Sftredirlh.sys
10/01/2011 09:30 AM 19,304 Sftvollh.sys
11/02/2006 05:49 AM 53,352 SISAGP.SYS
11/02/2006 05:50 AM 38,504 sisraid2.sys
11/02/2006 05:50 AM 71,784 sisraid4.sys
01/18/2008 10:55 PM 66,560 smb.sys
01/18/2008 10:49 PM 17,408 smclib.sys
01/19/2008 12:41 AM 21,048 spldr.sys
01/18/2008 09:10 PM 681,984 spsys.sys
02/18/2011 09:31 AM 304,640 srv.sys
04/29/2011 08:49 AM 146,432 srv2.sys
04/29/2011 08:49 AM 102,400 srvnet.sys
05/11/2009 10:12 AM 28,520 ssmdrv.sys
01/19/2008 12:43 AM 123,960 Storport.sys
01/18/2008 10:53 PM 52,992 stream.sys
01/19/2008 12:41 AM 15,288 swenum.sys
11/02/2006 05:50 AM 35,944 symc8xx.sys
11/02/2006 05:49 AM 31,848 sym_hi.sys
11/02/2006 05:50 AM 34,920 sym_u3.sys
08/15/2007 09:03 PM 190,384 SynTP.sys
01/18/2008 10:49 PM 24,576 tape.sys
06/16/2010 11:59 AM 898,952 tcpip.sys
01/18/2008 10:56 PM 30,208 tcpipreg.sys
10/18/2006 03:50 PM 16,128 tdcmdpst.sys
01/18/2008 10:57 PM 20,992 tdi.sys
01/18/2008 11:01 PM 17,920 tdpipe.sys
01/18/2008 11:01 PM 29,184 tdtcp.sys
01/18/2008 10:56 PM 71,680 tdx.sys
01/19/2008 12:42 AM 54,328 termdd.sys
01/24/2007 06:44 PM 290,304 tifm21.sys
09/19/2007 02:59 PM 285,184 tos_sps32.sys
01/18/2008 11:01 PM 23,552 tssecsrv.sys
01/19/2008 01:55 AM 15,360 TUNMP.SYS
02/18/2010 07:52 AM 25,088 tunnel.sys
10/06/2006 02:22 AM 16,768 TVALZ_O.SYS
11/02/2006 05:49 AM 56,936 UAGP35.SYS
01/18/2008 10:28 PM 226,816 udfs.sys
11/02/2006 05:50 AM 58,472 ULIAGPKX.SYS
11/02/2006 05:51 AM 235,112 uliahci.sys
11/02/2006 05:50 AM 98,408 ulsata.sys
11/02/2006 05:50 AM 115,816 ulsata2.sys
01/18/2008 10:53 PM 34,816 umbus.sys
01/28/2011 04:51 PM UMDF
01/18/2008 10:53 PM 7,680 umpass.sys
01/18/2008 10:56 PM 15,872 usb8023.sys
01/18/2008 10:53 PM 25,728 USBCAMD.sys
01/18/2008 10:53 PM 25,728 USBCAMD2.sys
01/18/2008 10:53 PM 73,216 usbccgp.sys
11/02/2006 04:55 AM 68,608 usbcir.sys
01/18/2008 10:53 PM 5,888 usbd.sys
01/18/2008 10:53 PM 39,424 usbehci.sys
01/18/2008 10:53 PM 194,560 usbhub.sys
11/02/2006 04:55 AM 19,456 usbohci.sys
01/18/2008 10:53 PM 226,304 usbport.sys
01/18/2008 11:14 PM 18,944 usbprint.sys
01/18/2008 11:14 PM 35,328 usbscan.sys
01/18/2008 10:53 PM 55,296 USBSTOR.SYS
01/18/2008 10:53 PM 23,552 usbuhci.sys
11/02/2006 04:55 AM 132,352 usbvideo.sys
01/18/2008 10:52 PM 25,088 vga.sys
01/18/2008 10:52 PM 26,112 vgapnp.sys
11/02/2006 05:49 AM 54,376 VIAAGP.SYS
11/02/2006 04:30 AM 39,424 viac7.sys
11/02/2006 05:49 AM 17,512 viaide.sys
01/18/2008 10:52 PM 110,080 videoprt.sys
01/19/2008 12:42 AM 52,792 volmgr.sys
01/19/2008 12:43 AM 294,456 volmgrx.sys
01/19/2008 12:42 AM 227,896 volsnap.sys
11/02/2006 05:50 AM 112,232 vsmraid.sys
11/02/2006 04:52 AM 20,608 wacompen.sys
01/18/2008 10:56 PM 62,464 wanarp.sys
01/18/2008 10:35 PM 32,768 watchdog.sys
11/02/2006 05:49 AM 19,560 wd.sys
01/19/2008 12:43 AM 503,864 Wdf01000.sys
01/19/2008 12:42 AM 35,896 WdfLdr.sys
11/02/2006 04:35 AM 11,264 wmiacpi.sys
01/19/2008 12:41 AM 17,976 wmilib.sys
01/18/2008 11:04 PM 39,936 WpdUsb.sys
01/18/2008 10:56 PM 15,872 ws2ifsl.sys
01/18/2008 10:52 PM 51,200 WUDFPf.sys
01/18/2008 10:53 PM 83,328 WUDFRd.sys
01/09/2007 02:00 PM 221,696 yk60x86.sys
297 File(s) 36,292,705 bytes

Directory of C:\Windows\System32\Drivers\en-US

01/28/2011 05:00 PM .
01/28/2011 05:00 PM ..
11/02/2006 08:41 AM 9,728 acpi.sys.mui
11/02/2006 08:41 AM 8,704 afd.sys.mui
11/02/2006 08:41 AM 3,072 AGP440.sys.mui
11/02/2006 08:41 AM 3,072 AMDAGP.SYS.mui
11/02/2006 08:40 AM 2,560 amdide.sys.mui
11/02/2006 08:40 AM 14,848 amdk7.sys.mui
11/02/2006 08:40 AM 14,848 amdk8.sys.mui
11/02/2006 08:41 AM 3,072 ati2mpad.sys.mui
11/02/2006 08:41 AM 3,584 ati2mtag.sys.mui
11/02/2006 08:40 AM 3,072 atikmdag.sys.mui
01/19/2008 12:30 AM 5,120 b57nd60x.sys.mui
11/02/2006 08:40 AM 7,680 battc.sys.mui
11/02/2006 08:40 AM 5,120 bcm4sbxp.sys.mui
11/02/2006 08:40 AM 2,560 BrParwdm.sys.mui
11/02/2006 08:41 AM 10,240 BrSerId.sys.mui
11/02/2006 08:40 AM 5,120 bthpan.sys.mui
11/02/2006 08:41 AM 7,168 bthport.sys.mui
11/02/2006 08:41 AM 3,072 cmbp0wdm.sys.mui
11/02/2006 08:40 AM 14,848 crusoe.sys.mui
11/02/2006 08:41 AM 3,072 cxbp0wdm.sys.mui
11/02/2006 08:40 AM 3,072 Dot4usb.sys.mui
11/02/2006 08:40 AM 4,096 dxgkrnl.sys.mui
11/02/2006 08:41 AM 5,120 e100b325.sys.mui
01/19/2008 12:37 AM 19,968 e1e6032.sys.mui
01/19/2008 12:40 AM 16,896 E1G60I32.sys.mui
11/02/2006 08:40 AM 5,120 fltmgr.sys.mui
11/02/2006 08:40 AM 3,072 GAGP30KX.SYS.mui
11/02/2006 08:41 AM 3,584 gpr400.sys.mui
11/02/2006 08:41 AM 4,096 grserial.sys.mui
11/02/2006 08:41 AM 3,584 hidbth.sys.mui
11/03/2009 06:18 PM 36,864 http.sys.mui
11/02/2006 08:41 AM 10,752 i8042prt.sys.mui
11/02/2006 08:40 AM 14,848 intelppm.sys.mui
11/02/2006 08:41 AM 6,144 IPMIDrv.sys.mui
11/02/2006 08:41 AM 4,096 ipnat.sys.mui
11/02/2006 08:41 AM 4,096 isapnp.sys.mui
11/02/2006 08:41 AM 4,608 kbdclass.sys.mui
11/02/2006 08:41 AM 3,072 kbdhid.sys.mui
11/02/2006 08:41 AM 9,728 ltmdmnt.sys.mui
01/19/2008 12:30 AM 6,656 luafv.sys.mui
11/02/2006 08:41 AM 4,096 modem.sys.mui
11/02/2006 08:41 AM 4,608 mouclass.sys.mui
11/02/2006 08:41 AM 3,072 mouhid.sys.mui
01/19/2008 12:44 AM 20,480 mpio.sys.mui
11/02/2006 08:41 AM 4,096 msdsm.sys.mui
11/02/2006 08:41 AM 3,584 mssmbios.sys.mui
11/02/2006 08:41 AM 65,536 ntfs.sys.mui
11/02/2006 08:40 AM 4,096 ntrigdigi.sys.mui
11/02/2006 08:41 AM 5,120 nv4_mini.sys.mui
11/02/2006 08:41 AM 3,072 NV_AGP.SYS.mui
11/02/2006 08:40 AM 12,288 ohci1394.sys.mui
11/02/2006 08:41 AM 3,584 pacer.sys.mui
11/02/2006 08:40 AM 4,096 parport.sys.mui
11/02/2006 08:40 AM 3,072 parvdm.sys.mui
11/02/2006 08:41 AM 8,704 pci.sys.mui
11/02/2006 08:41 AM 4,608 pcmcia.sys.mui
11/02/2006 08:41 AM 3,072 pnpmem.sys.mui
11/02/2006 08:40 AM 14,848 processr.sys.mui
11/02/2006 08:41 AM 4,096 pscr.sys.mui
11/02/2006 08:41 AM 3,072 qwavedrv.sys.mui
11/02/2006 08:40 AM 3,584 RNDISMP.sys.mui
11/02/2006 08:41 AM 3,584 rndismpx.sys.mui
11/02/2006 08:41 AM 4,096 scmstcs.sys.mui
11/02/2006 08:41 AM 4,096 SCR111.sys.mui
11/02/2006 08:41 AM 3,584 scsiport.sys.mui
11/02/2006 08:40 AM 10,752 serial.sys.mui
11/02/2006 08:41 AM 5,632 sermouse.sys.mui
11/02/2006 08:41 AM 3,072 serscan.sys.mui
11/02/2006 08:41 AM 3,072 SISAGP.SYS.mui
11/02/2006 08:41 AM 3,072 srv.sys.mui
11/02/2006 08:41 AM 3,072 stcusb.sys.mui
01/19/2008 12:34 AM 5,120 tpm.sys.mui
11/02/2006 08:40 AM 3,072 UAGP35.SYS.mui
11/02/2006 08:41 AM 3,072 ULIAGPKX.SYS.mui
11/02/2006 08:40 AM 3,584 umbus.sys.mui
11/02/2006 08:41 AM 3,072 VIAAGP.SYS.mui
11/02/2006 08:40 AM 14,848 viac7.sys.mui
01/19/2008 12:36 AM 32,768 volsnap.sys.mui
11/02/2006 08:41 AM 4,608 wacompen.sys.mui
11/02/2006 08:41 AM 2,560 wd.sys.mui
01/19/2008 12:33 AM 3,072 wdf01000.sys.mui
11/02/2006 08:41 AM 5,632 yk60x86.sys.mui
82 File(s) 608,256 bytes

Directory of C:\Windows\System32\Drivers\etc

06/08/2012 01:18 AM .
06/08/2012 01:18 AM ..
06/08/2012 01:18 AM 27 hosts
09/18/2006 05:41 PM 3,683 lmhosts.sam
09/18/2006 05:41 PM 407 networks
09/18/2006 05:41 PM 1,358 protocol
09/18/2006 05:41 PM 17,244 services
5 File(s) 22,719 bytes

Directory of C:\Windows\System32\Drivers\UMDF

01/28/2011 04:51 PM .
01/28/2011 04:51 PM ..
11/02/2006 08:42 AM en-US
11/11/2007 11:13 AM 0 Msft_User_WpdFs_01_00_00.Wdf
03/24/2010 02:24 PM 0 Msft_User_WpdMtpDr_01_00_00.Wdf
01/19/2008 12:37 AM 220,160 WpdFs.dll
01/19/2008 12:37 AM 664,576 WpdMtpDr.dll
4 File(s) 884,736 bytes

Directory of C:\Windows\System32\Drivers\UMDF\en-US

11/02/2006 08:42 AM .
11/02/2006 08:42 AM ..
11/02/2006 08:40 AM 6,144 WpdMtpDr.dll.mui
1 File(s) 6,144 bytes

Total Files Listed:
389 File(s) 37,814,560 bytes
14 Dir(s) 64,430,985,216 bytes free


***********************Hidden Drivers********************
Volume in drive C is SQ004585V03
Volume Serial Number is 90D3-0EF7

Directory of C:\Windows\System32\Drivers

03/31/2008 03:55 PM 4 taishop.sys
1 File(s) 4 bytes
0 Dir(s) 64,430,993,408 bytes free


*********************Processes*******************


PROCESS PID PRIO PATH
Dwm.exe 1796 High C:\Windows\system32\Dwm.exe
Explorer.EXE 1816 Normal C:\Windows\Explorer.EXE
taskeng.exe 2040 Normal C:\Windows\system32\taskeng.exe
igfxpers.exe 472 Normal C:\Windows\System32\igfxpers.exe
RtHDVCpl.exe 896 Normal C:\Windows\RtHDVCpl.exe
SynTPStart.exe 2452 Normal C:\Program Files\Synaptics\SynTP\SynTPStart.exe
GoogleDesktop.exe 2868 Normal C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
realsched.exe 3040 Normal C:\Program Files\Common Files\Real\Update_OB\realsched.exe
AvastUI.exe 3100 Normal C:\Program Files\AVAST Software\Avast\AvastUI.exe
ONENOTEM.EXE 3116 Normal C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
SynToshiba.exe 3544 Normal C:\Program Files\Synaptics\SynTP\SynToshiba.exe
unsecapp.exe 3940 Normal C:\Windows\system32\wbem\unsecapp.exe
firefox.exe 3852 Normal C:\Program Files\Mozilla Firefox\firefox.exe
plugin-container.exe 2808 Normal C:\Program Files\Mozilla Firefox\plugin-container.exe
RealPlay.exe 2788 Idle C:\Program Files\Real\RealPlayer\RealPlay.exe
wuauclt.exe 1216 Normal C:\Windows\system32\wuauclt.exe
cmd.exe 544 Normal C:\Windows\system32\cmd.exe
processes.exe 2340 Normal C:\Users\JonEJet\Desktop\SpiderKill\SpiderKill\processes.exe


