 Really Slow/Not responding often, Don't know what's wrong... |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Want a New HP LaserJet MFP? Trade in your old printer and receive $1,000 in savings!
Trade in your old printer and receive up to $1,000 in saving on a new HP LaserJet Multifunction Printer. Click here for savings!
Forum Guidelines
Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.
Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help DO NOT RUN ComboFix unless requested to. Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Jan 9 2010, 06:46 PM
Post
#1
|
|
|
Member  Group: Members Posts: 32 Joined: 8-November 08 Member No.: 254,096  |
I attached all the requested files, except for the RootRepeal because it it wouldn't finish the scan without coming up with an unknown error. Thank you so much in advance for helping to fix this laptop, I really appreciate all efforts. DDS (Ver_09-12-01.01) - NTFSx86 Run by Zac at 17:10:21.70 on Sat 01/09/2010 Internet Explorer: 8.0.6001.18865 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2045.819 [GMT -5:00] AV: VirusScan Enterprise + AntiSpyware Enterprise *On-access scanning enabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} SP: VirusScan Enterprise + AntiSpyware Enterprise *enabled* (Updated) {24E45799-D058-4314-AC5D-1B2EE5C3151F} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\rundll32.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\WLTRYSVC.EXE C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\WLANExt.exe C:\Windows\system32\aestsrv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\svchost.exe -k hpdevmgmt C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe C:\Windows\Explorer.EXE C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\taskeng.exe C:\Program Files\McAfee\Common Framework\naPrdMgr.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\SafeConnect\scManager.sys C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\Windows\system32\STacSV.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Windows\System32\WLTRAY.EXE C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\OEM02Mon.exe C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\SafeConnect\scClient.exe C:\Windows\System32\bcmwltry.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\Macromed\Flash\FlashUtil10d.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\notepad.exe C:\Users\Zac\Desktop\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ mDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=3070724 uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll uURLSearchHooks: H - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~3.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" -"http://www.colby.edu/chemistry/OChem/DEMOS/Substitution.html" mRun: [<NO NAME>] mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [NVHotkey] rundll32.exe c:\windows\system32\nvHotkey.dll,Start mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter mRun: [OEM02Mon.exe] c:\windows\OEM02Mon.exe mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\windows\installer\{7f0c4457-8e64-491b-8d7b-991504365d1e}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\safeco~1.lnk - c:\program files\safeconnect\scClient.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab mASetup: {582610B8-E496-4813-993C-4B027173FE38} - c:\program files\pixiepack codec pack\InstallerHelper.exe Hosts: 127.0.0.1 www.spywareinfo.com ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-7-15 327688] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-7-15 108552] R1 mferkdk;VSCore mferkdk;c:\program files\mcafee\virusscan enterprise\mferkdk.sys [2009-1-27 31848] R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2008-10-15 73728] R3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2009-8-24 73512] R3 mfebopk;McAfee Inc.;c:\windows\system32\drivers\mfebopk.sys [2009-8-24 34152] R3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2009-8-24 177864] S1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-7-15 27784] S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-9-11 21504] S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-7-15 298776] =============== Created Last 30 ================ 2010-01-08 23:34:45 0 d-----w- C:\VivoxLogs 2009-12-29 18:54:33 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-12-29 17:43:54 0 d-----w- c:\programdata\CCP 2009-12-29 17:43:54 0 d-----w- c:\program files\CCP 2009-12-27 03:21:21 0 d-----w- c:\program files\CCleaner 2009-12-25 18:52:32 15360 ----a-w- c:\windows\system32\drivers\NTIDrvr.sys 2009-12-25 18:52:30 14336 ----a-w- c:\windows\system32\drivers\UBHelper.sys 2009-12-25 18:51:13 0 d-----w- c:\windows\system32\drivers\nti 2009-12-25 18:51:13 0 d-----w- c:\program files\NewTech Infosystems ==================== Find3M ==================== 2010-01-09 21:30:18 62985 ----a-w- c:\programdata\nvModes.dat 2010-01-07 21:07:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-07 21:07:04 