*********************Modules of explorer.exe and svchost.exe*******************
Module information for 'Explorer.EXE'(1816)
MODULE BASE SIZE PATH
Explorer.EXE 490000 2936832 C:\Windows\Explorer.EXE 6.0.6000.16386 (vista_rtm.061101-2205) Windows Explorer
ntdll.dll 77600000 1212416 C:\Windows\system32\ntdll.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) NT Layer DLL
kernel32.dll 77380000 901120 C:\Windows\system32\kernel32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows NT BASE API Client DLL
snxhk.dll 75d00000 225280 C:\Program Files\AVAST Software\Avast\snxhk.dll 7.0.1426.0 avast! snxhk
ADVAPI32.dll 77070000 811008 C:\Windows\system32\ADVAPI32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Advanced Windows 32 Base API
RPCRT4.dll 77530000 794624 C:\Windows\system32\RPCRT4.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Remote Procedure Call Runtime
GDI32.dll 75e70000 307200 C:\Windows\system32\GDI32.dll 6.0.6001.18159 (vistasp1_gdr.081020-1655) GDI Client DLL
USER32.dll 76fb0000 643072 C:\Windows\system32\USER32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Multi-User Windows USER API Client DLL
msvcrt.dll 769d0000 696320 C:\Windows\system32\msvcrt.dll 7.0.6001.18000 (longhorn_rtm.080118-1840) Windows NT CRT DLL
SHLWAPI.dll 76f50000 360448 C:\Windows\system32\SHLWAPI.dll 6.0.6000.16386 (vista_rtm.061101-2205) Shell Light-weight Utility Library
SHELL32.dll 75ec0000 11599872 C:\Windows\system32\SHELL32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Shell Common Dll
ole32.dll 76d40000 1327104 C:\Windows\system32\ole32.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft OLE for Windows
OLEAUT32.dll 76b10000 577536 C:\Windows\system32\OLEAUT32.dll 6.0.6001.18565 6.0.6001.18565
SHDOCVW.dll 6ff50000 1077248 C:\Windows\system32\SHDOCVW.dll 6.0.6000.16386 (vista_rtm.061101-2205) Shell Doc Object and Control Library
UxTheme.dll 74bd0000 258048 C:\Windows\system32\UxTheme.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft UxTheme Library
POWRPROF.dll 75130000 106496 C:\Windows\system32\POWRPROF.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Power Profile Helper DLL
dwmapi.dll 71780000 49152 C:\Windows\system32\dwmapi.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Microsoft Desktop Window Manager API
gdiplus.dll 73830000 1748992 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll 5.2.6001.18551 (vistasp1_gdr.101104-0637) Microsoft GDI+
slc.dll 75710000 237568 C:\Windows\system32\slc.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Software Licensing Client Dll
PROPSYS.dll 736f0000 765952 C:\Windows\system32\PROPSYS.dll 7.0.6001.16503 (longhorn(wmbla).080526-2159) Microsoft Property System
BROWSEUI.dll 6fd70000 1335296 C:\Windows\system32\BROWSEUI.dll 6.0.6000.16386 (vista_rtm.061101-2205) Shell Browser UI Library
IMM32.dll 77050000 122880 C:\Windows\system32\IMM32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Multi-User Windows IMM32 API Client DLL
MSCTF.dll 77460000 819200 C:\Windows\system32\MSCTF.dll 6.0.6000.16386 (vista_rtm.061101-2205) MSCTF Server DLL
DUser.dll 74fc0000 196608 C:\Windows\system32\DUser.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows DirectUser Engine
LPK.DLL 76e90000 36864 C:\Windows\system32\LPK.DLL 6.0.6001.18000 (longhorn_rtm.080118-1840) Language Pack
USP10.dll 76a80000 512000 C:\Windows\system32\USP10.dll 1.0626.6001.18461 (vistasp1_gdr.100416-0345) Uniscribe Unicode script processor
comctl32.dll 74c10000 1695744 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll 5.82 (longhorn_rtm.080118-1840) Common Controls Library
WindowsCodecs.dll 71ce0000 733184 C:\Windows\system32\WindowsCodecs.dll 6.0.6001.18131 (vistasp1_gdr.080827-1507) Microsoft Windows Codecs Library
apphelp.dll 75be0000 180224 C:\Windows\system32\apphelp.dll 6.0.6000.16386 (vista_rtm.061101-2205) Application Compatibility Client Library
CLBCatQ.DLL 77730000 540672 C:\Windows\system32\CLBCatQ.DLL 2001.12.6931.18000 (longhorn_rtm.080118-1840) COM+ Configuration Catalog
ashShell.dll 6fce0000 139264 C:\Program Files\AVAST Software\Avast\ashShell.dll 7.0.1426.0 avast! Shell Extension
msi.dll 6fad0000 2105344 C:\Windows\system32\msi.dll 4.0.6001.18000 Windows Installer
IconCodecService.dll 6fab0000 24576 C:\Windows\system32\IconCodecService.dll 6.0.6000.16386 (vista_rtm.061101-2205) Converts a PNG part of the icon to a legacy bmp icon
Secur32.dll 75cc0000 81920 C:\Windows\system32\Secur32.dll 6.0.6001.18272 (vistasp1_gdr.090615-0258) Security Support Provider Interface
rsaenh.dll 751d0000 241664 C:\Windows\system32\rsaenh.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Microsoft Enhanced Cryptographic Provider
timedate.cpl 6f770000 729088 C:\Windows\system32\timedate.cpl 6.0.6001.18000 (longhorn_rtm.080118-1840) Time Date Control Panel Applet
ATL.DLL 736a0000 81920 C:\Windows\system32\ATL.DLL 3.05.2284 ATL Module for Windows XP (Unicode)
NETAPI32.dll 75950000 479232 C:\Windows\system32\NETAPI32.dll 6.0.6001.18157 (vistasp1_gdr.081015-1604) Net Win32 API DLL
PSAPI.DLL 75e60000 28672 C:\Windows\system32\PSAPI.DLL 6.0.6000.16386 (vista_rtm.061101-2205) Process Status Helper
OLEACC.dll 737f0000 233472 C:\Windows\system32\OLEACC.dll 4.2.5406.0 (longhorn_rtm.080118-1840) Active Accessibility Core Component
actxprxy.dll 6f660000 339968 C:\Windows\System32\actxprxy.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) ActiveX Interface Marshaling Library
USERENV.dll 75ce0000 122880 C:\Windows\system32\USERENV.dll 6.0.6000.16386 (vista_rtm.061101-2205) Userenv
wmpband.dll 6fd20000 110592 C:\PROGRA~1\WI4EB4~1\wmpband.dll 11.0.6000.6324 (vista_rtm.061101-2205) Windows Media Player Deskband
MPR.dll 75860000 81920 C:\Windows\system32\MPR.dll 6.0.6000.16386 (vista_rtm.061101-2205) Multiple Provider Router DLL
WINBRAND.dll 75290000 880640 C:\Windows\system32\WINBRAND.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Branding Resources
shacct.dll 737b0000 90112 C:\Windows\System32\shacct.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Shell Accounts Classes
SAMLIB.dll 758e0000 69632 C:\Windows\System32\SAMLIB.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) SAM Library DLL
msshsq.dll 6f9b0000 245760 C:\Windows\System32\msshsq.dll 7.00.6001.18528 (vistasp1_gdr_oobsvc.100919-1500) Structured Query
NaturalLanguage6.dll 6f150000 811008 C:\Windows\System32\NaturalLanguage6.dll 6.0.6001.18098 (vistasp1_gdr.080625-1507) Natural Language Development Platform 6
CRYPT32.dll 75760000 987136 C:\Windows\System32\CRYPT32.dll 6.0.6000.16386 (vista_rtm.061101-2205) Crypto API32
MSASN1.dll 758c0000 73728 C:\Windows\System32\MSASN1.dll 6.0.6001.18326 (vistasp1_gdr.090903-2340) ASN.1 Runtime APIs
authui.dll 73b90000 1998848 C:\Windows\system32\authui.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Authentication UI
MSIMG32.dll 750a0000 20480 C:\Windows\system32\MSIMG32.dll 6.0.6000.16386 (vista_rtm.061101-2205) GDIEXT Client DLL
LINKINFO.dll 6fd50000 36864 C:\Windows\system32\LINKINFO.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Volume Tracking
urlmon.dll 77250000 1220608 C:\Windows\system32\urlmon.dll 7.00.6001.18000 (longhorn_rtm.080118-1840) OLE32 Extensions for Win32
iertutil.dll 77810000 286720 C:\Windows\system32\iertutil.dll 7.00.6001.18639 (vistasp1_gdr.110421-0338) Run time utility for Internet Explorer
NTMARTA.DLL 75150000 135168 C:\Windows\system32\NTMARTA.DLL 6.0.6000.16386 (vista_rtm.061101-2205) Windows NT MARTA provider
WLDAP32.dll 777c0000 303104 C:\Windows\system32\WLDAP32.dll 6.0.6000.16386 (vista_rtm.061101-2205) Win32 LDAP API DLL
WS2_32.dll 76ea0000 184320 C:\Windows\system32\WS2_32.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Socket 2.0 32-Bit DLL
NSI.dll 76b00000 24576 C:\Windows\system32\NSI.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) NSI User-mode interface DLL
ieframe.dll 6d9c0000 6094848 C:\Windows\system32\ieframe.dll 7.00.6000.16386 (vista_rtm.061101-2205) Internet Explorer
WINMM.dll 73a10000 204800 C:\Windows\system32\WINMM.dll 6.0.6000.16386 (vista_rtm.061101-2205) MCI API DLL
wdmaud.drv 739e0000 192512 C:\Windows\system32\wdmaud.drv 6.0.6000.16386 (vista_rtm.061101-2205) Winmm audio system driver
ksuser.dll 74b10000 16384 C:\Windows\system32\ksuser.dll 6.0.6000.16386 (vista_rtm.061101-2205) User CSA Library
MMDevAPI.DLL 74ba0000 159744 C:\Windows\system32\MMDevAPI.DLL 6.0.6000.16386 (vista_rtm.061101-2205) MMDevice API
AVRT.dll 75090000 28672 C:\Windows\system32\AVRT.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Multimedia Realtime Runtime
thumbcache.dll 6d610000 90112 C:\Windows\system32\thumbcache.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft Thumbnail Cache
ntshrui.dll 6d390000 303104 C:\Windows\system32\ntshrui.dll 6.0.6000.16386 (vista_rtm.061101-2205) Shell extensions for sharing
SETUPAPI.dll 76bb0000 1613824 C:\Windows\system32\SETUPAPI.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Setup API
cscapi.dll 6f520000 45056 C:\Windows\system32\cscapi.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Offline Files Win32 API
WINTRUST.dll 74b40000 184320 C:\Windows\system32\WINTRUST.dll 6.0.6001.18387 (vistasp1_gdr.091222-2238) Microsoft Trust Verification APIs
imagehlp.dll 77220000 167936 C:\Windows\system32\imagehlp.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows NT Image Helper
msiltcfg.dll 6df90000 28672 C:\Windows\system32\msiltcfg.dll 4.0.6000.16386 (vista_rtm.061101-2205) Windows Installer Configuration API Stub
VERSION.dll 75110000 32768 C:\Windows\system32\VERSION.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Version Checking and File Installation Libraries
ExplorerFrame.dll 6d7a0000 36864 C:\Windows\system32\ExplorerFrame.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) ExplorerFrame
WININET.dll 77140000 856064 C:\Windows\system32\WININET.dll 7.00.6000.16386 (vista_rtm.061101-2205) Internet Extensions for Win32
Normaliz.dll 76ba0000 12288 C:\Windows\system32\Normaliz.dll 6.0.6000.16386 (vista_rtm.061101-2205) Unicode Normalization DLL
AUDIOSES.DLL 736c0000 135168 C:\Windows\system32\AUDIOSES.DLL 6.0.6001.18000 (longhorn_rtm.080118-1840) Audio Session
audioeng.dll 720e0000 417792 C:\Windows\system32\audioeng.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Audio Engine
msacm32.drv 73af0000 36864 C:\Windows\system32\msacm32.drv 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft Sound Mapper
MSACM32.dll 735b0000 81920 C:\Windows\system32\MSACM32.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft ACM Audio Filter
midimap.dll 73690000 28672 C:\Windows\system32\midimap.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft MIDI Mapper
NLSData0009.dll 6c8f0000 4886528 C:\Windows\System32\NLSData0009.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Microsoft English Natural Language Server Data and Code
NLSLexicons0009.dll 6c660000 2650112 C:\Windows\System32\NLSLexicons0009.dll 6.0.6001.18098 (vistasp1_gdr.080625-1507) Microsoft English Natural Language Server Data and Code
stobject.dll 6e870000 598016 C:\Windows\system32\stobject.dll 6.0.6000.16386 (vista_rtm.061101-2205) Systray shell service object
BatMeter.dll 6e7b0000 745472 C:\Windows\system32\BatMeter.dll 6.0.6000.16386 (vista_rtm.061101-2205) Battery Meter Helper DLL
WTSAPI32.dll 750c0000 40960 C:\Windows\system32\WTSAPI32.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Terminal Server SDK APIs
WINSTA.dll 75550000 151552 C:\Windows\system32\WINSTA.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Winstation Library
es.dll 71fc0000 290816 C:\Windows\system32\es.dll 2001.12.6931.18057 (vistasp1_gdr.080417-1550) COM+
SndVolSSO.dll 6e610000 196608 C:\Windows\System32\SndVolSSO.dll 6.0.6000.16386 (vista_rtm.061101-2205) SCA Volume
ehSSO.dll 6c420000 135168 C:\Windows\ehome\ehSSO.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Media Center Shell Service Object
HID.DLL 720d0000 36864 C:\Windows\system32\HID.DLL 6.0.6000.16386 (vista_rtm.061101-2205) Hid User Library
netshell.dll 6b680000 3190784 C:\Windows\System32\netshell.dll 6.0.6000.16386 (vista_rtm.061101-2205) Network Connections Shell
IPHLPAPI.DLL 75650000 102400 C:\Windows\System32\IPHLPAPI.DLL 6.0.6000.16386 (vista_rtm.061101-2205) IP Helper API
dhcpcsvc.DLL 75690000 217088 C:\Windows\System32\dhcpcsvc.DLL 6.0.6000.16386 (vista_rtm.061101-2205) DHCP Client Service
DNSAPI.dll 75920000 180224 C:\Windows\System32\DNSAPI.dll 6.0.6000.16386 (vista_rtm.061101-2205) DNS Client API DLL
WINNSI.DLL 75750000 28672 C:\Windows\System32\WINNSI.DLL 6.0.6001.18000 (longhorn_rtm.080118-1840) Network Store Information RPC interface
dhcpcsvc6.DLL 75620000 135168 C:\Windows\System32\dhcpcsvc6.DLL 6.0.6000.16386 (vista_rtm.061101-2205) DHCPv6 Client
nlaapi.dll 74660000 61440 C:\Windows\System32\nlaapi.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Network Location Awareness 2
FirewallAPI.dll 74db0000 417792 C:\Windows\system32\FirewallAPI.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Firewall API
pnidui.dll 6bf00000 1830912 C:\Windows\system32\pnidui.dll 6.0.6000.16386 (vista_rtm.061101-2205) Network System Icon
QUtil.dll 6f130000 94208 C:\Windows\system32\QUtil.dll 6.0.6000.16386 (vista_rtm.061101-2205) Quarantine Utilities
wevtapi.dll 756d0000 262144 C:\Windows\system32\wevtapi.dll 6.0.6000.16386 (vista_rtm.061101-2205) Eventing Consumption and Configuration API
wlanutil.dll 71b60000 24576 C:\Windows\system32\wlanutil.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Wireless LAN 802.11 Utility DLL
FunDisc.dll 6d800000 159744 C:\Windows\system32\FunDisc.dll 6.0.6000.16386 (vista_rtm.061101-2205) Function Discovery Dll
fdproxy.dll 737d0000 36864 C:\Windows\system32\fdproxy.dll 6.0.6000.16386 (vista_rtm.061101-2205) Function Discovery Proxy Dll
msxml3.dll 6d4c0000 1269760 C:\Windows\System32\msxml3.dll 8.100.4002.0 MSXML 3.0 SP10
SXS.DLL 75c40000 389120 C:\Windows\system32\SXS.DLL 6.0.6000.16386 (vista_rtm.061101-2205) Fusion 2.5
oobefldr.dll 6bca0000 2162688 C:\Windows\system32\oobefldr.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Welcome Center
toolband.dll 10000000 380928 C:\Program Files\Lexmark Toolbar\toolband.dll
WINSPOOL.DRV 6e470000 270336 C:\Windows\system32\WINSPOOL.DRV 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Spooler Driver
resource.dll 6fe0000 466944 C:\Program Files\Lexmark Toolbar\resource.dll
npmproxy.dll 6eb80000 32768 C:\Windows\System32\npmproxy.dll 6.0.6000.16386 (vista_rtm.061101-2205) Network List Manager Proxy
Wlanapi.dll 6ed20000 73728 C:\Windows\system32\Wlanapi.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows WLAN AutoConfig Client Side API DLL
OneX.DLL 718f0000 1556480 C:\Windows\system32\OneX.DLL 6.0.6001.18000 (longhorn_rtm.080118-1840) IEEE 802.1X supplicant library
eappprxy.dll 71c90000 57344 C:\Windows\system32\eappprxy.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Microsoft EAPHost Peer Client DLL
eappcfg.dll 71b70000 147456 C:\Windows\system32\eappcfg.dll 6.0.6000.16386 (vista_rtm.061101-2205) Eap Peer Config
bcrypt.dll 75590000 282624 C:\Windows\system32\bcrypt.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Cryptographic Primitives Library
AltTab.dll 69ef0000 53248 C:\Windows\System32\AltTab.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Shell Alt Tab
wpdshserviceobj.dll 69bc0000 143360 C:\Windows\system32\wpdshserviceobj.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Portable Device Shell Service Object
WINHTTP.dll 6f540000 393216 C:\Windows\system32\WINHTTP.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows HTTP Services
srchadmin.dll 69320000 315392 C:\Windows\System32\srchadmin.dll 7.0.6001.16503 (longhorn(wmbla).080526-2159) Indexing Options
webcheck.dll 69a30000 245760 C:\Windows\system32\webcheck.dll 7.00.6000.16386 (vista_rtm.061101-2205) Web Site Monitor
mssprxy.dll 6a670000 45056 C:\Windows\system32\mssprxy.dll 7.0.6001.16503 (longhorn(wmbla).080526-2159) Microsoft Search Proxy
SyncCenter.dll 69810000 2211840 C:\Windows\System32\SyncCenter.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft Sync Center
bthprops.cpl 69050000 1019904 C:\Windows\system32\bthprops.cpl 6.0.6000.16386 (vista_rtm.061101-2205) Bluetooth Control Panel Applet
imapi2.dll 69260000 331776 C:\Windows\system32\imapi2.dll 6.0.6000.16386 (vista_rtm.061101-2205) Image Mastering API v2
PortableDeviceTypes.dll 69a80000 176128 C:\Windows\system32\PortableDeviceTypes.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Portable Device (Parameter) Types Component
PortableDeviceApi.dll 6cdc0000 253952 C:\Windows\system32\PortableDeviceApi.dll 6.0.6001.18160 (vistasp1_gdr.081021-1528) Windows Portable Device API Components
ntlanman.dll 69d70000 77824 C:\Windows\System32\ntlanman.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft® Lan Manager
drprov.dll 69eb0000 32768 C:\Windows\System32\drprov.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft Terminal Server Network Provider
davclnt.dll 69df0000 61440 C:\Windows\System32\davclnt.dll 6.0.6000.16386 (vista_rtm.061101-2205) Web DAV Client DLL
MLANG.dll 69e20000 196608 C:\Windows\system32\MLANG.dll 6.0.6000.16386 (vista_rtm.061101-2205) Multi Language Support DLL
mscms.dll 6b9f0000 401408 C:\Windows\system32\mscms.dll 6.0.6000.16386 (vista_rtm.061101-2205) Microsoft Color Matching System DLL
WinSATAPI.dll 67e60000 393216 C:\Windows\system32\WinSATAPI.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows System Assessment Tool API
msxml6.dll 70a50000 1417216 C:\Windows\System32\msxml6.dll 6.20.4001.0 MSXML 6.0 SP2
Cabinet.dll 74a60000 86016 C:\Windows\system32\Cabinet.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Microsoft® Cabinet File API
QAgent.dll 6f0f0000 188416 C:\Windows\System32\QAgent.dll 6.0.6000.16386 (vista_rtm.061101-2205) Quarantine Agent Proxy
fwpuclnt.dll 6ed60000 614400 C:\Windows\System32\fwpuclnt.dll 6.0.6000.16386 (vista_rtm.061101-2205) FWP/IPsec User-Mode API
wbemprox.dll 6e910000 45056 C:\Windows\system32\wbem\wbemprox.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) WMI
wbemcomn.dll 6e040000 372736 C:\Windows\system32\wbemcomn.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) WMI
wbemsvc.dll 6bab0000 65536 C:\Windows\system32\wbem\wbemsvc.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) WMI
fastprox.dll 6a6d0000 626688 C:\Windows\system32\wbem\fastprox.dll 6.0.6001.18226 (vistasp1_gdr.090302-1506) WMI Custom Marshaller
NTDSAPI.dll 758a0000 98304 C:\Windows\system32\NTDSAPI.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Active Directory Domain Services API
tquery.dll 6b080000 1593344 C:\Windows\system32\tquery.dll 7.0.6001.16503 (longhorn(wmbla).080526-2159) tquery.dll
zipfldr.dll 6e930000 356352 C:\Windows\system32\zipfldr.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Compressed (zipped) Folders
mbamext.dll 6d840000 98304 C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll 1.61.0.0000 Malwarebytes Anti-Malware
syncui.dll 68b90000 188416 C:\Windows\system32\syncui.dll 6.0.6000.16386 (vista_rtm.061101-2205) Windows Briefcase
SYNCENG.dll 6a530000 90112 C:\Windows\system32\SYNCENG.dll 6.0.6001.18000 (longhorn_rtm.080118-1840) Windows Briefcase Engine
MpOav.dll 6d420000 90112 C:\Program Files\Windows Defender\MpOav.dll 1.1.1600.0 IOfficeAntiVirus Module
tiptsf.dll 68ce0000 393216 C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll 6.0.6000.16386 (vista_rtm.061101-2205) Tablet PC Input Panel Text Services Framework
AcroIEHelper.dll 2a30000 65536 C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 8.3.1.289 Adobe PDF Helper for Internet Explorer
MSVCR80.dll 74eb0000 634880 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.3053_none_d08d7bba442a9b36\MSVCR80.dll 8.00.50727.3053 Microsoft® C Runtime Library
xmllite.dll 74b70000 192512 C:\Windows\system32\xmllite.dll 1.2.1009.0 Microsoft XmlLite Library




******************************************
EOF

SVCHOST Diag



~~~~~Services loaded under SVCHOST~~~~~


Image Name: svchost.exe
PID: 900
Services: DcomLaunch
PlugPlay

Image Name: svchost.exe
PID: 1020
Services: RpcSs

Image Name: svchost.exe
PID: 1060
Services: Audiosrv
Dhcp
Eventlog
lmhosts
wscsvc

Image Name: svchost.exe
PID: 1152
Services: AudioEndpointBuilder
EMDMgmt
hidserv
Netman
PcaSvc
SysMain
TabletInputService
TrkWks
UxSms
WdiSystemHost
Wlansvc
WPDBusEnum
wudfsvc

Image Name: svchost.exe
PID: 1168
Services: AeLookupSvc
Appinfo
BITS
Browser
EapHost
gpsvc
iphlpsvc
LanmanServer
MMCSS
ProfSvc
RasMan
Schedule
seclogon
SENS
ShellHWDetection
Themes
Winmgmt
wuauserv

Image Name: svchost.exe
PID: 1372
Services: EventSystem
fdPHost
FDResPub
LanmanWorkstation
netprofm
nsi
SSDPSRV
SstpSvc
W32Time
WebClient
WinHttpAutoProxySvc

Image Name: svchost.exe
PID: 1556
Services: CryptSvc
Dnscache
KtmRm
NlaSvc
TapiSrv
TermService

Image Name: svchost.exe
PID: 2100
Services: DPS

Image Name: svchost.exe
PID: 2780
Services: stisvc

Image Name: svchost.exe
PID: 3300
Services: WerSvc


~~~~~Modules loaded under SVCHOST~~~~~


Image Name: svchost.exe
PID: 900
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
umpnpmgr.dll
USER32.dll
GDI32.dll
USERENV.dll
Secur32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
POWRPROF.dll
GPAPI.dll
slc.dll
rpcss.dll
WS2_32.dll
NSI.dll
FirewallAPI.dll
OLEAUT32.dll
ole32.dll
VERSION.dll
CRYPT32.dll
MSASN1.dll
credssp.dll
schannel.dll
NETAPI32.dll
PSAPI.DLL
SETUPAPI.dll
Cabinet.dll
NTMARTA.DLL
WLDAP32.dll
SAMLIB.dll
WINSTA.dll
CLBCatQ.DLL
apphelp.dll
WTSAPI32.dll

Image Name: svchost.exe
PID: 1020
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
rpcss.dll
WS2_32.dll
NSI.dll
Secur32.dll
FirewallAPI.dll
USER32.dll
GDI32.dll
OLEAUT32.dll
ole32.dll
VERSION.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
CRYPT32.dll
MSASN1.dll
USERENV.dll
credssp.dll
schannel.dll
NETAPI32.dll
PSAPI.DLL
rsaenh.dll
mswsock.dll
wshtcpip.dll
wship6.dll
CLBCatQ.DLL
WTSAPI32.dll
WINSTA.dll

Image Name: svchost.exe
PID: 1060
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
wevtsvc.dll
USERENV.dll
Secur32.dll
USER32.dll
GDI32.dll
VERSION.dll
GPAPI.dll
slc.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
CRYPT32.dll
MSASN1.dll
credssp.dll
schannel.dll
NETAPI32.dll
PSAPI.DLL
WS2_32.dll
NSI.dll
mswsock.dll
wshtcpip.dll
wship6.dll
audiosrv.dll
ole32.dll
OLEAUT32.dll
MMDevAPI.DLL
SHLWAPI.dll
WTSAPI32.dll
WINSTA.dll
comctl32.dll
CLBCatQ.DLL
SETUPAPI.dll
WINTRUST.dll
imagehlp.dll
rsaenh.dll
audioses.dll
audioeng.dll
AVRT.dll
lmhsvc.dll
IPHLPAPI.DLL
dhcpcsvc.DLL
DNSAPI.dll
WINNSI.DLL
dhcpcsvc6.DLL
wscsvc.dll
FirewallAPI.dll
dbghelp.dll
wbemprox.dll
wbemcomn.dll
wbemsvc.dll
fastprox.dll
NTDSAPI.dll
WLDAP32.dll
ncrypt.dll
BCRYPT.dll
wuapi.dll
Cabinet.dll

Image Name: svchost.exe
PID: 1152
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
NTMARTA.DLL
USER32.dll
GDI32.dll
WLDAP32.dll
WS2_32.dll
NSI.dll
PSAPI.DLL
SAMLIB.dll
ole32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
audiosrv.dll
OLEAUT32.dll
MMDevAPI.DLL
SHLWAPI.dll
WTSAPI32.dll
WINSTA.dll
comctl32.dll
CLBCatQ.DLL
SETUPAPI.dll
WINTRUST.dll
CRYPT32.dll
MSASN1.dll
USERENV.dll
Secur32.dll
imagehlp.dll
uxsms.dll
tabsvc.dll
HID.DLL
slc.dll
wudfsvc.dll
WUDFPlatform.dll
VERSION.dll
wevtapi.dll
wlansvc.dll
NETAPI32.dll
SHELL32.dll
WLANMSM.DLL
WLANSEC.dll
OneX.DLL
eappprxy.dll
eappcfg.dll
gdiplus.dll
DUser.dll
UxTheme.dll
OLEACC.dll
AUTHZ.dll
dhcpcsvc.DLL
DNSAPI.dll
WINNSI.DLL
wlgpclnt.dll
l2gpstore.dll
wlanutil.dll
SYSNTFY.dll
WinSCard.dll
IPHLPAPI.DLL
dhcpcsvc6.DLL
bcrypt.dll
msxml6.dll
rsaenh.dll
credssp.dll
schannel.dll
kerberos.dll
cryptdll.dll
apphelp.dll
netcfgx.dll
Cabinet.dll
emdmgmt.dll
WDSCORE.dll
SLWGA.dll
urlmon.dll
iertutil.dll
hidserv.dll
pcasvc.dll
netman.dll
RASAPI32.dll
rasman.dll
TAPI32.dll
rtutils.dll
WINMM.dll
sysmain.dll
trkwks.dll
netshell.dll
nlaapi.dll
wpdbusenum.dll
GPAPI.dll
PortableDeviceApi.dll
wdi.dll
pcadm.dll
RASDLG.dll
MPRAPI.dll
ACTIVEDS.dll
adsldpc.dll
credui.dll
ATL.DLL
hnetcfg.dll
WINHTTP.dll
mswsock.dll
wshtcpip.dll
upnp.dll
SSDPAPI.dll
SXS.DLL
msxml3.dll
wbemprox.dll
wbemcomn.dll
wbemsvc.dll
fastprox.dll
NTDSAPI.dll
radardt.dll

Image Name: svchost.exe
PID: 1168
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
NTMARTA.DLL
USER32.dll
GDI32.dll
WLDAP32.dll
WS2_32.dll
NSI.dll
PSAPI.DLL
SAMLIB.dll
ole32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
mmcss.dll
AVRT.dll
gpsvc.dll
Secur32.dll
NETAPI32.dll
NTDSAPI.dll
DNSAPI.dll
WTSAPI32.dll
OLEAUT32.dll
USERENV.dll
GPAPI.dll
slc.dll
AUTHZ.dll
SYSNTFY.dll
WINSTA.dll
nlaapi.dll
IPHLPAPI.DLL
dhcpcsvc.DLL
WINNSI.DLL
dhcpcsvc6.DLL
profsvc.dll
ATL.DLL
shsvcs.dll
sens.dll
UxTheme.dll
rsaenh.dll
eapsvc.dll
eapphost.dll
CLBCatQ.DLL
umb.dll
SETUPAPI.dll
WINTRUST.dll
CRYPT32.dll
MSASN1.dll
imagehlp.dll
PROPSYS.dll
SXS.DLL
COMCTL32.dll
schedsvc.dll
SHLWAPI.dll
wevtapi.dll
ktmw32.dll
comctl32.dll
credssp.dll
schannel.dll
wiarpc.dll
taskcomp.dll
VERSION.dll
mswsock.dll
wshtcpip.dll
wship6.dll
apphelp.dll
tschannel.dll
srvsvc.dll
SSCORE.DLL
FirewallAPI.DLL
CLUSAPI.DLL
cryptdll.dll
ACTIVEDS.dll
adsldpc.dll
credui.dll
SHELL32.dll
RESUTILS.DLL
browser.dll
aelupsvc.dll
seclogon.dll
wmisvc.dll
wbemcomn.dll
iphlpsvc.dll
fwpuclnt.dll
rtutils.dll
sqmapi.dll
bcrypt.dll
rasmans.dll
Cabinet.dll
rastapi.dll
TAPI32.dll
WINMM.dll
OLEACC.dll
rasppp.dll
MPRAPI.dll
RASAPI32.dll
rasman.dll
kerberos.dll
RASQEC.DLL
QUtil.dll
raschap.dll
rastls.dll
CRYPTUI.dll
MSIMG32.dll
WinSCard.dll
VSSAPI.DLL
vsstrace.dll
XmlLite.dll
MPR.dll
wbemcore.dll
esscli.dll
FastProx.dll
wbemsvc.dll
wmiutils.dll
repdrvfs.dll
wmiprvsd.dll
NCObjAPI.DLL
wbemess.dll
napinsp.dll
pnrpnsp.dll
winrnr.dll
rasadhlp.dll
appinfo.dll
ncprov.dll
qmgr.dll
SHFOLDER.dll
WINHTTP.dll
bitsperf.dll
bitsigd.dll
upnp.dll
SSDPAPI.dll
msxml3.dll
urlmon.dll
iertutil.dll
wuaueng.dll
ESENT.dll
WINSPOOL.DRV
mspatcha.dll
WMsgAPI.dll
wer.dll
SensApi.dll
ncrypt.dll
wups2.dll
dssenh.dll
qmgrprxy.dll

Image Name: svchost.exe
PID: 1372
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
NTMARTA.DLL
USER32.dll
GDI32.dll
WLDAP32.dll
WS2_32.dll
NSI.dll
PSAPI.DLL
SAMLIB.dll
ole32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
es.dll
OLEAUT32.dll
PROPSYS.dll
rsaenh.dll
CLBCatQ.DLL
nsisvc.dll
secur32.dll
CRYPT32.dll
MSASN1.dll
USERENV.dll
credssp.dll
schannel.dll
NETAPI32.dll
SXS.DLL
webclnt.dll
WINHTTP.dll
SHLWAPI.dll
urlmon.dll
iertutil.dll
comctl32.dll
shell32.dll
WinInet.dll
Normaliz.dll
wkssvc.dll
IPHLPAPI.DLL
dhcpcsvc.DLL
DNSAPI.dll
WINNSI.DLL
dhcpcsvc6.DLL
NTDSAPI.dll
WINBRAND.dll
fdrespub.dll
wsdapi.dll
HTTPAPI.dll
WINTRUST.dll
imagehlp.dll
XmlLite.dll
FirewallAPI.dll
VERSION.dll
FunDisc.dll
ATL.DLL
SETUPAPI.dll
mswsock.dll
wshtcpip.dll
wship6.dll
msxml3.dll
sstpsvc.dll
rtutils.dll
w32time.dll
cryptdll.dll
GPAPI.dll
slc.dll
netprofm.dll
nlaapi.dll
npmproxy.dll
fdphost.dll
fdwsd.dll
MLANG.dll
fdssdp.dll
SSDPAPI.dll
fdproxy.dll
ssdpsrv.dll
napinsp.dll
pnrpnsp.dll
winrnr.dll
rasadhlp.dll

Image Name: svchost.exe
PID: 1556
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
NTMARTA.DLL
USER32.dll
GDI32.dll
WLDAP32.dll
WS2_32.dll
NSI.dll
PSAPI.DLL
SAMLIB.dll
ole32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
dnsrslvr.dll
DNSAPI.dll
dhcpcsvc.DLL
Secur32.dll
WINNSI.DLL
dhcpcsvc6.DLL
IPHLPAPI.DLL
mswsock.dll
wship6.dll
wshtcpip.dll
cryptsvc.dll
OLEAUT32.dll
VSSAPI.DLL
ATL.DLL
vsstrace.dll
AUTHZ.dll
XmlLite.dll
NETAPI32.dll
MPR.dll
SETUPAPI.dll
CRYPT32.dll
MSASN1.dll
USERENV.dll
nlasvc.dll
wevtapi.dll
ncsi.dll
WINHTTP.dll
SHLWAPI.dll
WTSAPI32.dll
bcrypt.dll
CFGMGR32.dll
comctl32.dll
rsaenh.dll
credssp.dll
schannel.dll
CLBCatQ.DLL
es.dll
PROPSYS.dll
ssdpapi.dll
tapisrv.dll
ACTIVEDS.dll
adsldpc.dll
credui.dll
SHELL32.dll
rtutils.dll
WINMM.dll
OLEACC.dll
termsrv.dll
ICAAPI.dll
WINTRUST.dll
imagehlp.dll
WINSTA.dll
unimdm.tsp
uniplat.dll
unimdmat.dll
VERSION.dll
modemui.dll
kmddsp.tsp
ndptsp.tsp
hidphone.tsp
HID.DLL
napinsp.dll
pnrpnsp.dll
winrnr.dll
rasadhlp.dll
msdtckrm.dll
ktmw32.dll
CLUSAPI.dll
NTDSAPI.dll
cryptdll.dll
CRYPTNET.dll
SensApi.dll
ESENT.dll

Image Name: svchost.exe
PID: 2100
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
dps.dll
wdi.dll
USER32.dll
GDI32.dll
USERENV.dll
Secur32.dll
OLEAUT32.dll
ole32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
CLBCatQ.DLL
taskschd.dll
SHLWAPI.dll
XmlLite.dll
comctl32.dll
GPAPI.dll
slc.dll
diagperf.dll
SHELL32.dll
pnpts.dll
VERSION.dll
iphlpapi.dll
dhcpcsvc.DLL
DNSAPI.dll
WS2_32.dll
NSI.dll
WINNSI.DLL
dhcpcsvc6.DLL
WINTRUST.dll
CRYPT32.dll
MSASN1.dll
imagehlp.dll

Image Name: svchost.exe
PID: 2780
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
wiaservc.dll
USER32.dll
GDI32.dll
OLEAUT32.dll
ole32.dll
VERSION.dll
COMDLG32.dll
SHLWAPI.dll
COMCTL32.dll
SHELL32.dll
IMM32.DLL
MSCTF.dll
LPK.DLL
USP10.dll
comctl32.dll
wiatrace.dll
secur32.dll
CRYPT32.dll
MSASN1.dll
USERENV.dll
credssp.dll
schannel.dll
NETAPI32.dll
PSAPI.DLL
msv1_0.dll
cryptdll.dll
WS2_32.dll
NSI.dll
WSDCHNGR.DLL
CLBCatQ.DLL
FunDisc.dll
ATL.DLL
SETUPAPI.dll
msxml3.dll
WINTRUST.dll
imagehlp.dll
rsaenh.dll
CFGMGR32.dll

Image Name: svchost.exe
PID: 3300
Modules: ntdll.dll
kernel32.dll
snxhk.dll
msvcrt.dll
ADVAPI32.dll
RPCRT4.dll
wersvc.dll


~~~~~SVCHOST service~~~~~

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"LocalService"=hex(7):6e,00,73,00,69,00,00,00,6c,00,6c,00,74,00,64,00,73,00,76,\
00,63,00,00,00,53,00,53,00,44,00,50,00,53,00,52,00,56,00,00,00,75,00,70,00,\
6e,00,70,00,68,00,6f,00,73,00,74,00,00,00,53,00,43,00,61,00,72,00,64,00,53,\
00,76,00,72,00,00,00,77,00,33,00,32,00,74,00,69,00,6d,00,65,00,00,00,45,00,\
76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,52,00,65,\
00,6d,00,6f,00,74,00,65,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,00,\
00,00,57,00,69,00,6e,00,48,00,74,00,74,00,70,00,41,00,75,00,74,00,6f,00,50,\
00,72,00,6f,00,78,00,79,00,53,00,76,00,63,00,00,00,6c,00,61,00,6e,00,6d,00,\
61,00,6e,00,77,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,\
00,00,00,54,00,42,00,53,00,00,00,53,00,4c,00,55,00,49,00,4e,00,6f,00,74,00,\
69,00,66,00,79,00,00,00,54,00,48,00,52,00,45,00,41,00,44,00,4f,00,52,00,44,\
00,45,00,52,00,00,00,66,00,64,00,72,00,65,00,73,00,70,00,75,00,62,00,00,00,\
6e,00,65,00,74,00,70,00,72,00,6f,00,66,00,6d,00,00,00,66,00,64,00,70,00,68,\
00,6f,00,73,00,74,00,00,00,77,00,63,00,6e,00,63,00,73,00,76,00,63,00,00,00,\
51,00,57,00,41,00,56,00,45,00,00,00,4d,00,63,00,78,00,32,00,53,00,76,00,63,\
00,00,00,57,00,65,00,62,00,43,00,6c,00,69,00,65,00,6e,00,74,00,00,00,53,00,\
73,00,74,00,70,00,53,00,76,00,63,00,00,00,00,00
"LocalSystemNetworkRestricted"=hex(7):68,00,69,00,64,00,73,00,65,00,72,00,76,\
00,00,00,55,00,78,00,53,00,6d,00,73,00,00,00,57,00,64,00,69,00,53,00,79,00,\
73,00,74,00,65,00,6d,00,48,00,6f,00,73,00,74,00,00,00,4e,00,65,00,74,00,6d,\
00,61,00,6e,00,00,00,74,00,72,00,6b,00,77,00,6b,00,73,00,00,00,41,00,75,00,\
64,00,69,00,6f,00,45,00,6e,00,64,00,70,00,6f,00,69,00,6e,00,74,00,42,00,75,\
00,69,00,6c,00,64,00,65,00,72,00,00,00,57,00,55,00,44,00,46,00,53,00,76,00,\
63,00,00,00,69,00,72,00,6d,00,6f,00,6e,00,00,00,73,00,79,00,73,00,6d,00,61,\
00,69,00,6e,00,00,00,49,00,50,00,42,00,75,00,73,00,45,00,6e,00,75,00,6d,00,\
00,00,64,00,6f,00,74,00,33,00,73,00,76,00,63,00,00,00,50,00,63,00,61,00,53,\
00,76,00,63,00,00,00,45,00,4d,00,44,00,4d,00,67,00,6d,00,74,00,00,00,54,00,\
61,00,62,00,6c,00,65,00,74,00,49,00,6e,00,70,00,75,00,74,00,53,00,65,00,72,\
00,76,00,69,00,63,00,65,00,00,00,77,00,6c,00,61,00,6e,00,73,00,76,00,63,00,\
00,00,57,00,50,00,44,00,42,00,75,00,73,00,45,00,6e,00,75,00,6d,00,00,00,00,\
00
"NetworkServiceNetworkRestricted"=hex(7):50,00,6f,00,6c,00,69,00,63,00,79,00,\
41,00,67,00,65,00,6e,00,74,00,00,00,00,00
"LocalServiceNoNetwork"=hex(7):50,00,4c,00,41,00,00,00,44,00,50,00,53,00,00,00,\
42,00,46,00,45,00,00,00,6d,00,70,00,73,00,73,00,76,00,63,00,00,00,65,00,68,\
00,73,00,74,00,61,00,72,00,74,00,00,00,00,00
"NetworkService"=hex(7):43,00,72,00,79,00,70,00,74,00,53,00,76,00,63,00,00,00,\
44,00,48,00,43,00,50,00,00,00,54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,\
00,69,00,63,00,65,00,00,00,4b,00,74,00,6d,00,52,00,6d,00,00,00,44,00,4e,00,\
53,00,43,00,61,00,63,00,68,00,65,00,00,00,4e,00,61,00,70,00,41,00,67,00,65,\
00,6e,00,74,00,00,00,6e,00,6c,00,61,00,73,00,76,00,63,00,00,00,57,00,69,00,\
6e,00,52,00,4d,00,00,00,57,00,45,00,43,00,53,00,56,00,43,00,00,00,54,00,61,\
00,70,00,69,00,73,00,72,00,76,00,00,00,00,00
"termsvcs"=hex(7):54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,69,00,63,00,\
65,00,00,00,00,00
"WerSvcGroup"=hex(7):77,00,65,00,72,00,73,00,76,00,63,00,00,00,00,00
"netsvcs"=hex(7):41,00,65,00,4c,00,6f,00,6f,00,6b,00,75,00,70,00,53,00,76,00,\
63,00,00,00,77,00,65,00,72,00,63,00,70,00,6c,00,73,00,75,00,70,00,70,00,6f,\
00,72,00,74,00,00,00,54,00,68,00,65,00,6d,00,65,00,73,00,00,00,43,00,65,00,\
72,00,74,00,50,00,72,00,6f,00,70,00,53,00,76,00,63,00,00,00,53,00,43,00,50,\
00,6f,00,6c,00,69,00,63,00,79,00,53,00,76,00,63,00,00,00,6c,00,61,00,6e,00,\
6d,00,61,00,6e,00,73,00,65,00,72,00,76,00,65,00,72,00,00,00,67,00,70,00,73,\
00,76,00,63,00,00,00,49,00,4b,00,45,00,45,00,58,00,54,00,00,00,41,00,75,00,\
64,00,69,00,6f,00,53,00,72,00,76,00,00,00,46,00,61,00,73,00,74,00,55,00,73,\
00,65,00,72,00,53,00,77,00,69,00,74,00,63,00,68,00,69,00,6e,00,67,00,43,00,\
6f,00,6d,00,70,00,61,00,74,00,69,00,62,00,69,00,6c,00,69,00,74,00,79,00,00,\
00,49,00,61,00,73,00,00,00,49,00,72,00,6d,00,6f,00,6e,00,00,00,4e,00,6c,00,\
61,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,00,00,00,4e,00,57,00,43,\
00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,00,00,00,\
4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,00,74,00,00,00,52,00,61,\
00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,73,00,6d,00,61,00,6e,00,\
00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,00,63,00,65,00,73,00,73,\
00,00,00,53,00,45,00,4e,00,53,00,00,00,53,00,68,00,61,00,72,00,65,00,64,00,\
61,00,63,00,63,00,65,00,73,00,73,00,00,00,53,00,52,00,53,00,65,00,72,00,76,\
00,69,00,63,00,65,00,00,00,54,00,61,00,70,00,69,00,73,00,72,00,76,00,00,00,\
57,00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,70,00,00,\
00,54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00,\
77,00,75,00,61,00,75,00,73,00,65,00,72,00,76,00,00,00,42,00,49,00,54,00,53,\
00,00,00,53,00,68,00,65,00,6c,00,6c,00,48,00,57,00,44,00,65,00,74,00,65,00,\
63,00,74,00,69,00,6f,00,6e,00,00,00,4c,00,6f,00,67,00,6f,00,6e,00,48,00,6f,\
00,75,00,72,00,73,00,00,00,50,00,43,00,41,00,75,00,64,00,69,00,74,00,00,00,\
68,00,65,00,6c,00,70,00,73,00,76,00,63,00,00,00,75,00,70,00,6c,00,6f,00,61,\
00,64,00,6d,00,67,00,72,00,00,00,69,00,70,00,68,00,6c,00,70,00,73,00,76,00,\
63,00,00,00,73,00,65,00,63,00,6c,00,6f,00,67,00,6f,00,6e,00,00,00,41,00,70,\
00,70,00,49,00,6e,00,66,00,6f,00,00,00,6d,00,73,00,69,00,73,00,63,00,73,00,\
69,00,00,00,4d,00,4d,00,43,00,53,00,53,00,00,00,50,00,72,00,6f,00,66,00,53,\
00,76,00,63,00,00,00,45,00,61,00,70,00,48,00,6f,00,73,00,74,00,00,00,77,00,\
69,00,6e,00,6d,00,67,00,6d,00,74,00,00,00,73,00,63,00,68,00,65,00,64,00,75,\
00,6c,00,65,00,00,00,53,00,65,00,73,00,73,00,69,00,6f,00,6e,00,45,00,6e,00,\
76,00,00,00,62,00,72,00,6f,00,77,00,73,00,65,00,72,00,00,00,68,00,6b,00,6d,\
00,73,00,76,00,63,00,00,00,00,00
"swprv"=hex(7):73,00,77,00,70,00,72,00,76,00,00,00,00,00
"LocalServiceNetworkRestricted"=hex(7):44,00,48,00,43,00,50,00,00,00,65,00,76,\
00,65,00,6e,00,74,00,6c,00,6f,00,67,00,00,00,41,00,75,00,64,00,69,00,6f,00,\
53,00,72,00,76,00,00,00,4c,00,6d,00,48,00,6f,00,73,00,74,00,73,00,00,00,77,\
00,73,00,63,00,73,00,76,00,63,00,00,00,70,00,32,00,70,00,69,00,6d,00,73,00,\
76,00,63,00,00,00,50,00,4e,00,52,00,50,00,53,00,76,00,63,00,00,00,70,00,32,\
00,70,00,73,00,76,00,63,00,00,00,57,00,50,00,43,00,53,00,76,00,63,00,00,00,\
50,00,6e,00,72,00,70,00,41,00,75,00,74,00,6f,00,52,00,65,00,67,00,00,00,00,\
00
"rpcss"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"regsvc"=hex(7):52,00,65,00,6d,00,6f,00,74,00,65,00,52,00,65,00,67,00,69,00,73,\
00,74,00,72,00,79,00,00,00,00,00
"wcssvc"=hex(7):57,00,63,00,73,00,50,00,6c,00,75,00,67,00,49,00,6e,00,53,00,65,\
00,72,00,76,00,69,00,63,00,65,00,00,00,00,00
"DcomLaunch"=hex(7):50,00,6c,00,75,00,67,00,50,00,6c,00,61,00,79,00,00,00,44,\
00,63,00,6f,00,6d,00,4c,00,61,00,75,00,6e,00,63,00,68,00,00,00,00,00
"wdisvc"=hex(7):57,00,64,00,69,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,48,\
00,6f,00,73,00,74,00,00,00,00,00
"sdrsvc"=hex(7):73,00,64,00,72,00,73,00,76,00,63,00,00,00,00,00
"imgsvc"=hex(7):53,00,74,00,69,00,53,00,76,00,63,00,00,00,00,00
"secsvcs"=hex(7):57,00,69,00,6e,00,44,00,65,00,66,00,65,00,6e,00,64,00,00,00,\
00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService]
"AuthenticationCapabilities"=dword:00002000
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNetworkRestricted]
"DefaultRpcStackSize"=dword:00000040

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalSystemNetworkRestricted]
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
"AuthenticationCapabilities"=dword:00003020
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkService]
"CoInitializeSecurityParam"=dword:00000001
"DefaultRpcStackSize"=dword:0000001c

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\SDRSVC]
"CoInitializeSecurityParam"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\swprv]
"CoInitializeSecurityParam"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs]
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\wcssvc]
"CoInitializeSecurityParam"=dword:00000001
"CoInitializeSecurityAppID"="{CD11FAB6-1C0E-45e1-BA31-5C6008EF2607}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\wercplsupport]
"AuthenticationCapabilities"=dword:00003020
"CoInitializeSecurityParam"=dword:00000001