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-21 06:40:20 916480 ----a-w- c:\windows\system32\wininet.dll 2009-11-21 06:34:39 71680 ----a-w- c:\windows\system32\iesetup.dll 2009-11-21 06:34:39 109056 ----a-w- c:\windows\system32\iesysprep.dll 2009-11-21 04:59:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-11-17 17:24:38 665600 ----a-w- c:\windows\inf\drvindex.dat 2009-11-17 17:24:38 51200 ----a-w- c:\windows\inf\infpub.dat 2009-11-17 17:24:36 143360 ----a-w- c:\windows\inf\infstor.dat 2009-11-17 17:24:35 143360 ----a-w- c:\windows\inf\infstrng.dat 2009-11-17 17:24:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf 2009-11-17 17:23:26 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf 2009-11-09 12:31:42 24064 ----a-w- c:\windows\system32\nshhttp.dll 2009-11-09 12:30:03 30720 ----a-w- c:\windows\system32\httpapi.dll 2009-11-08 06:22:54 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll 2009-11-03 01:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe 2009-10-29 09:17:42 2048 ----a-w- c:\windows\system32\tzres.dll 2008-09-14 01:44:55 174 --sha-w- c:\program files\desktop.ini 2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat 2009-10-04 19:04:03 16384 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat 2009-10-04 19:04:03 32768 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2009-10-04 19:04:03 16384 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat 2007-07-24 21:51:05 8192 --sha-w- c:\windows\users\default\NTUSER.DAT ============= FINISH: 17:12:29.57 ===============
Attached File(s)
|
 |
 
|
|
Jan 15 2010, 05:45 PM
Post
#2
|
|
 bleepin' _temp_ Group: Malware Response Instructor Posts: 14,927 Joined: 25-January 08 From: At home Member No.: 186,120 |
Hello and welcome to Bleeping Computer
We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. Please include a clear description of the problems you're having, along with any steps you may have performed so far. Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process. Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.
In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. I suggest you do this and select Immediate E-Mail notification and click on Proceed. This way you will be advised when we respond to your topic and facilitate the cleaning of your machine. After 5 days if a topic is not replied to we assume it has been abandoned and it is closed. regards myrti --------------------  Help request via PM will be ignored, unless I am already helping you. Please use the forums! If I have helped you please consider to  to help me continue the malware fight! Thank you! |
|
|
|
icon on your desktop.
button.|
Jan 18 2010, 02:41 PM
Post
#3
|
|
|
Member Group: Members Posts: 32 Joined: 8-November 08 Member No.: 254,096 |
The problem is not yet resolved, but it appears to come and go randomly. Sorry for being vague, but the best description I can provide is that my computer has generally slowed down compared to the way it was. For instance, it will take a really long time to load any program, sometimes providing the "Not Responding" response in the title bar of the program window. Upon waking my computer up from sleep mode, the screen will stay black for a few minutes, which never used to happen, and from time to time it seems as though the computer will get so overwhelmed by just a few programs being open, that windows explorer starts to "Not respond", meaning I cannot really do anything until it refreshes itself. I'm just wondering if I have too many programs running at the same time, or if there is some sort of virus/malware infection, or something else along those lines that is causing my comp to run slowly which is fixable.
Here are the scan logs you requested: OTL logfile created on: 1/18/2010 2:14:58 PM - Run 1 OTL by OldTimer - Version 3.1.25.2 Folder = C:\Users\Zac\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18865) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 44.00% Memory free 4.00 Gb Paging File | 2.00 Gb Available in Paging File | 57.00% Paging File free Paging file location(s): c:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 136.45 Gb Total Space | 65.60 Gb Free Space | 48.08% Space Free | Partition Type: NTFS Drive D: | 10.00 Gb Total Space | 5.53 Gb Free Space | 55.34% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: LAPTOP Current User Name: Zac Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2010/01/18 14:13:40 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Users\Zac\Desktop\OTL.exe PRC - [2010/01/05 07:56:02 | 02,002,160 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe PRC - [2009/11/21 01:42:38 | 00,638,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe PRC - [2009/10/27 22:31:14 | 00,257,440 | R--- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil10d.exe PRC - [2009/10/18 16:11:37 | 00,297,240 | ---- | M] (Impulse Point, LLC) -- C:\Program Files\SafeConnect\SCClient.exe PRC - [2009/10/18 16:11:36 | 00,128,280 | ---- | M] (Impulse