~~~~~SVCHOST MD5~~~~~

3794B461C45882E06856F282EEF025AF C:\Windows\system32\svchost.exe


~~~~~END OF FILE!~~~~~

While we look at these logs, we scan a file that is most likely legit, but gotta make sure.

• Please go to the Virustotal website by clicking here
  
• Click the Choose File button and in the Name field paste:

  c:\windows\system32\wbem\wbemess.dll

  
  
• Click Open and click Scan It!
  
• If Virustotal informs you that "File already analysed", click Reanalyse
  
• An analysis report will appear. Copy and paste the url (something like http://www.virustotal.com/analisis/blabla) into your next reply.

FYI I am still being redirected...woooohooooo this is fun...lol


https://www.virustotal.com/file/2d283a83359584defed9dd7c10649c560acc588e56086c04aa455bde84ee3b89/analysis/1339601834/

Hello!

I'm going to step in for a moment to ask a few random questions, so we can further diagnose this together...

1. How are you using the search engines? Are you being redirected in normal browsing on any website, or just a search engine? What is your usual web browser?

2. Post the following information from this tool:

1. Download Win32kDiag from any of the following locations and save it to your Desktop.
   
   
   
   • Download Win32kDiag (Win32kDiag.exe) - #1
     
   • Download Win32kDiag (Win32kDiag.exe) - #2
     
   • Download Win32kDiag (Win32kDiag.exe) - #3
     

Double-click Win32kDiag.exe to run Win32kDiag and let it finish.

When it states "Finished! Press any key to exit...", press any key on your keyboard to close the program.

Double-click on the Win32kDiag.txt file that is located on your Desktop and post the entire contents of that log as a reply to this topic.

My normal web browser is google....and yes, anytime I use this feature I get redirected under most searches....like this

hxxp://8.26.70.252/see/display.php?q=pogo&affsub=7095258_46938-12780&subid=e10

Doing scan now

Just searches?

Where did you download Google Chrome? ((Google.com?) Or another source?)

After you post the scan log from Win32kDiag, post a Quick Scan from OTL please.

I think we got this wrapped up here...

Don't remember about the gooogle chrome....don't need it, never use it

Okay. How's it going on the scan logs? Post them whenever done, please.

scan still going...been a few hours

It shouldn't take more than 30 minutes at the max.!

Cancel the scan and try again, please...

I stopped it at this point....will try new scan again

Running from: C:\Users\JonEJet\Desktop\Win32kDiag.exe

Log file at : C:\Users\JonEJet\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\Windows'...



Cannot access: C:\Windows\System32\catroot2\edb00286.log

[1] 2012-06-08 01:22:59 65536 C:\Windows\System32\catroot2\edb00286.log ()



Cannot access: C:\Windows\System32\config\BCD-Template

[1] 2008-01-05 07:22:50 262144 C:\Windows\SoftwareDistribution\Download\b1d48c0a5500e900499764daaa6a0385\x86_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.0.6001.18000_none_282474660318747d\BCD-Template ()

[1] 2007-11-06 16:41:23 262144 C:\Windows\System32\config\BCD-Template ()

[1] 2006-11-02 08:34:29 262144 C:\Windows\winsxs\x86_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.0.6000.16386_none_25edb26a062d63a9\BCD-Template ()

[1] 2008-01-05 04:22:52 262144 C:\Windows\winsxs\x86_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.0.6001.18000_none_282474660318747d\BCD-Template ()



Cannot access: C:\Windows\System32\config\BCD-Template.LOG

[1] 2007-11-06 16:41:23 37888 C:\Windows\System32\config\BCD-Template.LOG ()



Cannot access: C:\Windows\System32\config\BCD-Template.LOG1

[1] 2006-11-02 08:43:50 0 C:\Windows\System32\config\BCD-Template.LOG1 ()



Cannot access: C:\Windows\System32\config\BCD-Template.LOG2

[1] 2006-11-02 08:43:50 0 C:\Windows\System32\config\BCD-Template.LOG2 ()



Cannot access: C:\Windows\System32\config\COMPONENTS.LOG

[1] 2006-11-02 06:43:16 1024 C:\Windows\System32\config\COMPONENTS.LOG ()



Cannot access: C:\Windows\System32\config\COMPONENTS.SAV

[1] 2007-11-06 16:41:12 6602752 C:\Windows\System32\config\COMPONENTS.SAV ()



Cannot access: C:\Windows\System32\config\DEFAULT.LOG

[1] 2006-11-02 11:28:20 1024 C:\Windows\System32\config\DEFAULT.LOG ()



Cannot access: C:\Windows\System32\config\DEFAULT.SAV

[1] 2007-11-06 16:41:11 102400 C:\Windows\System32\config\DEFAULT.SAV ()



Cannot access: C:\Windows\System32\config\RegBack\COMPONENTS.LOG1

[1] 2012-06-13 10:26:31 262144 C:\Windows\System32\config\COMPONENTS.LOG1 ()

[1] 2012-02-11 00:09:09 262144 C:\Windows\System32\config\RegBack\COMPONENTS.LOG1 ()



Cannot access: C:\Windows\System32\config\RegBack\COMPONENTS.LOG2

[1] 2006-11-02 08:33:34 0 C:\Windows\System32\config\COMPONENTS.LOG2 ()

[1] 2006-11-02 09:07:24 0 C:\Windows\System32\config\RegBack\COMPONENTS.LOG2 ()



Cannot access: C:\Windows\System32\config\RegBack\DEFAULT.LOG1

[1] 2012-06-13 10:48:06 262144 C:\Windows\System32\config\DEFAULT.LOG1 ()

[1] 2012-05-28 15:08:24 262144 C:\Windows\System32\config\RegBack\DEFAULT.LOG1 ()



Cannot access: C:\Windows\System32\config\RegBack\DEFAULT.LOG2

[1] 2006-11-02 08:33:34 0 C:\Windows\System32\config\DEFAULT.LOG2 ()

[1] 2006-11-02 09:07:11 0 C:\Windows\System32\config\RegBack\DEFAULT.LOG2 ()



Cannot access: C:\Windows\System32\config\RegBack\SAM.LOG1

[1] 2011-01-28 17:18:38 262144 C:\Windows\System32\config\RegBack\SAM.LOG1 ()

[1] 2012-06-13 10:24:16 262144 C:\Windows\System32\config\SAM.LOG1 ()



Cannot access: C:\Windows\System32\config\RegBack\SAM.LOG2

[1] 2006-11-02 09:07:11 0 C:\Windows\System32\config\RegBack\SAM.LOG2 ()

[1] 2006-11-02 08:33:34 0 C:\Windows\System32\config\SAM.LOG2 ()



Cannot access: C:\Windows\System32\config\RegBack\SECURITY.LOG1

[1] 2012-05-28 15:08:03 262144 C:\Windows\System32\config\RegBack\SECURITY.LOG1 ()

[1] 2012-06-13 10:26:16 262144 C:\Windows\System32\config\SECURITY.LOG1 ()



Cannot access: C:\Windows\System32\config\RegBack\SECURITY.LOG2

[1] 2006-11-02 09:06:26 0 C:\Windows\System32\config\RegBack\SECURITY.LOG2 ()

[1] 2006-11-02 08:33:34 0 C:\Windows\System32\config\SECURITY.LOG2 ()



Cannot access: C:\Windows\System32\config\RegBack\SOFTWARE.LOG1

[1] 2012-05-28 15:08:17 262144 C:\Windows\System32\config\RegBack\SOFTWARE.LOG1 ()

[1] 2012-06-13 14:19:00 262144 C:\Windows\System32\config\SOFTWARE.LOG1 ()



Cannot access: C:\Windows\System32\config\RegBack\SOFTWARE.LOG2

[1] 2006-11-02 09:06:57 0 C:\Windows\System32\config\RegBack\SOFTWARE.LOG2 ()

[1] 2012-05-26 23:38:30 262144 C:\Windows\System32\config\SOFTWARE.LOG2 ()



Cannot access: C:\Windows\System32\config\RegBack\SYSTEM.LOG1

[1] 2012-05-28 15:08:22 1310720 C:\Windows\System32\config\RegBack\SYSTEM.LOG1 ()

[1] 2012-06-13 13:56:05 262144 C:\Windows\System32\config\SYSTEM.LOG1 ()



Cannot access: C:\Windows\System32\config\RegBack\SYSTEM.LOG2

[1] 2006-11-02 09:07:11 0 C:\Windows\System32\config\RegBack\SYSTEM.LOG2 ()

[1] 2006-11-02 08:33:34 0 C:\Windows\System32\config\SYSTEM.LOG2 ()



Cannot access: C:\Windows\System32\config\SAM.LOG

[1] 2007-11-06 16:59:48 0 C:\Windows\Debug\sam.log ()

[1] 2006-11-02 06:35:37 1024 C:\Windows\System32\config\SAM.LOG ()



Cannot access: C:\Windows\System32\config\SECURITY.LOG

[1] 2006-11-02 06:35:37 1024 C:\Windows\System32\config\SECURITY.LOG ()



Cannot access: C:\Windows\System32\config\SECURITY.SAV

[1] 2007-11-06 16:41:13 20480 C:\Windows\System32\config\SECURITY.SAV ()



Cannot access: C:\Windows\System32\config\SOFTWARE.LOG

[1] 2012-06-04 13:06:26 1024 C:\Windows\System32\config\SOFTWARE.LOG ()



Cannot access: C:\Windows\System32\config\SOFTWARE.SAV

[1] 2007-11-06 16:41:20 15556608 C:\Windows\System32\config\SOFTWARE.SAV ()



Cannot access: C:\Windows\System32\config\SYSTEM.LOG

[1] 2012-06-04 13:06:26 1024 C:\Windows\System32\config\SYSTEM.LOG ()



Cannot access: C:\Windows\System32\config\SYSTEM.SAV

[1] 2007-11-06 16:41:21 6012928 C:\Windows\System32\config\SYSTEM.SAV ()



Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat

[1] 2012-06-13 10:26:47 262144 C:\Windows\ServiceProfiles\LocalService\ntuser.dat ()

[1] 2012-06-13 10:26:55 524288 C:\Windows\ServiceProfiles\NetworkService\ntuser.dat ()

[1] 2012-06-08 04:47:06 262144 C:\Windows\System32\config\systemprofile\ntuser.dat ()



Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat.LOG

[1] 2006-11-02 11:28:20 1024 C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG ()

[1] 2006-11-02 11:28:20 1024 C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG ()

[1] 2006-11-02 11:28:20 1024 C:\Windows\System32\config\systemprofile\ntuser.dat.LOG ()



Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat.LOG1

[1] 2012-06-13 10:26:46 136192 C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 ()

[1] 2012-06-13 10:26:53 262144 C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 ()

[1] 2011-04-05 22:43:31 9216 C:\Windows\System32\config\systemprofile\ntuser.dat.LOG1 ()



Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat.LOG2

[1] 2006-11-02 08:47:53 0 C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG2 ()

[1] 2006-11-02 08:47:52 0 C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG2 ()

[1] 2006-11-02 08:43:31 0 C:\Windows\System32\config\systemprofile\ntuser.dat.LOG2 ()



Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TM.blf

[1] 2011-04-05 22:43:31 65536 C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TM.blf ()



Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms

[1] 2011-04-05 22:43:31 524288 C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms ()



Cannot access: C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms

[1] 2007-11-06 16:54:22 524288 C:\Windows\System32\config\systemprofile\ntuser.dat{6b265b38-8caa-11dc-8cea-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms ()



Cannot access: C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.0.regtrans-ms

[1] 2011-06-16 08:57:17 5242880 C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.0.regtrans-ms ()



Cannot access: C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.1.regtrans-ms

[1] 2011-01-30 07:36:13 5242880 C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.1.regtrans-ms ()



Cannot access: C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.2.regtrans-ms

[1] 2011-02-26 10:14:26 5242880 C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.2.regtrans-ms ()



Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101A}.TxR.3.regtrans-ms

[1] 2012-06-13 10:23:18 5242880 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101A}.TxR.3.regtrans-ms ()



Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101A}.TxR.4.regtrans-ms

[1] 2011-01-30 07:36:13 5242880 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101A}.TxR.4.regtrans-ms ()



Cannot access: C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.blf

[1] 2012-06-13 10:23:18 65536 C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.blf ()



Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf

[1] 2012-06-13 10:23:02 65536 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf ()



Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms

[1] 2011-05-03 03:49:39 524288 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms ()



Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms

[1] 2012-06-13 10:23:02 524288 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms ()



Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000003.regtrans-ms

[1] 2011-07-14 03:28:39 524288 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000003.regtrans-ms ()



Cannot access: C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000004.regtrans-ms

[1] 2012-06-05 10:49:40 524288 C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000004.regtrans-ms ()



Cannot access: C:\Windows\System32\DriverStore\FileRepository\netrtx32.inf_f093b1d0\netrtx32.PNF

[1] 2012-06-02 11:05:33 24256 C:\Windows\inf\netrtx32.PNF ()

[1] 2012-06-02 11:05:32 24256 C:\Windows\System32\DriverStore\FileRepository\netrtx32.inf_f093b1d0\netrtx32.PNF ()



Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl

[1] 2012-06-13 10:24:43 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl ()



Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl

[1] 2012-06-13 10:24:10 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl ()



Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl

[1] 2012-06-13 10:24:10 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl ()



Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl

[1] 2012-06-13 10:24:10 64 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl ()



Cannot access: C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_16.bin

[1] 2012-04-21 19:48:23 1112 C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_16.bin ()



Cannot access: C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_24.bin

[1] 2012-04-21 19:48:23 2456 C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_24.bin ()



Cannot access: C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_32.bin

[1] 2012-04-21 19:48:23 4280 C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_32.bin ()



Cannot access: C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_48.bin

[1] 2012-04-21 19:48:23 9560 C:\Windows\System32\networklist\icons\{2E8371A6-4CD4-413A-B786-989216C1F6BF}_48.bin ()



Cannot access: C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_16.bin

[1] 2012-06-09 19:42:09 1112 C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_16.bin ()



Cannot access: C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_24.bin

[1] 2012-06-09 19:42:09 2456 C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_24.bin ()



Cannot access: C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_32.bin

[1] 2012-06-09 19:42:09 4280 C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_32.bin ()



Cannot access: C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_48.bin

[1] 2012-06-09 19:42:09 9560 C:\Windows\System32\networklist\icons\{6AE8DF8C-ECB6-4AC8-8C6B-316507035617}_48.bin ()



Cannot access: C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_16.bin

[1] 2012-05-05 20:05:59 1112 C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_16.bin ()



Cannot access: C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_24.bin

[1] 2012-05-05 20:05:59 2456 C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_24.bin ()



Cannot access: C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_32.bin

[1] 2012-05-05 20:05:59 4280 C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_32.bin ()



Cannot access: C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_48.bin

[1] 2012-05-05 20:05:59 9560 C:\Windows\System32\networklist\icons\{E550DE9B-5A4F-4951-80A5-3ACD738DD518}_48.bin ()



Cannot access: C:\Windows\System32\spool\drivers\w32x86\3\msonpdrv.dll

[1] 2006-10-26 23:56:16 864080 C:\Windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSONPDRV.DLL (Microsoft Corporation)

[1] 2009-02-27 04:42:02 863128 C:\Windows\System32\spool\drivers\w32x86\3\msonpdrv.dll ()

[1] 2009-02-27 04:42:02 863128 C:\Windows\System32\spool\drivers\w32x86\msonpdrv.dll (Microsoft Corporation)



Cannot access: C:\Windows\System32\spool\drivers\w32x86\3\msonpui.dll

[1] 2006-10-26 23:56:14 67408 C:\Windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\MSONPUI.DLL (Microsoft Corporation)

[1] 2009-02-27 04:42:04 66440 C:\Windows\System32\spool\drivers\w32x86\3\msonpui.dll ()

[1] 2009-02-27 04:42:04 66440 C:\Windows\System32\spool\drivers\w32x86\msonpui.dll (Microsoft Corporation)



Cannot access: C:\Windows\System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan

[1] 2012-06-12 10:24:42 3504 C:\Windows\System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan ()



Cannot access: C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

[1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

[1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



Cannot access: C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

[1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

[1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



Cannot access: C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

[1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

[1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



Cannot access: C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

[1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

[1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



Cannot access: C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

[1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

[1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



Cannot access: C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{000c67f9-0f8d-42e6-b7bc-c8e0e73fc435}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{409290dd-2d84-4586-9359-801261ff6a77}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{99bf3265-ddc1-4985-9050-a3a2aeff7e88}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{da80fb81-edd5-4efe-ac05-de9a34f87d04}\snapshot.etl ()

[1] 2012-06-13 10:24:03 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{01f32406-bd3b-49d3-9171-f1deb13db9b9}\snapshot.etl ()

[1] 2012-06-11 15:08:22 294912 C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{e3252b13-cf58-4ec1-ad1f-da06cf818b16}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{146aeae5-3f2f-4ea0-8511-6814e172f5d4}\snapshot.etl ()

[1] 2012-06-11 15:08:22 1605632 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{c3d31e67-c290-490d-893d-41f11faf066d}\snapshot.etl ()

[1] 2012-06-11 15:08:22 999424 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{d9cb2f36-e79b-4d9f-a359-4b44cb4b0fc2}\snapshot.etl ()

[1] 2012-06-11 15:08:22 2097152 C:\Windows\System32\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{f566f45a-2e45-42ac-b948-4ff4ad7cab29}\snapshot.etl ()



Cannot access: C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{47cb6cb0-c5ff-493a-a179-954101c9ee05}\krundown.etl

[1] 2012-06-13 10:32:55 2359296 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{47cb6cb0-c5ff-493a-a179-954101c9ee05}\krundown.etl ()

[1] 2012-06-12 20:56:14 2424832 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{eab453ee-1a8e-43ff-87ae-974ec71eff1c}\krundown.etl ()

[1] 2012-06-11 20:19:04 2949120 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{f5603adf-9ef2-4cdb-b34e-9962801dccc1}\krundown.etl ()



Cannot access: C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{47cb6cb0-c5ff-493a-a179-954101c9ee05}\ksnapshot.etl

[1] 2012-06-13 10:32:56 4128768 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{47cb6cb0-c5ff-493a-a179-954101c9ee05}\ksnapshot.etl ()

[1] 2012-06-12 20:56:15 4128768 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{eab453ee-1a8e-43ff-87ae-974ec71eff1c}\ksnapshot.etl ()

[1] 2012-06-11 20:19:05 4128768 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{f5603adf-9ef2-4cdb-b34e-9962801dccc1}\ksnapshot.etl ()



Cannot access: C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{eab453ee-1a8e-43ff-87ae-974ec71eff1c}\krundown.etl

[1] 2012-06-13 10:32:55 2359296 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{47cb6cb0-c5ff-493a-a179-954101c9ee05}\krundown.etl ()

[1] 2012-06-12 20:56:14 2424832 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{eab453ee-1a8e-43ff-87ae-974ec71eff1c}\krundown.etl ()

[1] 2012-06-11 20:19:04 2949120 C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{f5603adf-9ef2-4cdb-b34e-9962801dccc1}\krundown.etl ()



Cannot access: C:\Windows\System32\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}\{eab453ee-1a8e-43ff-87ae-974ec71eff1c}\ksnapshot.etl

Well, I'm 30 minutes in on the new scan, and it's giving me the same exact scan....same results, but still scanning

Let's go to OTL at this time. Post a new log please.

OTL logfile created on: 6/13/2012 5:07:47 PM - Run 3
OTL by OldTimer - Version 3.2.45.0 Folder = C:\Users\JonEJet\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 0.77 Gb Available Physical Memory | 38.61% Memory free
4.21 Gb Paging File | 2.43 Gb Available in Paging File | 57.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 110.32 Gb Total Space | 59.84 Gb Free Space | 54.24% Space Free | Partition Type: NTFS
Drive D: | 284.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: JONEJET-PC | User Name: JonEJet | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/06/06 11:50:57 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/06/04 15:50:17 | 000,023,328 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jp2launcher.exe
PRC - [2012/06/04 15:50:15 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\java.exe
PRC - [2012/06/01 10:16:41 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\JonEJet\Desktop\OTL.exe
PRC - [2012/03/06 19:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011/10/01 09:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/10/14 18:45:05 | 000,589,824 | ---- | M] ( ) -- C:\Windows\System32\lxducoms.exe
PRC - [2010/02/01 23:02:21 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2008/10/29 02:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2007/09/19 15:01:12 | 000,077,824 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
PRC - [2007/08/15 19:31:50 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPStart.exe
PRC - [2007/08/15 18:58:02 | 000,200,704 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynToshiba.exe
PRC - [2007/04/25 15:14:16 | 004,444,160 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/03/29 14:39:20 | 000,427,576 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
PRC - [2007/02/26 01:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2007/01/25 22:47:50 | 000,136,816 | ---- | M] () -- C:\TOSHIBA\IVP\ISM\pinger.exe
PRC - [2006/11/15 00:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
PRC - [2006/10/05 16:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
PRC - [2006/08/23 20:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2006/05/25 22:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe


========== Modules (No Company Name) ==========

MOD - [2012/06/06 11:50:56 | 002,042,848 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/06/04 15:50:17 | 000,014,112 | ---- | M] () -- C:\Program Files\Java\jre6\bin\jp2native.dll
MOD - [2011/08/28 10:57:23 | 006,277,280 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2009/05/06 09:04:36 | 000,466,944 | ---- | M] () -- C:\Program Files\Lexmark Toolbar\resource.dll
MOD - [2009/05/06 09:03:44 | 000,372,736 | ---- | M] () -- C:\Program Files\Lexmark Toolbar\toolband.dll
MOD - [2007/09/13 19:11:18 | 000,249,856 | ---- | M] () -- C:\Windows\System32\igfxTMM.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (MpsSvc)
SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice_tmp.exe -- (MozillaMaintenance)
SRV - File not found [On_Demand | Stopped] -- -- (BFE)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011/10/01 09:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/10/14 18:45:05 | 000,589,824 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxducoms.exe -- (lxdu_device)
SRV - [2008/07/27 14:00:25 | 000,069,632 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/06/19 21:17:50 | 000,132,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008/01/19 00:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/19 00:34:54 | 000,068,608 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\mprdim.dll -- (RemoteAccess)
SRV - [2008/01/19 00:34:46 | 000,053,760 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\Mcx2Svc.dll -- (Mcx2Svc)
SRV - [2007/09/24 21:38:00 | 000,181,784 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2007/09/19 15:01:12 | 000,077,824 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv)
SRV - [2007/03/29 14:39:20 | 000,427,576 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV - [2007/02/26 01:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2007/01/25 22:47:50 | 000,136,816 | ---- | M] () [Auto | Running] -- C:\TOSHIBA\IVP\ISM\pinger.exe -- (pinger)
SRV - [2006/11/15 00:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2006/10/05 16:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2006/08/23 20:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2006/05/25 22:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (Tosrfcom)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\sysprep\UP_date\PEDrv.sys -- (SVRPEDRV)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\SYSPREP\Drivers\ioport.sys -- (IO_Memory)
DRV - File not found [Kernel | Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\coShared\CW\1.5\CO_Mon.sys -- (CWMonitor)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\SeviceFix13496S\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012/03/06 19:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/03/06 19:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/03/06 19:02:00 | 000,035,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2012/03/06 19:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/03/06 19:01:48 | 000,057,688 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012/03/06 19:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2011/10/01 09:30:42 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV - [2011/10/01 09:30:40 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV - [2011/10/01 09:30:38 | 000,194,408 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV - [2011/10/01 09:30:36 | 000,579,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV - [2011/06/30 13:20:45 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/06/30 13:20:45 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008/01/18 22:49:18 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sermouse.sys -- (sermouse)
DRV - [2008/01/18 22:28:10 | 000,226,816 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\udfs.sys -- (udfs)
DRV - [2007/09/19 14:59:12 | 000,285,184 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\tos_sps32.sys -- (tos_sps32)
DRV - [2007/06/01 17:07:48 | 000,252,416 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rtl8187B.sys -- (RTL8187B)
DRV - [2007/01/24 18:44:06 | 000,290,304 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21)
DRV - [2006/11/28 19:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006/11/20 02:11:14 | 000,007,168 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FwLnk.sys -- (FwLnk)
DRV - [2006/11/09 02:32:00 | 000,219,264 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\KR10I.sys -- (KR10I)
DRV - [2006/11/09 02:31:00 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\KR10N.sys -- (KR10N)
DRV - [2006/11/02 05:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 05:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 05:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 05:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 05:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 05:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iaStorV.sys -- (iaStorV)
DRV - [2006/11/02 05:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 05:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 05:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 05:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 05:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 05:50:24 | 000,047,208 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\isapnp.sys -- (isapnp)
DRV - [2006/11/02 05:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,080,488 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\msdsm.sys -- (msdsm)
DRV - [2006/11/02 05:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 05:50:16 | 000,078,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\mpio.sys -- (mpio)
DRV - [2006/11/02 05:50:16 | 000,076,392 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sbp2port.sys -- (sbp2port)
DRV - [2006/11/02 05:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 05:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 05:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 05:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 05:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 05:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 05:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\HpCISSs.sys -- (HpCISSs)
DRV - [2006/11/02 05:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 05:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 05:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 05:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 05:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\Mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 05:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 05:49:49 | 000,027,752 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\i2omp.sys -- (i2omp)
DRV - [2006/11/02 05:49:38 | 000,019,560 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\wd.sys -- (Wd)
DRV - [2006/11/02 05:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 05:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 05:49:26 | 000,015,464 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\amdide.sys -- (amdide)
DRV - [2006/11/02 05:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 05:49:20 | 000,013,416 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\pciide.sys -- (pciide)
DRV - [2006/11/02 05:03:00 | 000,242,688 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\rdpdr.sys -- (rdpdr)
DRV - [2006/11/02 04:55:23 | 000,039,936 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\bthmodem.sys -- (BTHMODEM)
DRV - [2006/11/02 04:55:22 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\hidbth.sys -- (HidBth)
DRV - [2006/11/02 04:55:09 | 000,068,608 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\usbcir.sys -- (usbcir) eHome Infrared Receiver (USBCIR)
DRV - [2006/11/02 04:55:08 | 000,035,328 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\circlass.sys -- (circlass)
DRV - [2006/11/02 04:55:05 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\usbohci.sys -- (usbohci)
DRV - [2006/11/02 04:55:01 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\hidir.sys -- (HidIr)
DRV - [2006/11/02 04:52:52 | 000,020,608 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\wacompen.sys -- (WacomPen)
DRV - [2006/11/02 04:51:40 | 000,013,312 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sfloppy.sys -- (sfloppy)
DRV - [2006/11/02 04:51:38 | 000,013,312 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sffdisk.sys -- (sffdisk)
DRV - [2006/11/02 04:51:33 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\fdc.sys -- (fdc)
DRV - [2006/11/02 04:51:32 | 000,020,480 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\flpydisk.sys -- (flpydisk)
DRV - [2006/11/02 04:42:03 | 000,065,536 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\IPMIDrv.sys -- (IPMIDRV)
DRV - [2006/11/02 04:35:03 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\wmiacpi.sys -- (WmiAcpi)
DRV - [2006/11/02 04:30:19 | 000,039,424 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\viac7.sys -- (ViaC7)
DRV - [2006/11/02 04:30:18 | 000,040,960 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\amdk8.sys -- (AmdK8)
DRV - [2006/11/02 04:30:18 | 000,038,912 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\crusoe.sys -- (Crusoe)
DRV - [2006/11/02 04:30:18 | 000,038,912 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\amdk7.sys -- (AmdK7)
DRV - [2006/11/02 04:30:18 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\processr.sys -- (Processor)
DRV - [2006/11/02 04:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\BrSerId.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 04:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\BrSerWdm.sys -- (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\BrUsbMdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 03:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 03:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2006/10/18 15:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV - [2006/10/06 02:22:14 | 000,016,768 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ)
DRV - [2006/09/27 08:06:00 | 000,479,488 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\kr3npxp.sys -- (KR3NPXP)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {8A96AF9E-4074-43b7-BEA3-87217BDA7406}
IE - HKLM\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&systemid=406&q={searchTerms}
IE - HKLM\..\SearchScopes\{BC37B0C6-1699-454D-815B-74DB6873EE31}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage};

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_home?ie=UTF8&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_ie_sp_
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {21475A23-BD73-3152-6CAC-741072CD9B98}
IE - HKCU\..\SearchScopes\{105E99FF-8B9A-4492-B155-06194B9056D2}: "URL" = http://www.bing.com/search?FORM=BABTDF&PC=BBLN&q={searchTerms}&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{21475A23-BD73-3152-6CAC-741072CD9B98}: "URL" = http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_ie_us_display?ie=UTF8&tag=bds-amzn-serp-us-ie-20&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_ie_ds_&query={searchTerms}
IE - HKCU\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://blekko.com/ws/?source=c3348dd4&tbp=rbox&toolbarid=blekkotb_031&u=078E4B36CE8D139AA3721C4FC3CC31B5&q={searchTerms}
IE - HKCU\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&systemid=406&q={searchTerms}
IE - HKCU\..\SearchScopes\{BC37B0C6-1699-454D-815B-74DB6873EE31}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7TSHB
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Blekko"
FF - prefs.js..browser.search.order.1: "Blekko"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_home?ie=UTF8&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_ff_sp_"
FF - prefs.js..keyword.URL: "http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_ff_us_display?ie=UTF8&tag=bds-amzn-serp-us-ff-20&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_ff_ab_&query="
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/05/07 13:16:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/06 11:51:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/04 19:44:19 | 000,000,000 | ---D | M]

[2012/01/16 23:58:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\JonEJet\AppData\Roaming\Mozilla\Extensions
[2012/03/12 20:07:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\JonEJet\AppData\Roaming\Mozilla\Firefox\Profiles\6llx2x2q.default\extensions
[2012/06/01 10:11:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\JonEJet\AppData\Roaming\Mozilla\Firefox\Profiles\okcrvxtn.default\extensions
[2012/06/06 11:51:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/06/01 10:11:28 | 000,502,682 | ---- | M] () (No name found) -- C:\USERS\JONEJET\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\OKCRVXTN.DEFAULT\EXTENSIONS\ABB@AMAZON.COM.XPI
[2012/03/12 20:07:50 | 000,004,728 | ---- | M] () (No name found) -- C:\USERS\JONEJET\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\OKCRVXTN.DEFAULT\EXTENSIONS\COOIJLURCQ@COOIJLURCQ.ORG.XPI
[2012/06/06 11:50:58 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/20 21:18:25 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/05/28 15:04:42 | 000,002,134 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\search.xml
[2012/04/20 21:18:25 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Amazon (Enabled)
CHR - default_search_provider: search_url = http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_cr_us_display?ie=UTF8&tag=bds-amzn-serp-us-cr-20&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_cr_ds_&query={searchTerms}
CHR - default_search_provider: suggest_url = http://suggestqueries.google.com/complete/search?q={searchTerms}&output=chrome,
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.52\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.52\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\JonEJet\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files\Veetle\Player\npvlc.dll
CHR - plugin: Veetle Broadcaster Plugin (Enabled) = C:\Program Files\Veetle\VLCBroadcast\npvbp.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files\Veetle\plugins\npVeetle.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: avast! WebRep = C:\Users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\

O1 HOSTS File: ([2012/06/08 01:18:08 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Lexmark Printable Web) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()
O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKCU\..\Toolbar\ShellBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - Startup: C:\Users\JonEJet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 208.59.247.45 208.59.247.46
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3BCB3EAE-FB8F-4141-8934-8A0E11E5B570}: DhcpNameServer = 10.61.32.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DBCEC8C8-8DDA-4014-B428-FED0EEFC40F8}: DhcpNameServer = 208.59.247.45 208.59.247.46
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\JonEJet\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\JonEJet\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKCU\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/11 15:14:20 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro
[2012/06/08 14:08:09 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2012/06/08 01:49:17 | 000,000,000 | ---D | C] -- C:\Users\JonEJet\AppData\Local\temp
[2012/06/08 01:18:36 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/06/08 01:14:09 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/06/07 23:23:50 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/06/07 07:41:09 | 000,000,000 | ---D | C] -- C:\SeviceFix
[2012/06/05 09:49:42 | 000,012,872 | ---- | C] (SurfRight B.V.) -- C:\Windows\System32\bootdelete.exe
[2012/06/05 09:35:14 | 007,287,176 | ---- | C] (SurfRight B.V.) -- C:\Users\JonEJet\Desktop\HitmanPro36.exe
[2012/06/03 12:29:20 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\JonEJet\Documents\OTL.exe
[2012/06/02 14:55:01 | 098,077,435 | ---- | C] (Igor Pavlov) -- C:\Users\JonEJet\Desktop\OTLPEStd.exe
[2012/06/01 12:59:23 | 000,000,000 | ---D | C] -- C:\Users\JonEJet\AppData\Local\Seven Zip
[2012/06/01 12:27:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012/06/01 10:16:29 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\JonEJet\Desktop\OTL.exe
[2012/05/31 21:01:48 | 000,000,000 | ---D | C] -- C:\Program Files\Amazon
[2012/05/31 21:00:53 | 000,000,000 | ---D | C] -- C:\Program Files\Amazon Browser Bar
[2012/05/31 10:23:14 | 000,000,000 | ---D | C] -- C:\Users\JonEJet\Documents\OneNote Notebooks
[2012/05/31 10:01:00 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012/05/31 09:27:33 | 000,201,728 | ---- | C] (OldTimer Tools) -- C:\Users\JonEJet\Desktop\OTC.exe
[2012/05/30 11:04:58 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\JonEJet\Desktop\aswMBR.exe
[2012/05/30 10:20:51 | 000,000,000 | ---D | C] -- C:\Users\JonEJet\AppData\Roaming\FixZeroAccess
[2012/05/30 09:45:58 | 001,805,736 | ---- | C] (Symantec Corporation) -- C:\Users\JonEJet\Desktop\FixZeroAccess.exe
[2012/05/29 11:23:37 | 000,000,000 | ---D | C] -- C:\Program Files\Free Download Manager
[2012/05/29 11:22:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012/05/29 11:22:35 | 000,000,000 | ---D | C] -- C:\Users\JonEJet\AppData\Roaming\Babylon
[2012/05/28 15:04:14 | 000,000,000 | ---D | C] -- C:\Users\JonEJet\AppData\Local\blekkotb_031
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/06/13 16:56:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/13 16:24:48 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/13 16:24:48 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/13 12:06:28 | 000,047,616 | ---- | M] () -- C:\Users\JonEJet\Desktop\Win32kDiag.exe
[2012/06/13 10:24:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/06/13 10:24:02 | 2137,415,680 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/12 01:00:48 | 000,001,982 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012/06/09 13:40:35 | 000,059,246 | ---- | M] () -- C:\Users\JonEJet\Documents\marci.jpg
[2012/06/08 14:13:22 | 000,001,356 | ---- | M] () -- C:\Users\JonEJet\AppData\Local\d3d9caps.dat
[2012/06/08 01:18:08 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/06/08 00:48:21 | 179,672,641 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/06/07 23:30:59 | 001,415,784 | ---- | M] () -- C:\Users\JonEJet\Desktop\yorkyt.exe
[2012/06/07 14:14:40 | 000,604,946 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/06/07 14:14:40 | 000,104,356 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/06/07 11:03:06 | 000,080,384 | ---- | M] () -- C:\Users\JonEJet\Documents\MBRCheck.exe
[2012/06/06 23:37:06 | 000,015,494 | ---- | M] () -- C:\Users\JonEJet\log.xml
[2012/06/06 12:26:20 | 007,287,176 | ---- | M] (SurfRight B.V.) -- C:\Users\JonEJet\Desktop\HitmanPro36.exe
[2012/06/05 09:49:42 | 000,012,872 | ---- | M] (SurfRight B.V.) -- C:\Windows\System32\bootdelete.exe
[2012/06/02 14:55:07 | 098,077,435 | ---- | M] (Igor Pavlov) -- C:\Users\JonEJet\Desktop\OTLPEStd.exe
[2012/06/01 12:27:43 | 000,000,881 | ---- | M] () -- C:\Users\JonEJet\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/06/01 12:27:43 | 000,000,857 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/06/01 10:16:41 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\JonEJet\Documents\OTL.exe
[2012/06/01 10:16:41 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\JonEJet\Desktop\OTL.exe
[2012/05/31 10:23:11 | 000,001,122 | ---- | M] () -- C:\Users\JonEJet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2012/05/31 09:27:39 | 000,201,728 | ---- | M] (OldTimer Tools) -- C:\Users\JonEJet\Desktop\OTC.exe
[2012/05/31 09:19:25 | 000,349,920 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/05/30 11:05:05 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\JonEJet\Desktop\aswMBR.exe
[2012/05/30 09:46:03 | 001,805,736 | ---- | M] (Symantec Corporation) -- C:\Users\JonEJet\Desktop\FixZeroAccess.exe
[2012/05/28 12:15:03 | 000,005,120 | ---- | M] () -- C:\Users\JonEJet\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/27 10:01:18 | 000,000,917 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/06/13 12:06:22 | 000,047,616 | ---- | C] () -- C:\Users\JonEJet\Desktop\Win32kDiag.exe
[2012/06/09 13:40:30 | 000,059,246 | ---- | C] () -- C:\Users\JonEJet\Documents\marci.jpg
[2012/06/08 14:17:37 | 2137,415,680 | -HS- | C] () -- C:\hiberfil.sys
[2012/06/07 23:30:54 | 001,415,784 | ---- | C] () -- C:\Users\JonEJet\Desktop\yorkyt.exe
[2012/06/07 11:02:55 | 000,080,384 | ---- | C] () -- C:\Users\JonEJet\Documents\MBRCheck.exe
[2012/06/06 23:37:06 | 000,015,494 | ---- | C] () -- C:\Users\JonEJet\log.xml
[2012/06/01 12:24:16 | 000,000,881 | ---- | C] () -- C:\Users\JonEJet\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/06/01 12:24:16 | 000,000,869 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/06/01 12:24:16 | 000,000,857 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/05/31 10:23:11 | 000,001,122 | ---- | C] () -- C:\Users\JonEJet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2011/05/18 16:44:04 | 000,001,356 | ---- | C] () -- C:\Users\JonEJet\AppData\Local\d3d9caps.dat
[2011/01/30 04:50:10 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011/01/30 04:50:10 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010/12/28 12:48:12 | 000,651,264 | ---- | C] ( ) -- C:\Windows\System32\lxdupmui.dll
[2010/12/28 12:48:09 | 000,376,832 | ---- | C] ( ) -- C:\Windows\System32\lxducomm.dll
[2010/12/28 12:48:06 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxduhbn3.dll
[2010/12/28 12:48:04 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\lxducfg.exe
[2010/12/28 12:48:04 | 000,208,896 | ---- | C] () -- C:\Windows\System32\lxdugrd.dll
[2010/12/28 12:48:02 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxduvs.dll
[2010/12/28 12:48:01 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\lxduih.exe
[2010/12/28 12:45:37 | 000,045,056 | ---- | C] () -- C:\Windows\System32\LXDUPMON.DLL
[2010/12/28 12:45:37 | 000,032,768 | ---- | C] () -- C:\Windows\System32\LXDUFXPU.DLL
[2010/12/28 12:45:15 | 000,086,016 | ---- | C] () -- C:\Windows\System32\lxduoem.dll
[2010/12/28 12:32:53 | 000,389,120 | ---- | C] () -- C:\Windows\System32\LXDUinst.dll
[2010/12/28 12:32:52 | 000,446,464 | ---- | C] ( ) -- C:\Windows\System32\LXDUhcp.dll
[2010/12/28 12:32:51 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\lxduinpa.dll
[2010/12/28 12:32:50 | 000,339,968 | ---- | C] ( ) -- C:\Windows\System32\lxduiesc.dll
[2010/12/28 12:32:46 | 000,860,160 | ---- | C] ( ) -- C:\Windows\System32\lxduusb1.dll
[2010/12/28 12:32:44 | 001,069,056 | ---- | C] ( ) -- C:\Windows\System32\lxduserv.dll
[2010/12/28 12:32:39 | 000,577,536 | ---- | C] ( ) -- C:\Windows\System32\lxdulmpm.dll
[2010/12/28 12:32:24 | 000,589,824 | ---- | C] ( ) -- C:\Windows\System32\lxducoms.exe
[2010/12/28 12:32:13 | 000,761,856 | ---- | C] ( ) -- C:\Windows\System32\lxducomc.dll
[2010/12/28 12:23:12 | 000,409,600 | ---- | C] ( ) -- C:\Windows\System32\lxducoin.dll
[2010/12/28 12:22:08 | 000,081,920 | ---- | C] () -- C:\Windows\System32\lxducaps.dll
[2010/12/28 12:22:08 | 000,069,632 | ---- | C] () -- C:\Windows\System32\lxducnv4.dll
[2010/12/28 12:22:06 | 001,036,288 | ---- | C] () -- C:\Windows\System32\lxdudrs.dll
[2010/10/12 21:44:13 | 000,000,282 | ---- | C] () -- C:\Users\JonEJet\AppData\Roaming\wklnhst.dat

========== LOP Check ==========

[2012/01/30 22:44:31 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\30EF7
[2011/01/03 14:09:41 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\5600-6600 Series
[2012/05/29 11:22:35 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\Babylon
[2012/05/30 10:20:51 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\FixZeroAccess
[2011/01/03 13:57:23 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\Lexmark Productivity Studio
[2011/04/03 11:17:53 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\OpenOffice.org
[2008/05/05 17:55:23 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\Sirius
[2012/06/01 11:35:56 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\SoftGrid Client
[2011/10/08 17:34:20 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\StreamTorrent
[2010/10/12 21:44:18 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\Template
[2009/06/17 11:39:53 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\TOSHIBA
[2011/01/28 17:36:21 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\TP
[2008/03/31 20:10:41 | 000,000,000 | ---D | M] -- C:\Users\JonEJet\AppData\Roaming\WinBatch
[2012/06/13 10:22:35 | 000,032,574 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >

Also, not sure where that Amazon google search came from???

Something in your OTL log, do you know this IP address? 10.61.32.1

No, have no idea what that IP address is

Thanks Belahzur!

Please run OTL

• Under the Custom Scans/Fixes box at the bottom, copy and paste in the following:
  
  

  :otl
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3BCB3EAE-FB8F-4141-8934-8A0E11E5B570}: DhcpNameServer = 10.61.32.1
  CHR - default_search_provider: Amazon (Enabled)
  CHR - default_search_provider: search_url = http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_cr_us_display?ie=UTF8&tag=bds-amzn-serp-us-cr-20&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_cr_ds_&query={searchTerms}
  FF - prefs.js..browser.startup.homepage: "http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_home?ie=UTF8&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_ff_sp_"
  FF - prefs.js..keyword.URL: "http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_ff_us_display?ie=UTF8&tag=bds-amzn-serp-us-ff-20&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_ff_ab_&query="
  IE - HKCU\..\SearchScopes\{21475A23-BD73-3152-6CAC-741072CD9B98}: "URL" = http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_ie_us_display?ie=UTF8&tag=bds-amzn-serp-us-ie-20&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_ie_ds_&query={searchTerms}
  IE - HKCU\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://blekko.com/ws/?source=c3348dd4&tbp=rbox&toolbarid=blekkotb_031&u=078E4B36CE8D139AA3721C4FC3CC31B5&q={searchTerms}
  IE - HKLM\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = http://www.searchqu.com/web?src=ieb&systemid=406&q={searchTerms}
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_home?ie=UTF8&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_ie_sp_
  
  :commands
  [emptytemp]
  [reboot]

  
  
  
• Then click the Run Fix button at the top.
  
• Note: The fix for OTL automatically hides your Desktop and Start menu so the fix can be completed. Do not be alerted, this is normal.
  
• Please do not exit the program. It might take a while to fix, but allow it to run. If it asks to reboot the computer, allow it to reboot. If the program freezes, and the computer fails to reboot - let me know.
  Lastly, post the contents of the log. (Located at C:\_OTL\Moved Files)

---

Save these instructions so you can have access to them while in Safe Mode.

Please click here to download AVP Tool by Kaspersky.

• Save it to your desktop.
• Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
• Double click the setup file to run it.
• Click Next to continue.
• Accept the License agreement and click on next.
• It will, by default, install it to your desktop folder. Click Next.