Point, LLC) -- C:\Program Files\SafeConnect\scManager.sys PRC - [2009/10/11 04:17:36 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2009/04/11 01:27:36 | 02,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009/03/05 16:07:20 | 02,260,480 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe PRC - [2009/01/27 19:50:00 | 00,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe PRC - [2009/01/27 19:50:00 | 00,054,608 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe PRC - [2009/01/27 19:50:00 | 00,013,648 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\scan32.exe PRC - [2008/08/13 17:32:40 | 00,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe PRC - [2008/08/13 17:32:40 | 00,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe PRC - [2008/06/09 07:23:00 | 00,196,608 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvvsvc.exe PRC - [2007/12/08 13:34:40 | 03,444,736 | ---- | M] (Dell Inc.) -- C:\Windows\System32\WLTRAY.EXE PRC - [2007/12/08 13:34:40 | 00,024,064 | ---- | M] () -- C:\Windows\System32\WLTRYSVC.EXE PRC - [2007/12/08 13:34:10 | 02,506,752 | ---- | M] (Dell Inc.) -- C:\Windows\System32\BCMWLTRY.EXE PRC - [2007/09/20 13:31:10 | 00,073,728 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEstSrv.exe PRC - [2007/09/13 13:45:38 | 00,102,400 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\stacsv.exe PRC - [2007/09/13 13:44:48 | 00,405,504 | ---- | M] (IDT, Inc.) -- C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe PRC - [2007/06/07 11:27:56 | 00,020,480 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files\Creative Live! Cam\VideoFX\StartFX.exe PRC - [2007/05/09 17:01:00 | 00,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM02Mon.exe PRC - [2007/04/27 19:35:28 | 00,857,648 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe PRC - [2007/02/20 13:01:12 | 01,125,088 | ---- | M] (Dell Inc) -- C:\Program Files\Dell\QuickSet\quickset.exe PRC - [2006/12/19 10:27:54 | 00,136,768 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\naPrdMgr.exe PRC - [2006/12/19 10:24:50 | 00,104,000 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe PRC - [2006/11/03 18:02:14 | 00,050,688 | ---- | M] (Avanquest Software ) -- C:\Program Files\Digital Line Detect\DLG.exe PRC - [2006/10/03 11:37:04 | 00,081,920 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe PRC - [2006/08/04 19:39:20 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\XAudio.exe PRC - [2006/02/28 11:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe ========== Modules (SafeList) ========== MOD - [2010/01/18 14:13:40 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Users\Zac\Desktop\OTL.exe MOD - [2009/04/11 01:21:38 | 01,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - [2009/10/18 16:11:36 | 00,128,280 | ---- | M] (Impulse Point, LLC) [Auto | Running] -- C:\Program Files\SafeConnect\scManager.sys -- (SCManager) SRV - [2009/09/24 20:27:04 | 00,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache) SRV - [2009/07/15 13:31:44 | 00,298,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Disabled | Stopped] -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd) SRV - [2009/05/08 18:20:34 | 00,045,312 | ---- | M] (NewTech Infosystems, Inc.) [Disabled | Stopped] -- C:\Program Files\NewTech Infosystems\Backup Now EZ\BackupNowEZSvr.exe -- (NTI BackupNowEZSvr) SRV - [2009/01/27 19:50:00 | 00,144,704 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe -- (McShield) SRV - [2009/01/27 19:50:00 | 00,054,608 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe -- (McTaskManager) SRV - [2008/11/04 00:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2008/08/13 17:32:40 | 00,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) SRV - [2008/06/09 07:23:00 | 00,196,608 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Windows\System32\nvvsvc.exe -- (nvsvc) SRV - [2008/01/19 02:38:24 | 00,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008/01/13 17:24:00 | 00,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service) SRV - [2007/12/08 13:34:40 | 00,024,064 | ---- | M] () [Auto | Running] -- C:\Windows\System32\WLTRYSVC.EXE -- (wltrysvc) SRV - [2007/10/22 10:31:33 | 00,138,168 | ---- | M] (Google) [Disabled | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc) SRV - [2007/09/26 13:41:56 | 00,503,608 | ---- | M] (Apple Inc.) [Disabled | Stopped] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service) SRV - [2007/09/20 13:31:10 | 00,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEstSrv.exe -- (AESTFilters) SRV - [2007/09/13 13:45:38 | 00,102,400 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\stacsv.exe -- (STacSV) SRV - [2007/06/04 22:14:50 | 00,217,088 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08) SRV - [2007/06/04 22:14:50 | 00,131,072 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc) SRV - [2007/03/19 12:44:44 | 00,070,656 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService) SRV - [2006/12/19 10:24:50 | 00,104,000 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework) SRV - [2006/11/08 15:35:38 | 00,053,248 | ---- | M] (Hewlett-Packard) [Auto | Stopped] -- C:\Windows\System32\HPZipm12.dll -- (Pml Driver HPZ12) SRV - [2006/11/08 15:35:36 | 00,043,520 | ---- | M] (Hewlett-Packard) [Auto | Stopped] -- C:\Windows\System32\HPZinw12.dll -- (Net Driver HPZ12) SRV - [2006/11/05 11:15:12 | 00,880,640 | ---- | M] (Sonic Solutions) [Disabled | Stopped] -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe -- (RoxMediaDB9) SRV - [2006/11/05 11:13:00 | 00,159,744 | ---- | M] (Sonic Solutions) [Disabled | Stopped] -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe -- (RoxWatch9) SRV - [2006/11/02 07:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\ehome\ehstart.dll -- (ehstart) SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2006/09/14 14:54:34 | 00,073,728 | ---- | M] (MicroVision Development, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- (stllssvr) SRV - [2006/08/04 19:39:20 | 00,386,560 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\drivers\XAudio.exe -- (XAudioService) SRV - [2006/02/28 11:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service) SRV - [2005/04/03 23:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) ========== Driver Services (SafeList) ========== DRV - [2010/01/05 07:56:06 | 00,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Running] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM) DRV - [2010/01/05 07:56:04 | 00,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV) DRV - [2010/01/05 07:56:02 | 00,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2009/07/15 13:32:26 | 00,327,688 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\Drivers\avgldx86.sys -- (AvgLdx86) DRV - [2009/07/15 13:32:21 | 00,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Stopped] -- C:\Windows\System32\Drivers\avgmfx86.sys -- (AvgMfx86) DRV - [2009/07/15 13:31:55 | 00,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\Drivers\avgtdix.sys -- (AvgTdiX) DRV - [2009/05/05 16:46:08 | 00,015,360 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NTIDrvr.sys -- (NTIDrvr) DRV - [2009/05/05 16:46:08 | 00,014,336 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UBHelper.sys -- (UBHelper) DRV - [2009/01/27 19:50:00 | 00,177,864 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk) DRV - [2009/01/27 19:50:00 | 00,073,512 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk) DRV - [2009/01/27 19:50:00 | 00,065,000 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeapfk.sys -- (mfeapfk) DRV - [2009/01/27 19:50:00 | 00,052,168 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\system32\drivers\mfetdik.sys -- (mfetdik) DRV - [2009/01/27 19:50:00 | 00,031,848 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys -- (mferkdk) DRV - [2008/06/09 07:23:00 | 07,522,624 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2007/12/06 20:52:48 | 01,044,984 | ---- | M] (Broadcom Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX) DRV - [2007/10/10 17:03:00 | 00,235,648 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Dev.sys -- (OEM02Dev) DRV - [2007/09/13 13:46:06 | 00,330,240 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA) DRV - [2007/07/24 16:47:30 | 00,020,152 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide) DRV - [2007/07/24 16:47:30 | 00,019,128 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide) DRV - [2007/07/24 16:47:30 | 00,017,592 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide) DRV - [2007/06/15 12:25:46 | 00,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5) DRV - [2007/04/27 19:35:56 | 00,182,456 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP) DRV - [2007/03/05 21:45:00 | 00,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Vfx.sys -- (OEM02Vfx) DRV - [2007/02/25 12:10:48 | 00,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\dsunidrv.sys -- (dsunidrv) DRV - [2007/02/12 16:36:54 | 00,277,784 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\iastor.sys -- (iaStor) DRV - [2007/02/09 14:34:16 | 00,051,768 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\drivers\drvnddm.sys -- (DRVNDDM) DRV - [2007/02/08 22:05:30 | 00,012,856 | ---- | M] (Roxio) [File_System | System | Running] -- C:\Windows\System32\drivers\DLACDBHM.SYS -- (DLACDBHM) DRV - [2006/11/30 07:50:00 | 00,034,152 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfebopk.sys -- (mfebopk) DRV - [2006/11/27 02:48:46 | 00,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2006/11/27 02:48:44 | 00,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2006/11/27 02:48:44 | 00,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2006/11/02 21:43:30 | 00,986,624 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV) DRV - [2006/11/02 21:42:18 | 00,206,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL) DRV - [2006/11/02 21:42:08 | 00,659,968 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf) DRV - [2006/11/02 04:51:45 | 