• It will then open a box There will be a tab that says Automatic scan.
• Under Automatic scan make sure these are checked.

• Hidden Startup Objects
• System Memory
• Disk Boot Sectors.
• My Computer.
• Also any other drives (Removable that you may have)

Leave the rest of the settings as they appear as default.

• Then click on Scan at the to right hand Corner.
• It will automatically Neutralize any objects found.
• If some objects are left un-neutralized then click the button that says Neutralize all
• If it says it cannot be neutralized then choose the delete option when prompted.
• After that is done click on the reports button at the bottom and save it to file name it Kas.
• Save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.
  
  Note: This tool will self uninstall when you close it so please save the log before closing it.

All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3BCB3EAE-FB8F-4141-8934-8A0E11E5B570}\\DhcpNameServer| /E : value set successfully!
Unable to fix default_search_provider items.
Unable to fix default_search_provider items.
Prefs.js: "http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_home?ie=UTF8&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_ff_sp_" removed from browser.startup.homepage
Prefs.js: "http://www.amazon.com/websearch/ref=bit_bds-amzn_serp_ff_us_display?ie=UTF8&tag=bds-amzn-serp-us-ff-20&tagbase=bds-amzn&tbrId=v1_abb-channel-17_058b36b5bfba43a19ad94c27393900e6_17_17_20120601_US_ff_ab_&query=" removed from keyword.URL
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{21475A23-BD73-3152-6CAC-741072CD9B98}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21475A23-BD73-3152-6CAC-741072CD9B98}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: JonEJet
->Temp folder emptied: 225442345 bytes
->Temporary Internet Files folder emptied: 101693646 bytes
->Java cache emptied: 12308864 bytes
->FireFox cache emptied: 111239166 bytes
->Google Chrome cache emptied: 6962424 bytes
->Flash cache emptied: 355310 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 15766 bytes
RecycleBin emptied: 62849844 bytes

Total Files Cleaned = 497.00 mb


OTL by OldTimer - Version 3.2.45.0 log created on 06142012_091807


< End of report >


Last edited by JonEJet on 14th June 2012, 2:07 pm; edited 1 time in total

Hey JonEJet, the big guns are helping you now.

Seems you posted an OTL log you already posted before.

Assuming you ran the OTL "Run Fix" script that DragonMaster Jay requested in his previous post, the log should be located in C:\_OTL\Moved Files

I thought so....looking again

Thanks Gabe, fixed previous post using todays scan

Fixed...see above

Thank you

OK

How about the AVP scan in safe mode, as indicated by DMJ?

Scanning right now under safe mode

This scan is 3.5 hours in, and still has a ways to go...is that normal?

It can take a while. Don't know why it is taking that long. Give it a bit longer.

Does it say if it has detected anything? If so...what's the detection?

nothing detected as of yet

44% done,says I have 5 hours left???

That seems a bit ridiculous, to be honest. I have successfully run that tool in 2 hours or less.

Let's switch to Dr Web CureIt, please:

Please download DrWeb-CureIt and save it to your Desktop. Do NOT perform a scan yet

• Double-click on drweb-cureit.exe to start the program.
  An Express Scan of your PC notice will appear.
  
• Under Start the Express Scan Now, Click OK to start the scan.
  This is a short scan that will scan the files currently running in memory.
  If something is found, click the Yes button when it asks you if you want to cure it.
  
• Once the short scan has finished, Click Options > Change settings
  
• Choose the Scan tab and UNcheck Heuristic analysis
  
• Back at the main window, click Custom Scan, then Select drives (a red dot will show which drives have been chosen).
  
• Then click the Start/Stop Scanning button (green arrow on the right, and the scan will start.
  
• When finished, a message will be displayed at the bottom advising if any viruses were found.
  
• Click Yes to all if it asks if you want to cure/move the file.
  
• When the scan has finished, look if you can see the icon next to the files found.
  If so, click it, then click the next icon right below and select Move incurable.
  (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
  
• Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
  
• Save the DrWeb.csv report to your Desktop.
  
• Exit Dr.Web Cureit when you have finished.
  
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
  

OTL infected with Trojan.Siggen4.2299

Did the quick scan, now on custom scan which is 3hrs in....not sure why these are going so slow, but not stopping now

Has found 7 infections, 13 curious thusfar

Okay, I have the log saved....but it is so long i can't paste it here

What can I do so you can see it?

Also have a quarantine file saved in my documents.........should I delete them all?

Submit that to http://www.mediafire.com and then post the download link here, please.

http://www.mediafire.com/?z6dg6xycdm5zgx5


Here is quarantine

http://www.mediafire.com/i/?kdub20h2ief5g0m

Taking a look at your quarantine pic there...

OTL was detected incorrectly by Dr. Web. It happens all the time.

Anyway, it's interesting that GetAd.JS was quarantined. GetAd.js contains scripting code to redirect web searches. All those GetAd*.aspx were all special ad pages by the malware. It's a scripting/macro virus aimed at displaying individual ads to you while browsing the internet (AKA redirecting your searches). I have all the locations outlined below.

Coders work with this advertising model, but some have done it scammy: http://www.aspfree.com/c/a/ASP.NET/Programming-an-InText-Advertising-System-under-ASPNET-35/

It's a legit type of idea, but definitely used maliciously in this case of yours!!


From the Scan Log:

C:\Users\JonEJet\Documents\My Pictures\LL_files\GetAd.js - archive contains infected objects - moved
C:\Users\JonEJet\Documents\My Pictures\LL_files\getjs.js - archive JS-HTML
C:\Users\JonEJet\Documents\My Pictures\LL_files\GetAd.js - probably infected with SCRIPT.Virus
C:\Users\JonEJet\Documents\My Pictures\LL_files\GetAd.js - archive JS-HTML
>C:\Users\JonEJet\Documents\My Pictures\LL_files\GetAd.js/JSFile_1[0][919] - probably infected with SCRIPT.Virus
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[1].aspx - probably infected with SCRIPT.Virus
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[1].aspx - archive JS-HTML
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[1].aspx/JSFile_1[0][615] - probably infected with SCRIPT.Virus
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[1].aspx/JSWrite_2[185] - OK
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[1].aspx/IFrame_3[98] - OK
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[1].aspx - archive contains infected objects - moved
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[2].aspx - probably infected with SCRIPT.Virus
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[2].aspx - archive JS-HTML
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[2].aspx/JSFile_1[0][612] - probably infected with SCRIPT.Virus
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[2].aspx/JSWrite_2[185] - OK
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[2].aspx/IFrame_3[98] - OK
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[2].aspx - archive contains infected objects - moved
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[3].aspx - probably infected with SCRIPT.Virus
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[3].aspx - archive JS-HTML
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[3].aspx/JSFile_1[0][741] - probably infected with SCRIPT.Virus
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[3].aspx/JSWrite_2[1e2] - OK
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[3].aspx/IFrame_3[f5] - OK
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBN99C74\GetAd[3].aspx - archive contains infected objects - moved
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPVKWOSX\GetAd[1].aspx - probably infected with SCRIPT.Virus
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPVKWOSX\GetAd[1].aspx - archive JS-HTML
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPVKWOSX\GetAd[1].aspx/JSFile_1[0][741] - probably infected with SCRIPT.Virus
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPVKWOSX\GetAd[1].aspx/JSWrite_2[1e2] - OK
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPVKWOSX\GetAd[1].aspx/IFrame_3[f5] - OK
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPVKWOSX\GetAd[1].aspx - archive contains infected objects - moved
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G0WF783Q\ros[2] - probably infected with SCRIPT.Virus
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G0WF783Q\GetAd[1].aspx - probably infected with SCRIPT.Virus
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G0WF783Q\GetAd[1].aspx - archive JS-HTML
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G0WF783Q\GetAd[1].aspx/JSFile_1[0][61c] - probably infected with SCRIPT.Virus
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G0WF783Q\GetAd[1].aspx/JSWrite_2[185] - OK
>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G0WF783Q\GetAd[1].aspx/IFrame_3[98] - OK
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G0WF783Q\GetAd[1].aspx - archive contains infected objects - moved

C:\Documents and Settings\JonEJet\DoctorWeb\Quarantine\yorkyt.exe infected with Trojan.MulDrop3.44950 - incurable - moved

What was yorkyt.exe - did you rename a tool?

Do you know what the LL_files directory was? It's really strange to see detections within My Pictures. Usually the user put infected files there.

Redirects should be gone now, yes?

Redirects are not gone, unbelievably ....just did a search

Only happens when I do a google search

The yorkyt.exe was a download during this process


I just deleted everything I could and I just got this

hxxp://8.26.70.252/see/display.php?q=new+york+jets&affsub=46355-4977_1233&subid=e10

Last edited by DragonMaster Jay on 15th June 2012, 6:18 pm; edited 1 time in total (Reason for editing : Please replace the tt letters in the HTTP:// with xx letters)

I will be back in the next few hours with a new fix, after complete investigation is made in to this issue.

I have to step out for a short time. Be back soon!

Thanks for the help guys....I know this is a pain in the A$$ for all of you.

It can be. I've dealt with even worse issues here and here.

Anyway, this malware is looking more and more like DNSChanger. Appears from the events that have occurred, your DNS is poisoned.

Let's kill it...yes?!

I have seen a combination infection from both Win32 DNSChanger-VJ and Rootkit.ZeroAccess.

---

NEXT STEPS IN ORDER

1. RE-RUN COMBOFIX
Delete your copy of ComboFix, and download a new version. Run ComboFix as instructed before, and post a new log please.

2. Please run OTL

• Under the Custom Scans/Fixes box at the bottom, copy and paste in the following:
  
  

  :Files
  echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  [EMPTYJAVA]

  
  
  
• Then click the Run Fix button at the top.
  
• Note: The fix for OTL automatically hides your Desktop and Start menu so the fix can be completed. Do not be alerted, this is normal.
  
• Please do not exit the program. It might take a while to fix, but allow it to run. If it asks to reboot the computer, allow it to reboot. If the program freezes, and the computer fails to reboot - let me know.
  Lastly, post the contents of the log. (Located at C:\_OTL\Moved Files)

3. Please open OTL -- Click the None button and paste this in the Custom Scans box:

hklm\software\clients\startmenuinternet|command /rs
%systemroot%\*. /rp /s
%USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s
%USERPROFILE%\AppData\Local\*.* /s
%USERPROFILE%\AppData\Local\*. /s
%TEMP%\smtmp\*.* /s
win32k.sys /md5
"%WinDir%\$NtUninstallKB*$." /30
C:\Program Files\Common Files\ComObjects\*.* /s
%systemroot%\*. /mp /s
%systemroot%\*. /rp /s

Then click Run Scan. It shall launch a log. Please post it in your next reply.


4. Download Farbar Recovery Scan Tool and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
  
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  
• Use the arrow keys to select the Repair your computer menu item.
  
• Choose your language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account and click Next.
  

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
  
• Restart your computer.
  
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  
• Click Repair your computer.
  
• Choose your language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account an click Next.
  

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt



• Select Command Prompt
  
• In the command window type in notepad and press Enter.
  
• The notepad opens. Under File menu select Open.
  
• Select "Computer" and find your flash drive letter and close the notepad.
  
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
  
• The tool will start to run.
  
• When the tool opens click Yes to the disclaimer.
  
• Place a check next to List Drivers MD5 as well as the default check marks that are already there
  
• Press Scan button.
  
• type exit and reboot the computer normally
  
• FRST will make a log (FRST.txt) on the flash drive, please copy and paste the log in your reply.

In your next reply, please make sure to include these logs:

-ComboFix log
-OTL Fix Log
-OTL Scan Log
-FRST Log

Also, let me know if it is redirecting after running the fix for OTL and ComboFix.

One at a time

ComboFix 12-06-15.03 - JonEJet 06/15/2012 14:35:57.2.2 - x86
Microsoft Windows Vista Home Premium 6.0.6001.1.1252.1.1033.18.2038.802 [GMT -4:00]
Running from: c:\users\JonEJet\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-05-15 to 2012-06-15 )))))))))))))))))))))))))))))))
.
.
2012-06-15 18:45 . 2012-06-15 18:50 -------- d-----w- c:\users\JonEJet\AppData\Local\temp
2012-06-15 18:45 . 2012-06-15 18:45 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-06-15 18:45 . 2012-06-15 18:45 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-15 09:54 . 2012-06-15 09:54 -------- d-----w- c:\programdata\boost_interprocess
2012-06-15 09:53 . 2012-06-15 09:53 -------- d-----w- c:\program files\MediaFire Express
2012-06-15 09:52 . 2012-06-15 12:51 -------- d-----w- c:\users\JonEJet\AppData\Local\MediaFire Express
2012-06-14 19:08 . 2012-06-15 14:57 -------- d-----w- c:\users\JonEJet\DoctorWeb
2012-06-14 14:14 . 2012-06-14 14:14 -------- d-----w- c:\programdata\Kaspersky Lab
2012-06-14 13:26 . 2012-06-14 13:26 0 ----a-w- c:\windows\system32\shoA32C.tmp
2012-06-08 18:08 . 2012-06-08 18:12 -------- d-----w- c:\programdata\HitmanPro
2012-06-07 11:41 . 2012-06-15 18:29 -------- d-----w- C:\SeviceFix
2012-06-01 16:24 . 2012-04-21 01:18 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2012-06-01 16:24 . 2012-04-21 01:18 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2012-06-01 01:01 . 2012-06-01 01:01 -------- d-----w- c:\program files\Amazon
2012-06-01 01:00 . 2012-06-01 15:45 -------- d-----w- c:\program files\Amazon Browser Bar
2012-05-31 14:01 . 2012-06-06 16:05 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-05-31 13:59 . 2012-06-06 15:50 624608 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-05-31 13:59 . 2012-06-06 15:50 43488 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll
2012-05-31 13:59 . 2012-06-06 15:50 157600 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-05-31 13:59 . 2012-06-06 15:50 113120 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-05-30 14:20 . 2012-05-30 14:20 -------- d-----w- c:\users\JonEJet\AppData\Roaming\FixZeroAccess
2012-05-29 15:23 . 2012-05-29 15:27 -------- d-----w- c:\program files\Free Download Manager
2012-05-29 15:22 . 2012-05-29 15:22 -------- d-----w- c:\programdata\Babylon
2012-05-29 15:22 . 2012-05-29 15:22 -------- d-----w- c:\users\JonEJet\AppData\Roaming\Babylon
2012-05-28 19:04 . 2012-05-28 19:46 -------- d-----w- c:\users\JonEJet\AppData\Local\blekkotb_031
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-04 19:50 . 2011-04-02 16:25 472864 ----a-w- c:\windows\system32\deployJava1.dll
2012-04-04 19:56 . 2010-12-07 10:54 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-06 15:50 . 2012-06-01 16:24 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 2153472]
"MediaFire Tray"="c:\users\JonEJet\AppData\Local\MediaFire Express\mf_systray.exe" [2012-06-13 2172488]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-20 141848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-20 129560]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-25 4444160]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-15 102400]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-11-06 1862144]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-02-02 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]
.
c:\users\JonEJet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OpenOffice.org 3.3.lnk - c:\users\JonEJet\AppData\Local\temp\quickstart.exe [N/A]
_uninst_.lnk - c:\users\JonEJet\AppData\Local\temp\_uninst_.bat [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
Contents of the 'Scheduled Tasks' folder
.
2012-03-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cd0b4fdb4952f0.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 02:58]
.
2012-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 02:58]
.
.
------- Supplementary Scan -------
.
uStart Page =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 208.59.247.45 208.59.247.46
FF - ProfilePath - c:\users\JonEJet\AppData\Roaming\Mozilla\Firefox\Profiles\okcrvxtn.default\
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files:
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MpsSvc]
"ImagePath"="."
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
------------------------ Other Running Processes ------------------------
.
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\windows\system32\lxducoms.exe
c:\toshiba\IVP\ISM\pinger.exe
c:\program files\Microsoft Application Virtualization Client\sftvsa.exe
c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\windows\system32\TODDSrv.exe
c:\program files\Toshiba\Power Saver\TosCoSrv.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Microsoft Application Virtualization Client\sftlist.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
c:\windows\RtHDVCpl.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Synaptics\SynTP\SynTPEnh.exe
c:\program files\Synaptics\SynTP\SynToshiba.exe
c:\users\JonEJet\AppData\Local\MediaFire Express\mf_daemon.exe
c:\users\JonEJet\AppData\Local\MediaFire Express\mf_status.exe
c:\users\JonEJet\AppData\Local\MediaFire Express\mf_services.exe
.
**************************************************************************
.
Completion time: 2012-06-15 15:20:19 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-15 19:20
.
Pre-Run: 65,449,205,760 bytes free
Post-Run: 65,498,370,048 bytes free
.
- - End Of File - - B5B0758A59F530B339AEBE857D0BB436

Step II

All processes killed
========== FILES ==========
< echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c >
Are you sure (Y/N)?processed file: C:\Windows\system32\drivers\etc\hosts
C:\Users\JonEJet\Desktop\cmd.bat deleted successfully.
C:\Users\JonEJet\Desktop\cmd.txt deleted successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\JonEJet\Desktop\cmd.bat deleted successfully.
C:\Users\JonEJet\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: JonEJet
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 52972771 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 7527 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 51.00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: JonEJet
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: JonEJet
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.48.0 log created on 06152012_153124

Step III


http://www.mediafire.com/?45k48dhwoxkiygc

Step IV

Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 03-06-2012
Ran by SYSTEM at 15-06-2012 17:53:53
Running from C:\Users\JonEJet\Downloads
Windows Vista (TM) Home Premium (X86) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [141848 2007-09-20] (Intel Corporation)
HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [129560 2007-09-20] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] RtHDVCpl.exe [x]
HKLM\...\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe [102400 2007-08-15] (Synaptics, Inc.)
HKLM\...\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [1862144 2007-11-06] (Google)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [413696 2009-05-26] (Apple Inc.)
HKLM\...\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [198160 2010-02-01] (RealNetworks, Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [40368 2011-08-30] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4241512 2012-03-06] (AVAST Software)
HKU\Default\...\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [430080 2007-05-18] (TOSHIBA)
HKU\Default User\...\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [430080 2007-05-18] (TOSHIBA)
HKU\JonEJet\...\Run: [MediaFire Tray] "C:\Users\JonEJet\AppData\Local\MediaFire Express\mf_systray.exe" --boot-start [2172488 2012-06-13] (MediaFire LLC)
Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)
Tcpip\Parameters: [DhcpNameServer] 208.59.247.45 208.59.247.46
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
Startup: C:\Users\JonEJet\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\JonEJet\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> (No File)
Startup: C:\Users\JonEJet\Start Menu\Programs\Startup\_uninst_.lnk
ShortcutTarget: _uninst_.lnk -> (No File)

================================ Services (Whitelisted) ==================

2 AgereModemAudio; C:\Windows\system32\agrsmsvc.exe [9216 2006-10-05] (Agere Systems)
2 avast! Antivirus; "C:\Program Files\AVAST Software\Avast\AvastSvc.exe" [44768 2012-03-06] (AVAST Software)
2 CFSvcs; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2006-11-15] (TOSHIBA CORPORATION)
2 Eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [21504 2008-01-19] (Microsoft Corporation)
3 GameConsoleService; "C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe" [181784 2007-09-24] (WildTangent, Inc.)
3 GoogleDesktopManager; "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [1862144 2007-11-06] (Google)
2 gupdate1caa3b3b7341e00; "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc [133104 2010-02-01] (Google Inc.)
2 lxdu_device; C:\Windows\system32\lxducoms.exe -service [589824 2010-10-14] ( )
2 pinger; C:\TOSHIBA\IVP\ISM\pinger.exe [136816 2007-01-25] ()
2 TNaviSrv; C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe [77824 2007-09-19] (TOSHIBA Corporation)
2 TODDSrv; C:\Windows\system32\TODDSrv.exe [114688 2006-05-25] (TOSHIBA Corporation)
2 TosCoSrv; "C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe" [427576 2007-03-29] (TOSHIBA Corporation)
2 TOSHIBA Bluetooth Service; C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [125048 2007-02-26] (TOSHIBA CORPORATION)
2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-23] (Ulead Systems, Inc.)
2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [x]
2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [x]
3 MozillaMaintenance; C:\Program Files\Mozilla Maintenance Service\maintenanceservice_tmp.exe [x]

========================== Drivers (Whitelisted) =============

2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [20696 2012-03-06] (AVAST Software)
2 aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [57688 2012-03-06] (AVAST Software)
1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [35672 2012-03-06] (AVAST Software)
1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [612184 2012-03-06] (AVAST Software)
1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [337880 2012-03-06] (AVAST Software)
1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [53848 2012-03-06] (AVAST Software)
4 KR10I; C:\Windows\System32\drivers\kr10i.sys [219264 2006-11-09] (TOSHIBA CORPORATION)
4 KR10N; C:\Windows\System32\drivers\kr10n.sys [211072 2006-11-09] (TOSHIBA CORPORATION)
4 KR3NPXP; C:\Windows\System32\drivers\kr3npxp.sys [479488 2006-09-27] (TOSHIBA CORPORATION)
4 Processor; C:\Windows\System32\drivers\processr.sys [38400 2006-11-02] (Microsoft Corporation)
0 ACPI; system32\drivers\acpi.sys [x]
3 AgereSoftModem; system32\DRIVERS\AGRSM.sys [x]
3 AsyncMac; system32\DRIVERS\asyncmac.sys [x]
0 atapi; system32\drivers\atapi.sys [x]
2 avgntflt; system32\DRIVERS\avgntflt.sys [x]
1 avipbb; system32\DRIVERS\avipbb.sys [x]
4 blbdrive; C:\Windows\System32\drivers\blbdrive.sys [x]
3 bowser; system32\DRIVERS\bowser.sys [x]
3 catchme; \??\C:\ComboFix\catchme.sys [x]
4 cdfs; system32\DRIVERS\cdfs.sys [x]
1 cdrom; system32\DRIVERS\cdrom.sys [x]
0 CLFS; System32\CLFS.sys [x]
3 CmBatt; system32\DRIVERS\CmBatt.sys [x]
0 Compbatt; system32\DRIVERS\compbatt.sys [x]
0 crcdisk; system32\drivers\crcdisk.sys [x]
2 CWMonitor; \??\C:\Program Files\Common Files\Symantec Shared\coShared\CW\1.5\CO_Mon.sys [x]
1 DfsC; System32\Drivers\dfsc.sys [x]
0 disk; system32\drivers\disk.sys [x]
3 drmkaud; system32\drivers\drmkaud.sys [x]
3 E1G60; system32\DRIVERS\E1G60I32.sys [x]
0 Ecache; System32\drivers\ecache.sys [x]
4 fdc; system32\DRIVERS\fdc.sys [x]
0 FileInfo; system32\drivers\fileinfo.sys [x]
3 Filetrace; system32\drivers\filetrace.sys [x]
4 flpydisk; system32\DRIVERS\flpydisk.sys [x]
0 FltMgr; system32\drivers\fltmgr.sys [x]
3 FwLnk; system32\DRIVERS\FwLnk.sys [x]
3 HdAudAddService; system32\drivers\HdAudio.sys [x]
3 HDAudBus; system32\DRIVERS\HDAudBus.sys [x]
3 HidUsb; system32\DRIVERS\hidusb.sys [x]
3 HTTP; system32\drivers\HTTP.sys [x]
1 i8042prt; system32\DRIVERS\i8042prt.sys [x]
3 igfx; system32\DRIVERS\igdkmd32.sys [x]
3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
0 intelide; system32\drivers\intelide.sys [x]
3 intelppm; system32\DRIVERS\intelppm.sys [x]
3 IO_Memory; \??\C:\WINDOWS\SYSTEM32\SYSPREP\Drivers\ioport.sys [x]
3 IpFilterDriver; system32\DRIVERS\ipfltdrv.sys [x]
3 IpInIp; system32\DRIVERS\ipinip.sys [x]
3 IPNAT; system32\DRIVERS\ipnat.sys [x]
3 IRENUM; system32\drivers\irenum.sys [x]
3 iScsiPrt; system32\DRIVERS\msiscsi.sys [x]
1 kbdclass; system32\DRIVERS\kbdclass.sys [x]
1 kbdhid; system32\DRIVERS\kbdhid.sys [x]
0 KSecDD; System32\Drivers\ksecdd.sys [x]
2 lltdio; system32\DRIVERS\lltdio.sys [x]
3 Modem; system32\drivers\modem.sys [x]
3 monitor; system32\DRIVERS\monitor.sys [x]
1 mouclass; system32\DRIVERS\mouclass.sys [x]
3 mouhid; system32\DRIVERS\mouhid.sys [x]
0 MountMgr; System32\drivers\mountmgr.sys [x]
3 mpsdrv; System32\drivers\mpsdrv.sys [x]
3 MpsSvc; . [x]
3 mrxsmb; system32\DRIVERS\mrxsmb.sys [x]
3 mrxsmb10; system32\DRIVERS\mrxsmb10.sys [x]
3 mrxsmb20; system32\DRIVERS\mrxsmb20.sys [x]
0 msahci; system32\drivers\msahci.sys [x]
0 msisadrv; system32\drivers\msisadrv.sys [x]
3 MSKSSRV; system32\drivers\MSKSSRV.sys [x]
3 MSPCLOCK; system32\drivers\MSPCLOCK.sys [x]
3 MSPQM; system32\drivers\MSPQM.sys [x]
3 mssmbios; system32\DRIVERS\mssmbios.sys [x]
3 MSTEE; system32\drivers\MSTEE.sys [x]
0 Mup; System32\Drivers\mup.sys [x]
3 NativeWifiP; system32\DRIVERS\nwifi.sys [x]
0 NDIS; system32\drivers\ndis.sys [x]
3 NdisTapi; system32\DRIVERS\ndistapi.sys [x]
3 Ndisuio; system32\DRIVERS\ndisuio.sys [x]
3 NdisWan; system32\DRIVERS\ndiswan.sys [x]
1 NetBIOS; system32\DRIVERS\netbios.sys [x]
1 netbt; System32\DRIVERS\netbt.sys [x]
1 nsiproxy; system32\drivers\nsiproxy.sys [x]
3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
3 ohci1394; system32\DRIVERS\ohci1394.sys [x]
0 partmgr; System32\drivers\partmgr.sys [x]
0 pci; system32\drivers\pci.sys [x]
0 pcmcia; system32\DRIVERS\pcmcia.sys [x]
2 PEAUTH; system32\drivers\peauth.sys [x]
3 PptpMiniport; system32\DRIVERS\raspptp.sys [x]
1 PSched; system32\DRIVERS\pacer.sys [x]
0 PxHelp20; System32\Drivers\PxHelp20.sys [x]
1 RasAcd; System32\DRIVERS\rasacd.sys [x]
3 Rasl2tp; system32\DRIVERS\rasl2tp.sys [x]
3 RasPppoe; system32\DRIVERS\raspppoe.sys [x]
3 RasSstp; system32\DRIVERS\rassstp.sys [x]
1 rdbss; system32\DRIVERS\rdbss.sys [x]
1 RDPCDD; System32\DRIVERS\RDPCDD.sys [x]
1 RDPENCDD; system32\drivers\rdpencdd.sys [x]
2 rspndr; system32\DRIVERS\rspndr.sys [x]
3 RTL8169; system32\DRIVERS\Rtlh86.sys [x]
3 RTL8187B; system32\DRIVERS\RTL8187B.sys [x]
3 sdbus; system32\DRIVERS\sdbus.sys [x]
3 Sftfs; system32\DRIVERS\Sftfslh.sys [x]
3 Sftplay; system32\DRIVERS\Sftplaylh.sys [x]
3 Sftredir; system32\DRIVERS\Sftredirlh.sys [x]
3 Sftvol; system32\DRIVERS\Sftvollh.sys [x]
1 Smb; system32\DRIVERS\smb.sys [x]
3 srv; System32\DRIVERS\srv.sys [x]
3 srv2; System32\DRIVERS\srv2.sys [x]
3 srvnet; System32\DRIVERS\srvnet.sys [x]
1 ssmdrv; system32\DRIVERS\ssmdrv.sys [x]
3 SVRPEDRV; \??\C:\Windows\System32\sysprep\UP_date\PEDrv.sys [x]
3 swenum; system32\DRIVERS\swenum.sys [x]
3 SynTP; system32\DRIVERS\SynTP.sys [x]
0 Tcpip; System32\drivers\tcpip.sys [x]
3 Tcpip6; system32\DRIVERS\tcpip.sys [x]
2 tcpipreg; System32\drivers\tcpipreg.sys [x]
3 tdcmdpst; system32\DRIVERS\tdcmdpst.sys [x]
3 TDPIPE; system32\drivers\tdpipe.sys [x]
3 TDTCP; system32\drivers\tdtcp.sys [x]
1 tdx; system32\DRIVERS\tdx.sys [x]
1 TermDD; system32\DRIVERS\termdd.sys [x]
3 tifm21; system32\drivers\tifm21.sys [x]
3 Tosrfcom; [x]
0 tos_sps32; system32\DRIVERS\tos_sps32.sys [x]
3 tssecsrv; System32\DRIVERS\tssecsrv.sys [x]
3 tunmp; system32\DRIVERS\tunmp.sys [x]
3 tunnel; system32\DRIVERS\tunnel.sys [x]
0 TVALZ; system32\DRIVERS\TVALZ_O.SYS [x]
4 udfs; system32\DRIVERS\udfs.sys [x]
3 umbus; system32\DRIVERS\umbus.sys [x]
3 usbccgp; system32\DRIVERS\usbccgp.sys [x]
3 usbehci; system32\DRIVERS\usbehci.sys [x]
3 usbhub; system32\DRIVERS\usbhub.sys [x]
3 usbprint; system32\DRIVERS\usbprint.sys [x]
3 usbscan; system32\DRIVERS\usbscan.sys [x]
3 USBSTOR; system32\DRIVERS\USBSTOR.SYS [x]
3 usbuhci; system32\DRIVERS\usbuhci.sys [x]
3 usbvideo; System32\Drivers\usbvideo.sys [x]
3 vga; system32\DRIVERS\vgapnp.sys [x]
0 volmgr; system32\drivers\volmgr.sys [x]
0 volmgrx; System32\drivers\volmgrx.sys [x]
0 volsnap; system32\drivers\volsnap.sys [x]
3 Wanarp; system32\DRIVERS\wanarp.sys [x]
1 Wanarpv6; system32\DRIVERS\wanarp.sys [x]
0 Wdf01000; system32\drivers\Wdf01000.sys [x]
3 WpdUsb; system32\DRIVERS\wpdusb.sys [x]
3 WUDFRd; system32\DRIVERS\WUDFRd.sys [x]
3 yukonwlh; system32\DRIVERS\yk60x86.sys [x]

========================== NetSvcs (Whitelisted) ===========


============ One Month Created Files and Folders ==============

2012-06-15 16:39 - 2012-06-15 16:39 - 0020976 ____A C:\Users\JonEJet\Desktop\FRST.txt
2012-06-15 16:10 - 2012-06-15 16:10 - 0008842 ____A C:\Users\JonEJet\Desktop\directions.txt
2012-06-15 16:07 - 2012-06-15 16:39 - 0000000 ____D C:\FRST
2012-06-15 16:05 - 2012-06-15 16:05 - 0874322 ____A C:\Users\JonEJet\Desktop\FRST.exe
2012-06-15 15:52 - 2012-06-15 15:57 - 0424470 ____A C:\Users\JonEJet\Desktop\OTL.Txt
2012-06-15 15:31 - 2012-06-15 15:43 - 0000000 ____D C:\_OTL
2012-06-15 15:28 - 2012-06-15 15:28 - 0596480 ____A (OldTimer Tools) C:\Users\JonEJet\Desktop\OTL.exe
2012-06-15 15:20 - 2012-06-15 15:20 - 0009014 ____A C:\ComboFix.txt
2012-06-15 14:50 - 2012-06-15 14:50 - 0000000 ____D C:\$RECYCLE.BIN
2012-06-15 14:33 - 2011-06-26 02:45 - 0256000 ____A C:\Windows\PEV.exe
2012-06-15 14:33 - 2010-11-07 13:20 - 0208896 ____A C:\Windows\MBR.exe
2012-06-15 14:33 - 2009-04-20 00:56 - 0060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2012-06-15 14:33 - 2000-08-30 20:00 - 0518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2012-06-15 14:33 - 2000-08-30 20:00 - 0406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2012-06-15 14:33 - 2000-08-30 20:00 - 0098816 ____A C:\Windows\sed.exe
2012-06-15 14:33 - 2000-08-30 20:00 - 0080412 ____A C:\Windows\grep.exe
2012-06-15 14:33 - 2000-08-30 20:00 - 0068096 ____A C:\Windows\zip.exe
2012-06-15 14:32 - 2012-06-15 15:20 - 0000000 ____D C:\Qoobox
2012-06-15 14:32 - 2012-06-15 15:20 - 0000000 ____D C:\ComboFix
2012-06-15 14:31 - 2012-06-15 14:31 - 4559180 ___RA (Swearware) C:\Users\JonEJet\Desktop\ComboFix.exe
2012-06-15 05:53 - 2012-06-15 05:53 - 0000000 ____D C:\Program Files\MediaFire Express
2012-06-15 05:52 - 2012-06-15 16:33 - 0000000 ____D C:\Users\JonEJet\AppData\Local\MediaFire Express
2012-06-15 05:52 - 2012-06-15 05:54 - 0000000 ____A C:\Windows\System32\install_results
2012-06-15 05:51 - 2012-06-15 05:52 - 24772832 ____A (MediaFire) C:\Users\JonEJet\Desktop\MediaFireExpress-0.13.1.3782-windows.exe
2012-06-14 22:07 - 2012-06-14 22:07 - 0138472 ____A C:\Windows\Minidump\Mini061412-01.dmp
2012-06-14 15:08 - 2012-06-15 10:57 - 0000000 ____D C:\Users\JonEJet\DoctorWeb
2012-06-14 15:01 - 2012-06-14 15:05 - 87081672 ____A C:\Users\JonEJet\Desktop\drweb-cureit.exe
2012-06-14 14:57 - 2012-06-15 16:31 - 2135339008 __ASH C:\hiberfil.sys
2012-06-14 09:50 - 2012-06-14 10:07 - 137409816 ____A C:\Users\JonEJet\Desktop\setup_11.0.0.1245.x01_2012_06_14_14_31.exe
2012-06-13 12:06 - 2012-06-13 12:06 - 0047616 ____A C:\Users\JonEJet\Desktop\Win32kDiag.exe
2012-06-13 10:40 - 2012-06-13 10:40 - 0029837 ____A C:\Windows\System32\svc.txt
2012-06-13 10:40 - 2012-06-13 10:40 - 0018588 ____A C:\Windows\System32\reg.txt
2012-06-09 13:40 - 2012-06-09 13:40 - 0059246 ____A C:\Users\JonEJet\Documents\marci.jpg
2012-06-08 01:14 - 2012-06-15 15:31 - 0000098 ____A C:\Windows\System32\Drivers\etc\Hosts
2012-06-08 00:48 - 2012-06-08 00:48 - 0138472 ____A C:\Windows\Minidump\Mini060812-01.dmp
2012-06-07 12:23 - 2012-06-07 12:32 - 0000294 ____A C:\Windows\mbr.log
2012-06-07 11:02 - 2012-06-07 11:03 - 0080384 ____A C:\Users\JonEJet\Documents\MBRCheck.exe
2012-06-07 07:41 - 2012-06-15 14:29 - 0000000 ____D C:\SeviceFix
2012-06-06 23:37 - 2012-06-06 23:37 - 0015494 ____A C:\Users\JonEJet\log.xml
2012-06-05 09:49 - 2012-06-05 09:49 - 0012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2012-06-04 15:51 - 2012-06-04 15:50 - 0476960 ____A (Sun Microsystems, Inc.) C:\Windows\System32\npdeployJava1.dll
2012-06-04 15:51 - 2012-06-04 15:50 - 0157472 ____A (Sun Microsystems, Inc.) C:\Windows\System32\javaws.exe
2012-06-04 15:51 - 2012-06-04 15:50 - 0149280 ____A (Sun Microsystems, Inc.) C:\Windows\System32\javaw.exe
2012-06-04 15:51 - 2012-06-04 15:50 - 0149280 ____A (Sun Microsystems, Inc.) C:\Windows\System32\java.exe
2012-06-04 13:36 - 2012-06-04 12:38 - 0002916 ____A C:\Windows\System32\SystemLook.txt
2012-06-04 13:13 - 2012-06-05 12:39 - 0002996 ____A C:\Users\JonEJet\Downloads\SystemLook.txt
2012-06-04 11:30 - 2012-06-04 11:30 - 0868860 ____A C:\Users\JonEJet\Downloads\FSRT.exe
2012-06-02 14:55 - 2012-06-02 14:55 - 98077435 ____A (Igor Pavlov) C:\Users\JonEJet\Desktop\OTLPEStd.exe
2012-06-01 12:59 - 2012-06-01 12:59 - 0000000 ____D C:\Users\JonEJet\AppData\Local\Seven Zip
2012-06-01 12:26 - 2012-06-01 12:26 - 16339280 ____A (Mozilla) C:\Users\JonEJet\Desktop\Firefox Setup 12.0.exe
2012-06-01 12:24 - 2012-06-01 12:27 - 0000857 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2012-06-01 10:02 - 2012-06-01 10:03 - 0139264 ____A C:\Users\JonEJet\Downloads\SystemLook.exe
2012-05-31 21:01 - 2012-05-31 21:01 - 0000000 ____D C:\Program Files\Amazon
2012-05-31 21:00 - 2012-06-01 11:45 - 0000000 ____D C:\Program Files\Amazon Browser Bar
2012-05-31 10:23 - 2012-05-31 10:23 - 0000000 ____D C:\Users\JonEJet\Documents\OneNote Notebooks
2012-05-31 10:01 - 2012-06-06 12:05 - 0000000 ____D C:\Program Files\Mozilla Maintenance Service
2012-05-31 09:27 - 2012-05-31 09:27 - 0201728 ____A (OldTimer Tools) C:\Users\JonEJet\Desktop\OTC.exe
2012-05-30 17:52 - 2012-05-30 17:52 - 0154916 ____A C:\Users\JonEJet\gmer.txt
2012-05-30 11:14 - 2012-05-30 11:14 - 0138472 ____A C:\Windows\Minidump\Mini053012-02.dmp
2012-05-30 11:09 - 2012-05-30 11:09 - 0138472 ____A C:\Windows\Minidump\Mini053012-01.dmp
2012-05-30 11:04 - 2012-05-30 11:05 - 4731392 ____A (AVAST Software) C:\Users\JonEJet\Desktop\aswMBR.exe
2012-05-30 10:20 - 2012-05-30 10:20 - 0000000 ____D C:\Users\JonEJet\AppData\Roaming\FixZeroAccess
2012-05-30 09:45 - 2012-05-30 09:46 - 1805736 ____A (Symantec Corporation) C:\Users\JonEJet\Desktop\FixZeroAccess.exe
2012-05-29 12:27 - 2012-05-29 12:27 - 0047616 ____A C:\Users\JonEJet\Downloads\Win32kDiag.exe
2012-05-29 11:34 - 2012-05-29 11:34 - 0302592 ____A C:\Users\JonEJet\Downloads\uyougp9z.exe
2012-05-29 11:23 - 2012-05-29 11:27 - 0000000 ____D C:\Program Files\Free Download Manager
2012-05-29 11:22 - 2012-05-29 11:22 - 0000000 ____D C:\Users\JonEJet\AppData\Roaming\Babylon
2012-05-29 11:19 - 2012-05-29 11:19 - 0809328 ____A (AirInstaller Inc.) C:\Users\JonEJet\Downloads\setup.exe
2012-05-29 11:02 - 2012-05-29 11:02 - 0000268 ____A C:\Users\JonEJet\Documents\CFScript.txt
2012-05-29 10:46 - 2012-05-29 10:46 - 0080384 ____A C:\Users\JonEJet\Downloads\MBRCheck.exe
2012-05-28 16:45 - 2012-05-28 16:46 - 82493320 ____A (Sophos Limited) C:\Users\JonEJet\Downloads\Sophos Virus Removal Tool.exe
2012-05-28 15:46 - 2012-05-28 15:46 - 2127448 ____A (Kaspersky Lab ZAO) C:\Users\JonEJet\Downloads\tdsskiller(1).exe
2012-05-28 15:04 - 2012-05-28 15:46 - 0000000 ____D C:\Users\JonEJet\AppData\Local\blekkotb_031
2012-05-28 15:04 - 2012-05-28 15:04 - 0000000 ____D C:\avast! sandbox

============ 3 Months Modified Files and Folders ===============

2012-06-15 16:42 - 2007-12-11 17:06 - 1242837 ____A C:\Windows\WindowsUpdate.log
2012-06-15 16:42 - 2006-11-02 09:01 - 0032574 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-06-15 16:42 - 2006-11-02 09:01 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2012-06-15 16:42 - 2006-11-02 08:47 - 0003568 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2012-06-15 16:42 - 2006-11-02 08:47 - 0003568 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2012-06-15 16:39 - 2012-06-15 16:39 - 0020976 ____A C:\Users\JonEJet\Desktop\FRST.txt
2012-06-15 16:39 - 2012-06-15 16:07 - 0000000 ____D C:\FRST
2012-06-15 16:33 - 2012-06-15 05:52 - 0000000 ____D C:\Users\JonEJet\AppData\Local\MediaFire Express
2012-06-15 16:31 - 2012-06-14 14:57 - 2135339008 __ASH C:\hiberfil.sys
2012-06-15 16:10 - 2012-06-15 16:10 - 0008842 ____A C:\Users\JonEJet\Desktop\directions.txt
2012-06-15 16:05 - 2012-06-15 16:05 - 0874322 ____A C:\Users\JonEJet\Desktop\FRST.exe
2012-06-15 15:57 - 2012-06-15 15:52 - 0424470 ____A C:\Users\JonEJet\Desktop\OTL.Txt
2012-06-15 15:56 - 2010-02-01 23:10 - 0000886 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-06-15 15:43 - 2012-06-15 15:31 - 0000000 ____D C:\_OTL
2012-06-15 15:31 - 2012-06-08 01:14 - 0000098 ____A C:\Windows\System32\Drivers\etc\Hosts
2012-06-15 15:28 - 2012-06-15 15:28 - 0596480 ____A (OldTimer Tools) C:\Users\JonEJet\Desktop\OTL.exe
2012-06-15 15:20 - 2012-06-15 15:20 - 0009014 ____A C:\ComboFix.txt
2012-06-15 15:20 - 2012-06-15 14:32 - 0000000 ____D C:\Qoobox
2012-06-15 15:20 - 2012-06-15 14:32 - 0000000 ____D C:\ComboFix
2012-06-15 14:51 - 2006-11-02 06:23 - 0000215 ____A C:\Windows\system.ini
2012-06-15 14:50 - 2012-06-15 14:50 - 0000000 ____D C:\$RECYCLE.BIN
2012-06-15 14:47 - 2007-11-06 19:27 - 0515718 ____A C:\Windows\PFRO.log
2012-06-15 14:45 - 2011-04-05 21:05 - 0000000 ____D C:\Windows\ERDNT
2012-06-15 14:31 - 2012-06-15 14:31 - 4559180 ___RA (Swearware) C:\Users\JonEJet\Desktop\ComboFix.exe
2012-06-15 14:29 - 2012-06-07 07:41 - 0000000 ____D C:\SeviceFix
2012-06-15 11:24 - 2008-03-31 15:54 - 0000000 ____D C:\users\JonEJet
2012-06-15 11:06 - 2008-03-31 15:56 - 0000000 ____D C:\Users\JonEJet\AppData\LocalLow
2012-06-15 10:57 - 2012-06-14 15:08 - 0000000 ____D C:\Users\JonEJet\DoctorWeb
2012-06-15 05:54 - 2012-06-15 05:52 - 0000000 ____A C:\Windows\System32\install_results
2012-06-15 05:53 - 2012-06-15 05:53 - 0000000 ____D C:\Program Files\MediaFire Express
2012-06-15 05:52 - 2012-06-15 05:51 - 24772832 ____A (MediaFire) C:\Users\JonEJet\Desktop\MediaFireExpress-0.13.1.3782-windows.exe
2012-06-14 22:07 - 2012-06-14 22:07 - 0138472 ____A C:\Windows\Minidump\Mini061412-01.dmp
2012-06-14 22:07 - 2011-12-24 16:50 - 296179937 ____A C:\Windows\MEMORY.DMP
2012-06-14 22:07 - 2011-12-24 16:50 - 0000000 ____D C:\Windows\Minidump
2012-06-14 15:05 - 2012-06-14 15:01 - 87081672 ____A C:\Users\JonEJet\Desktop\drweb-cureit.exe
2012-06-14 14:55 - 2011-05-18 16:44 - 0001356 ____A C:\Users\JonEJet\AppData\Local\d3d9caps.dat
2012-06-14 12:25 - 2011-12-18 20:31 - 2911356 ____A C:\Windows\ntbtlog.txt
2012-06-14 10:07 - 2012-06-14 09:50 - 137409816 ____A C:\Users\JonEJet\Desktop\setup_11.0.0.1245.x01_2012_06_14_14_31.exe
2012-06-14 03:02 - 2006-11-02 06:24 - 56731752 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2012-06-13 12:06 - 2012-06-13 12:06 - 0047616 ____A C:\Users\JonEJet\Desktop\Win32kDiag.exe
2012-06-13 10:40 - 2012-06-13 10:40 - 0029837 ____A C:\Windows\System32\svc.txt
2012-06-13 10:40 - 2012-06-13 10:40 - 0018588 ____A C:\Windows\System32\reg.txt
2012-06-12 01:00 - 2010-02-01 23:00 - 0001982 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2012-06-11 19:39 - 2011-04-08 13:49 - 0000000 ____D C:\Users\JonEJet\Desktop\Scapes New
2012-06-09 13:40 - 2012-06-09 13:40 - 0059246 ____A C:\Users\JonEJet\Documents\marci.jpg
2012-06-08 04:47 - 2006-11-02 06:22 - 41680896 ____A C:\Windows\System32\config\software_previous
2012-06-08 04:47 - 2006-11-02 06:22 - 17825792 ____A C:\Windows\System32\config\system_previous
2012-06-08 04:46 - 2006-11-02 07:18 - 0000000 ____D C:\Windows\System32\spool
2012-06-08 04:46 - 2006-11-02 07:18 - 0000000 ____D C:\Windows\System32\Msdtc
2012-06-08 04:46 - 2006-11-02 07:18 - 0000000 ____D C:\Windows\registration
2012-06-08 04:44 - 2006-11-02 06:22 - 40370176 ____A C:\Windows\System32\config\components_previous
2012-06-08 04:44 - 2006-11-02 06:22 - 0262144 ____A C:\Windows\System32\config\sam_previous
2012-06-08 01:13 - 2006-11-02 07:18 - 0000000 ___RD C:\users\Public
2012-06-08 00:48 - 2012-06-08 00:48 - 0138472 ____A C:\Windows\Minidump\Mini060812-01.dmp
2012-06-08 00:38 - 2006-11-02 06:22 - 0262144 ____A C:\Windows\System32\config\security_previous
2012-06-08 00:38 - 2006-11-02 06:22 - 0262144 ____A C:\Windows\System32\config\default_previous
2012-06-07 14:14 - 2006-11-02 06:33 - 0704254 ____A C:\Windows\System32\PerfStringBackup.INI
2012-06-07 12:32 - 2012-06-07 12:23 - 0000294 ____A C:\Windows\mbr.log
2012-06-07 11:03 - 2012-06-07 11:02 - 0080384 ____A C:\Users\JonEJet\Documents\MBRCheck.exe
2012-06-06 23:37 - 2012-06-06 23:37 - 0015494 ____A C:\Users\JonEJet\log.xml
2012-06-06 12:05 - 2012-05-31 10:01 - 0000000 ____D C:\Program Files\Mozilla Maintenance Service
2012-06-06 11:51 - 2009-07-24 21:11 - 0000000 ____D C:\Program Files\Mozilla Firefox
2012-06-05 12:39 - 2012-06-04 13:13 - 0002996 ____A C:\Users\JonEJet\Downloads\SystemLook.txt
2012-06-05 11:13 - 2007-11-11 11:18 - 0000000 ____D C:\DOCS
2012-06-05 09:49 - 2012-06-05 09:49 - 0012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2012-06-04 15:51 - 2007-11-06 19:07 - 0000000 ____D C:\Program Files\Common Files\Java
2012-06-04 15:50 - 2012-06-04 15:51 - 0476960 ____A (Sun Microsystems, Inc.) C:\Windows\System32\npdeployJava1.dll
2012-06-04 15:50 - 2012-06-04 15:51 - 0157472 ____A (Sun Microsystems, Inc.) C:\Windows\System32\javaws.exe
2012-06-04 15:50 - 2012-06-04 15:51 - 0149280 ____A (Sun Microsystems, Inc.) C:\Windows\System32\javaw.exe
2012-06-04 15:50 - 2012-06-04 15:51 - 0149280 ____A (Sun Microsystems, Inc.) C:\Windows\System32\java.exe
2012-06-04 15:50 - 2011-04-02 12:25 - 0472864 ____A (Sun Microsystems, Inc.) C:\Windows\System32\deployJava1.dll
2012-06-04 15:50 - 2007-11-06 19:07 - 0000000 ____D C:\Program Files\Java
2012-06-04 12:38 - 2012-06-04 13:36 - 0002916 ____A C:\Windows\System32\SystemLook.txt
2012-06-04 11:30 - 2012-06-04 11:30 - 0868860 ____A C:\Users\JonEJet\Downloads\FSRT.exe
2012-06-02 14:55 - 2012-06-02 14:55 - 98077435 ____A (Igor Pavlov) C:\Users\JonEJet\Desktop\OTLPEStd.exe
2012-06-02 11:10 - 2006-11-02 08:52 - 0024781 ____A C:\Windows\setupact.log
2012-06-02 11:05 - 2007-11-06 18:28 - 0000000 ____D C:\Windows\System32\RTCOM
2012-06-01 12:59 - 2012-06-01 12:59 - 0000000 ____D C:\Users\JonEJet\AppData\Local\Seven Zip
2012-06-01 12:27 - 2012-06-01 12:24 - 0000857 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2012-06-01 12:26 - 2012-06-01 12:26 - 16339280 ____A (Mozilla) C:\Users\JonEJet\Desktop\Firefox Setup 12.0.exe
2012-06-01 11:45 - 2012-05-31 21:00 - 0000000 ____D C:\Program Files\Amazon Browser Bar
2012-06-01 11:35 - 2011-01-28 17:33 - 0000000 ____D C:\Users\JonEJet\AppData\Roaming\SoftGrid Client
2012-06-01 10:03 - 2012-06-01 10:02 - 0139264 ____A C:\Users\JonEJet\Downloads\SystemLook.exe
2012-05-31 21:01 - 2012-05-31 21:01 - 0000000 ____D C:\Program Files\Amazon
2012-05-31 13:41 - 2008-03-31 15:57 - 0089424 ____A C:\Users\JonEJet\AppData\Local\GDIPFONTCACHEV1.DAT
2012-05-31 10:23 - 2012-05-31 10:23 - 0000000 ____D C:\Users\JonEJet\Documents\OneNote Notebooks
2012-05-31 09:27 - 2012-05-31 09:27 - 0201728 ____A (OldTimer Tools) C:\Users\JonEJet\Desktop\OTC.exe
2012-05-31 09:19 - 2006-11-02 08:47 - 0349920 ____A C:\Windows\System32\FNTCACHE.DAT
2012-05-30 17:52 - 2012-05-30 17:52 - 0154916 ____A C:\Users\JonEJet\gmer.txt
2012-05-30 11:14 - 2012-05-30 11:14 - 0138472 ____A C:\Windows\Minidump\Mini053012-02.dmp
2012-05-30 11:09 - 2012-05-30 11:09 - 0138472 ____A C:\Windows\Minidump\Mini053012-01.dmp
2012-05-30 11:05 - 2012-05-30 11:04 - 4731392 ____A (AVAST Software) C:\Users\JonEJet\Desktop\aswMBR.exe
2012-05-30 10:20 - 2012-05-30 10:20 - 0000000 ____D C:\Users\JonEJet\AppData\Roaming\FixZeroAccess
2012-05-30 09:46 - 2012-05-30 09:45 - 1805736 ____A (Symantec Corporation) C:\Users\JonEJet\Desktop\FixZeroAccess.exe
2012-05-29 12:27 - 2012-05-29 12:27 - 0047616 ____A C:\Users\JonEJet\Downloads\Win32kDiag.exe
2012-05-29 11:34 - 2012-05-29 11:34 - 0302592 ____A C:\Users\JonEJet\Downloads\uyougp9z.exe
2012-05-29 11:27 - 2012-05-29 11:23 - 0000000 ____D C:\Program Files\Free Download Manager
2012-05-29 11:22 - 2012-05-29 11:22 - 0000000 ____D C:\Users\JonEJet\AppData\Roaming\Babylon
2012-05-29 11:19 - 2012-05-29 11:19 - 0809328 ____A (AirInstaller Inc.) C:\Users\JonEJet\Downloads\setup.exe
2012-05-29 11:02 - 2012-05-29 11:02 - 0000268 ____A C:\Users\JonEJet\Documents\CFScript.txt
2012-05-29 10:46 - 2012-05-29 10:46 - 0080384 ____A C:\Users\JonEJet\Downloads\MBRCheck.exe
2012-05-28 16:46 - 2012-05-28 16:45 - 82493320 ____A (Sophos Limited) C:\Users\JonEJet\Downloads\Sophos Virus Removal Tool.exe
2012-05-28 15:46 - 2012-05-28 15:46 - 2127448 ____A (Kaspersky Lab ZAO) C:\Users\JonEJet\Downloads\tdsskiller(1).exe
2012-05-28 15:46 - 2012-05-28 15:04 - 0000000 ____D C:\Users\JonEJet\AppData\Local\blekkotb_031
2012-05-28 15:04 - 2012-05-28 15:04 - 0000000 ____D C:\avast! sandbox
2012-05-28 12:15 - 2009-07-26 00:35 - 0005120 ____A C:\Users\JonEJet\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-05-27 10:19 - 2006-11-02 07:18 - 0000000 ____D C:\Windows\SchCache
2012-05-27 10:01 - 2012-01-01 16:22 - 0000917 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-05-27 10:01 - 2010-12-07 06:54 - 0000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-05-15 12:02 - 2011-01-28 18:43 - 0000000 ____D C:\Users\JonEJet\Desktop\Scapes Old
2012-05-14 16:22 - 2011-01-28 15:06 - 0000000 ____D C:\Program Files\Microsoft Silverlight
2012-05-07 13:16 - 2006-11-02 06:23 - 0002577 ____A C:\Windows\System32\config.nt
2012-04-04 15:56 - 2010-12-07 06:54 - 0022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-03-26 08:56 - 2012-03-26 08:56 - 0000882 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cd0b4fdb4952f0.job


========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\explorer.exe
[2009-02-21 16:56] - [2008-10-29 02:29] - 2927104 ____A (Microsoft Corporation) 4F554999D7D5F05DAAEBBA7B5BA1089D

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\User32.dll
[2011-01-28 15:41] - [2008-01-19 00:36] - 0627200 ____A (Microsoft Corporation) B974D9F06DC7D1908E825DC201681269

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys
[2011-01-28 15:40] - [2008-01-19 00:42] - 0227896 ____A (Microsoft Corporation) D8B4A53DD2769F226B3EB374374987C9


==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points (XP) =====================


========================= Memory info ======================

Percentage of memory in use: 15%
Total physical RAM: 2038.33 MB
Available physical RAM: 1724.23 MB
Total Pagefile: 1869.04 MB
Available Pagefile: 1781.33 MB
Total Virtual: 2047.88 MB
Available Virtual: 2002.39 MB

======================= Partitions =========================

1 Drive b: (RAMDisk) (Fixed) (Total:0.06 GB) (Free:0.06 GB) NTFS
2 Drive c: (SQ004585V03) (Fixed) (Total:110.32 GB) (Free:61.12 GB) NTFS
3 Drive x: (ReatogoPE) (CDROM) (Total:0.28 GB) (Free:0 GB) CDFS

Disk ### Status Size Free Dyn Gpt
-------- ---------- ------- ------- --- ---
Disk 0 Online 112 GB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Unknown 1500 MB 1024 KB
Partition 2 Primary 110 GB 1501 MB
======================================================================================================

Disk: 0
Partition 1
Type : 27
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 TOSHIBA SYS NTFS Partition 1500 MB Healthy
======================================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C SQ004585V03 NTFS Partition 110 GB Healthy
======================================================================================================

==========================================================

Last Boot:

======================= End Of Log ==========================

Still being redirected FWIW.....lol Jeez

We're doing a bit of damage control here, so forgive me if any of your browser extensions get deleted.

(Side note: You're very persistent. We could use you on the force. Let me know if you'd like some training!)

This system is hereby untrusted! Therefore, even if there are no signs of rootkits or redirects, there may still be malware lurking about. It is most recommended to forbid any more steps here, and reformat and reinstall your PC. If you choose to continue, and we can try anyway, I have no guarantees. Continue below if you choose!!

Type 27 Hidden Partition Identified!!

Do you know what this partition was created for: Partition 1 Unknown 1500 MB 1024 KB ?? The size of it is 1500 MB.

Please go to: VirusTotal

• Click the Browse button and search for the following file: c:\program files\mozilla firefox\components\browsercomps.dll
  
• Click Open
  
• Then click Send File
  
• Please be patient while the file is scanned.
  
• Once the scan results appear, please provide them in your next reply.

If it says already scanned -- click "reanalyze now"

Please post the results in your next reply.


Re-running ComboFix to remove infections:

• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Open notepad and copy/paste the text in the codebox below into it:
  

  killall::
  
  ADS::
  C:\Users\JonEJet\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\41F219BD-00000001.eml:OECustomProperty
  
  File::
  c:\windows\system32\shoA32C.tmp
  C:\Users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_icmlaeflemplmjndnaapfdbbnpncnbda_0.localstorage
  C:\Users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pbjikboenpfhbbejgkoklgkhjpfogcam_0.localstorage
  C:\Users\JonEJet\Downloads\uyougp9z.exe
  C:\Users\JonEJet\Downloads\setup.exe
  
  Folder::
  C:\Users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Default\aabjollpjkfbikmogkgjjdogkmdhjeoj
  C:\Users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0
  C:\Users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\379QDL8O
  C:\Users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EODNN00Q
  C:\Users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SMJR8YQY
  C:\Users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ35FAKR
  C:\Users\JonEJet\AppData\Local\temp\WPDNSE
  
  SigCheck::
  c:\windows\explorer.exe
  C:\Windows\System32\User32.dll
  C:\Windows\System32\Drivers\volsnap.sys
  
  Reg::
  [-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MpsSvc]
  
  Driver::
  MpsSvc
  
  Reboot::

• Save this as CFScript.txt, in the same location as ComboFix.exe
  
  
  
  
• Referring to the picture above, drag CFScript into ComboFix.exe
  
• When finished, it shall produce a log for you at C:\ComboFix.txt
  
• Please post the contents of the log in your next reply.

Jay....I'm very competitive dude....I can't stand losing, and this little guy has me fired up....I got to beat this thing.....If I can help the boys here in any way, I'm your guy!!!!

Lets get back at it

https://www.virustotal.com/file/5399287c7dc6745c5c760e7f1e0da343a040f7176c867d59a4d6e4da4863ce78/analysis/1339810080/



ComboFix 12-06-15.03 - JonEJet 06/15/2012 21:34:42.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2038.1068 [GMT -4:00]
Running from: c:\users\JonEJet\Desktop\ComboFix.exe
Command switches used :: c:\users\JonEJet\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_icmlaeflemplmjndnaapfdbbnpncnbda_0.localstorage"
"c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pbjikboenpfhbbejgkoklgkhjpfogcam_0.localstorage"
"c:\users\JonEJet\Downloads\setup.exe"
"c:\users\JonEJet\Downloads\uyougp9z.exe"
"c:\windows\system32\shoA32C.tmp"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Default\aabjollpjkfbikmogkgjjdogkmdhjeoj
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Default\aabjollpjkfbikmogkgjjdogkmdhjeoj\background.html
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Default\aabjollpjkfbikmogkgjjdogkmdhjeoj\ContentScript.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Default\aabjollpjkfbikmogkgjjdogkmdhjeoj\manifest.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\ar\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\be\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\bg\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\ca\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\cs\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\da\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\de\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\el\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\en\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\en_GB\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\es\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\et\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\fa\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\fi\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\fr\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\he\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\hr\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\hu\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\id\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\it\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\ja\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\ko\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\nb\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\nl\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\pl\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\pt_BR\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\pt_PT\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\ro\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\ru\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\sk\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\sl\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\sr\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\sv\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\th\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\tr\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\uk\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\ur\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\vi\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\zh_CN\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\_locales\zh_TW\messages.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\background.html
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\manifest.json
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\popup.html
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\anchor.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\background.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\dateFormat.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\jquery.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\mouse.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\pbj.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\popup.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\protobuf.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\query.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\ratings.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\warnDlg.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\scripts\wrc_gpb.js
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\css\anchor.css
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\css\popup.css
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\background-body.jpg
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\background-right-bottom.jpg
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\background-right-top.jpg
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\close.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\disabled.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\grey.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\horizontal-line-white.jpg
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\horizontal-line.jpg
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icon_incorrect.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\corporate-small-disable.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\corporate-small-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\corporate.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\drugs-small-disable.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\drugs-small-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\drugs.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\gambling-small-disable.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\gambling-small-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\gambling.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green-1.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green-2.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green-3.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green-hover.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green1-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green1-small.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green2-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green2-small.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green3-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green3-24.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\green3-small.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\grey-0.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\grey-3.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\grey-small.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\grey0-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\grey3-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\illegal-small-disable.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\illegal-small-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\illegal.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\it-small-disable.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\it-small-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\it.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\limet-hover.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\limet-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\limet.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\line-dark-horizontal.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\line-light-horizontal.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\logo128.jpg
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\logo256.jpg
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\logo48.jpg
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\logo64.jpg
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\news-small-disable.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\news-small-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\news.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\orange-hover.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\orange-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\orange.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\orange1-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\orange2-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\orange3-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\pornography-small-disable.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\pornography-small-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\pornography.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red-1.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red-2.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red-3.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red-hover.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red1-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red1-small.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red2-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red2-small.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red3-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\red3-small.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\shopping-small-disable.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\shopping-small-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\shopping.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\social-small-disable.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\social-small-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\social.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\violence-small-disable.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\violence-small-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\violence.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\weapons-small-disable.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\weapons-small-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\weapons.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow-1.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow-2.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow-3.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow-hover.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow-selected.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow1-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow1-small.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow2-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow2-small.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow3-16.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\icons\yellow3-small.png
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\logo.jpg
c:\users\JonEJet\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\skin\images\vertical-line.jpg
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\379QDL8O
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\379QDL8O\&s=4uZeW4mRG8DveJvWLJ34AZkGGls[1].htm
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\379QDL8O\desktop.ini
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ35FAKR
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ35FAKR\desktop.ini
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQ35FAKR\pixel[1].gif
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EODNN00Q
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EODNN00Q\127.0.0[1].1
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EODNN00Q\desktop.ini
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EODNN00Q\favicon[1].ico
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SMJR8YQY
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SMJR8YQY\desktop.ini
c:\users\JonEJet\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SMJR8YQY\logo3[1].png
c:\users\JonEJet\AppData\Local\temp\WPDNSE
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_MpsSvc
.
.
((((((((((((((((((((((((( Files Created from 2012-05-16 to 2012-06-16 )))))))))))))))))))))))))))))))
.
.
2012-06-16 01:46 . 2012-06-16 01:46 8782 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2012-06-16 01:46 . 2012-06-16 01:46 7271 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2012-06-16 01:46 . 2012-06-16 01:46 23327 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2012-06-16 01:46 . 2012-06-16 01:46 20719 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS
2012-06-16 01:44 . 2012-06-16 01:51 -------- d-----w- c:\users\JonEJet\AppData\Local\temp
2012-06-16 01:44 . 2012-06-16 01:44 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-06-16 01:44 . 2012-06-16 01:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-15 20:07 . 2012-06-15 22:01 -------- d-----w- C:\FRST
2012-06-15 19:31 . 2012-06-15 19:43 -------- d-----w- C:\_OTL
2012-06-15 09:54 . 2012-06-15 09:54 -------- d-----w- c:\programdata\boost_interprocess
2012-06-15 09:53 . 2012-06-15 09:53 -------- d-----w- c:\program files\MediaFire Express
2012-06-15 09:52 . 2012-06-15 22:05 -------- d-----w- c:\users\JonEJet\AppData\Local\MediaFire Express
2012-06-14 19:08 . 2012-06-15 14:57 -------- d-----w- c:\users\JonEJet\DoctorWeb
2012-06-14 14:14 . 2012-06-14 14:14 -------- d-----w- c:\programdata\Kaspersky Lab
2012-06-08 18:08 . 2012-06-08 18:12 -------- d-----w- c:\programdata\HitmanPro
2012-06-07 11:41 . 2012-06-15 18:29 -------- d-----w- C:\SeviceFix
2012-06-01 16:24 . 2012-04-21 01:18 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2012-06-01 16:24 . 2012-04-21 01:18 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2012-06-01 01:01 . 2012-06-01 01:01 -------- d-----w- c:\program files\Amazon
2012-06-01 01:00 . 2012-06-01 15:45 -------- d-----w- c:\program files\Amazon Browser Bar
2012-05-31 14:01 . 2012-06-06 16:05 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-05-31 13:59 . 2012-06-06 15:50 624608 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-05-31 13:59 . 2012-06-06 15:50 43488 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll
2012-05-31 13:59 . 2012-06-06 15:50 157600 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-05-31 13:59 . 2012-06-06 15:50 113120 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-05-30 14:20 . 2012-05-30 14:20 -------- d-----w- c:\users\JonEJet\AppData\Roaming\FixZeroAccess
2012-05-29 15:23 . 2012-05-29 15:27 -------- d-----w- c:\program files\Free Download Manager
2012-05-29 15:22 . 2012-05-29 15:22 -------- d-----w- c:\programdata\Babylon
2012-05-29 15:22 . 2012-05-29 15:22 -------- d-----w- c:\users\JonEJet\AppData\Roaming\Babylon
2012-05-28 19:04 . 2012-05-28 19:46 -------- d-----w- c:\users\JonEJet\AppData\Local\blekkotb_031
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-04 19:50 . 2011-04-02 16:25 472864 ----a-w- c:\windows\system32\deployJava1.dll
2012-04-04 19:56 . 2010-12-07 10:54 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-06 15:50 . 2012-06-01 16:24 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 2153472]
"MediaFire Tray"="c:\users\JonEJet\AppData\Local\MediaFire Express\mf_systray.exe" [2012-06-13 2172488]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-20 141848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-20 129560]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-25 4444160]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-15 102400]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-11-06 1862144]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-02-02 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]
.
c:\users\JonEJet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OpenOffice.org 3.3.lnk - c:\users\JonEJet\AppData\Local\temp\quickstart.exe [N/A]
_uninst_.lnk - c:\users\JonEJet\AppData\Local\temp\_uninst_.bat [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
Contents of the 'Scheduled Tasks' folder
.
2012-03-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cd0b4fdb4952f0.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 02:58]
.
2012-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 02:58]
.
.
------- Supplementary Scan -------
.
uStart Page =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 208.59.247.45 208.59.247.46
FF - ProfilePath - c:\users\JonEJet\AppData\Roaming\Mozilla\Firefox\Profiles\okcrvxtn.default\
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files:
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BFE]
"ImagePath"="."
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
------------------------ Other Running Processes ------------------------
.
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\windows\system32\lxducoms.exe
c:\toshiba\IVP\ISM\pinger.exe
c:\program files\Microsoft Application Virtualization Client\sftvsa.exe
c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\windows\system32\TODDSrv.exe
c:\program files\Toshiba\Power Saver\TosCoSrv.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Microsoft Application Virtualization Client\sftlist.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
c:\windows\RtHDVCpl.exe
c:\program files\Synaptics\SynTP\SynTPEnh.exe
c:\program files\Synaptics\SynTP\SynToshiba.exe
c:\users\JonEJet\AppData\Local\MediaFire Express\mf_daemon.exe
c:\users\JonEJet\AppData\Local\MediaFire Express\mf_status.exe
c:\users\JonEJet\AppData\Local\MediaFire Express\mf_services.exe
.
**************************************************************************
.
Completion time: 2012-06-15 22:20:02 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-16 02:19
ComboFix2.txt 2012-06-15 19:20
.
Pre-Run: 65,528,909,824 bytes free
Post-Run: 65,221,079,040 bytes free
.
- - End Of File - - 6AC8B579407FAAAFFAC700494BBB44B0

This friggin' thing is absolutely nuts

Still redirecting http://8.26.70.252/see/display.php?q=bart+scott&affsub=46938-97510&subid=e10

Found the tripwire. Let's see a little bit more action and catch your machine at ALL ANGLES...Honestly, it should not be this hard to remove this thing. Others have removed it with ease.


Please download aswMBR from here

• Save aswMBR.exe to your Desktop
  
• Double click aswMBR.exe to run it
  
• Click the Scan button to start the scan as illustrated below
  

Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives

• Once the scan finishes click Save log to save the log to your Desktop
  
  
  
• Copy and paste the contents of aswMBR.txt back here for review
  

Please download the latest version of Kaspersky GetSystemInfo (GSI) from Kaspersky and save it to your Desktop.

Note: please close all other applications running on your system.

Double click GetSystemInfo.exe to open it. It will display an agreement. Click on I Agree to continue.

Click the Settings button.



Set the slider to Maximum.



IMPORTANT! Then, click Customize - choose Driver / Ports tab and uncheck Scan Ports.




On the General tab, make sure all of the boxes are checked.




On the Misc tab, make sure all the checkboxes are checked.

Then, click OK on the windows that you launched.



Click Create Report to run it.


It will begin scanning.

It will create a zip folder called GetSystemInfo_XXXXXXXXXXXXXX.zip on your Desktop.

It should automatically upload it to http://www.getsysteminfo.com. If it does not, then please submit it manually by going to the site and doing the upload process.

It will redirect to a page, where it will provide a sharing URL for specialists. Copy and paste the url of the GSI Parser report in your next reply.


Please run Panda ActiveScan online scan.

• Choose Quick Scan then click the big green Scan now button
  
• If it wants to install an ActiveX component allow it
  
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  
• Once the scan is completed, please hit the notepad icon next to the text Export to:
  
• Save it to a convenient location such as your Desktop
  
• Post the contents of the ActiveScan.txt in your next reply

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-16 10:39:32
-----------------------------
10:39:32.520 OS Version: Windows 6.0.6001 Service Pack 1
10:39:32.520 Number of processors: 2 586 0xF0D
10:39:32.522 ComputerName: JONEJET-PC UserName: JonEJet
10:39:37.676 Initialize success
10:39:37.848 AVAST engine defs: 12061600
10:39:40.500 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4
10:39:40.500 Disk 0 Vendor: TOSHIBA_MK1246GSX LB213M Size: 114473MB BusType: 3
10:39:40.531 Disk 0 MBR read successfully
10:39:40.531 Disk 0 MBR scan
10:39:40.547 Disk 0 Windows VISTA default MBR code
10:39:40.562 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 1500 MB offset 2048
10:39:40.593 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 112969 MB offset 3074048
10:39:40.593 Disk 0 scanning sectors +234434560
10:39:40.734 Disk 0 scanning C:\Windows\system32\drivers
10:40:08.181 Service scanning
10:41:36.165 Modules scanning
10:42:09.689 Disk 0 trace - called modules:
10:42:09.845 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll PCIIDEX.SYS msahci.sys
10:42:10.360 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85662ac8]
10:42:10.360 3 CLASSPNP.SYS[82b0b745] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-4[0x84e8cab0]
10:42:13.464 AVAST engine scan C:\Windows
10:42:21.919 AVAST engine scan C:\Windows\system32
10:52:14.985 AVAST engine scan C:\Windows\system32\drivers
10:52:43.002 AVAST engine scan C:\Users\JonEJet
10:55:06.351 AVAST engine scan C:\ProgramData
10:56:33.586 Scan finished successfully
11:00:03.078 Disk 0 MBR has been saved successfully to "C:\Users\JonEJet\Desktop\MBR.dat"
11:00:03.094 The log file has been saved successfully to "C:\Users\JonEJet\Desktop\aswMBR.txt"




http://www.getsysteminfo.com/read.php?file=7df54e93c9f25e439d127233538d1e42