00,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300) DRV - [2006/11/02 04:51:38 | 00,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx) DRV - [2006/11/02 04:51:34 | 00,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor) DRV - [2006/11/02 04:51:32 | 00,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci) DRV - [2006/11/02 04:51:25 | 00,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci) DRV - [2006/11/02 04:51:25 | 00,232,040 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV) DRV - [2006/11/02 04:51:00 | 00,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320) DRV - [2006/11/02 04:50:45 | 00,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2) DRV - [2006/11/02 04:50:41 | 00,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid) DRV - [2006/11/02 04:50:35 | 00,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx) DRV - [2006/11/02 04:50:35 | 00,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata) DRV - [2006/11/02 04:50:35 | 00,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m) DRV - [2006/11/02 04:50:24 | 00,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) DRV - [2006/11/02 04:50:19 | 00,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960) DRV - [2006/11/02 04:50:17 | 00,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp) DRV - [2006/11/02 04:50:16 | 00,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4) DRV - [2006/11/02 04:50:13 | 00,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor) DRV - [2006/11/02 04:50:11 | 00,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx) DRV - [2006/11/02 04:50:10 | 00,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas) DRV - [2006/11/02 04:50:10 | 00,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI) DRV - [2006/11/02 04:50:10 | 00,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2) DRV - [2006/11/02 04:50:10 | 00,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs) DRV - [2006/11/02 04:50:09 | 00,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc) DRV - [2006/11/02 04:50:09 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid) DRV - [2006/11/02 04:50:07 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi) DRV - [2006/11/02 04:50:05 | 00,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS) DRV - [2006/11/02 04:50:05 | 00,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx) DRV - [2006/11/02 04:50:04 | 00,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC) DRV - [2006/11/02 04:50:03 | 00,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3) DRV - [2006/11/02 04:49:59 | 00,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x) DRV - [2006/11/02 04:49:56 | 00,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi) DRV - [2006/11/02 04:49:53 | 00,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas) DRV - [2006/11/02 03:25:24 | 00,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2006/11/02 03:24:47 | 00,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer) DRV - [2006/11/02 03:24:46 | 00,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp) DRV - [2006/11/02 03:24:45 | 00,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo) DRV - [2006/11/02 03:24:44 | 00,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm) DRV - [2006/11/02 03:24:44 | 00,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm) DRV - [2006/11/02 02:36:50 | 00,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi) DRV - [2006/11/02 02:36:43 | 02,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300) DRV - [2006/11/02 02:30:55 | 00,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel® DRV - [2006/11/02 02:30:54 | 00,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel® DRV - [2006/11/02 02:30:53 | 00,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp) DRV - [2006/11/02 01:37:21 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\secdrv.sys -- (secdrv) DRV - [2006/10/18 02:00:00 | 00,036,624 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\PxHelp20.sys -- (PxHelp20) DRV - [2006/10/05 17:07:28 | 00,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct) DRV - [2006/09/19 13:44:04 | 00,015,664 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2006/08/18 12:18:08 | 00,009,400 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLADResM.SYS -- (DLADResM) DRV - [2006/08/18 12:17:46 | 00,035,096 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLABMFSM.SYS -- (DLABMFSM) DRV - [2006/08/18 12:17:44 | 00,097,848 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLAUDF_M.SYS -- (DLAUDF_M) DRV - [2006/08/18 12:17:44 | 00,094,648 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLAUDFAM.SYS -- (DLAUDFAM) DRV - [2006/08/18 12:17:42 | 00,026,008 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLAOPIOM.SYS -- (DLAOPIOM) DRV - [2006/08/18 12:17:40 | 00,032,472 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLABOIOM.SYS -- (DLABOIOM) DRV - [2006/08/18 12:17:38 | 00,104,472 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLAIFS_M.SYS -- (DLAIFS_M) DRV - [2006/08/18 12:17:38 | 00,014,520 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLAPoolM.SYS -- (DLAPoolM) DRV - [2006/08/11 09:35:16 | 00,028,184 | ---- | M] (Roxio) [File_System | System | Running] -- C:\Windows\System32\drivers\DLARTL_M.SYS -- (DLARTL_M) DRV - [2006/08/04 19:39:10 | 00,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio) DRV - [2006/07/21 10:21:26 | 00,099,176 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\DRVMCDB.SYS -- (DRVMCDB) DRV - [2006/06/19 16:26:58 | 00,012,672 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\mdmxsdk.sys -- (mdmxsdk) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cl...amp;ibd=3070724 IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2241642629-384779116-2283715535-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ IE - HKU\S-1-5-21-2241642629-384779116-2283715535-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-2241642629-384779116-2283715535-1000\..\URLSearchHook: *CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found IE - HKU\S-1-5-21-2241642629-384779116-2283715535-1000\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () IE - HKU\S-1-5-21-2241642629-384779116-2283715535-1000\S-1-5-21-2241642629-384779116-2283715535-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [2009/03/15 18:31:38 | 00,000,000 | ---D | M] -- C:\Users\Zac\AppData\Roaming\Mozilla\Extensions [2009/03/15 18:31:38 | 00,000,000 | ---D | M] -- C:\Users\Zac\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org O1 HOSTS File: ([2010/01/08 22:52:41 | 00,371,781 | R--- | M]) - C:\Windows\System32\drivers\etc\HOSTS O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 12818 more lines... O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found. O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O3 - HKU\S-1-5-21-2241642629-384779116-2283715535-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKU\S-1-5-21-2241642629-384779116-2283715535-1000\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found. O3 - HKU\S-1-5-21-2241642629-384779116-2283715535-1000\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Windows\System32\WLTRAY.EXE (Dell Inc.) O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-2241642629-384779116-2283715535-1000..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - HKU\S-1-5-21-2241642629-384779116-2283715535-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - HKU\S-1-5-21-2241642629-384779116-2283715535-1000..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -Mozilla\4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident\4.0; File not found O7 - HKU\S-1-5-21-2241642629-384779116-2283715535-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O13 - gopher Prefix: O15 - HKLM\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\.DEFAULT\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\S-1-5-18\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\S-1-5-21-2241642629-384779116-2283715535-1000\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 158.65.8.11 158.65.3.66 O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com) O24 - Desktop WallPaper: C:\Users\Zac\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg O24 - Desktop BackupWallPaper: C:\Users\Zac\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 16:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{8466f72a-ef39-11de-b78d-001c23ab7700}\Shell\AutoRun\command - "" = G:\restore\restorestarter.exe -- File not found O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\restore\restorestarter.exe -- File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/01/18 14:13:25 | 00,547,328 | ---- | C] (OldTimer Tools) -- C:\Users\Zac\Desktop\OTL.exe [2010/01/12 21:59:33 | 00,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll [2010/01/12 21:59:32 | 00,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll [2010/01/12 16:09:45 | 00,000,000 | ---D | C] -- C:\Users\Zac\Documents\Canon Utilities [2010/01/12 16:00:50 | 00,000,000 | ---D | C] -- C:\Users\Zac\Desktop\Pics for mom [2010/01/09 17:18:26 | 00,000,000 | ---D | C] -- C:\Program Files\WinZip [2010/01/08 18:34:45 | 00,000,000 | ---D | C] -- C:\VivoxLogs [2010/01/08 18:21:02 | 18,848,592 | ---- | C] (Lime Wire LLC) -- C:\Users\Zac\Desktop\LimeWireWin.exe [2009/12/29 14:38:30 | 00,000,000 | ---D | C] -- C:\Users\Zac\Documents\EVE [2009/12/29 14:38:13 | 00,000,000 | ---D | C] -- C:\Users\Zac\AppData\Local\CCP [2009/12/29 13:54:33 | 04,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_41.dll [2009/12/29 12:43:54 | 00,000,000 | ---D | C] -- C:\ProgramData\CCP [2009/12/29 12:43:54 | 00,000,000 | ---D | C] -- C:\Program Files\CCP [2009/12/26 22:21:21 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner [2009/12/26 22:15:48 | 03,357,024 | ---- | C] (Piriform Ltd) -- C:\Users\Zac\Documents\ccsetup227.exe [2009/12/25 13:52:32 | 00,015,360 | ---- | C] (NewTech Infosystems, Inc.) -- C:\Windows\System32\drivers\NTIDrvr.sys [2009/12/25 13:52:30 | 00,014,336 | ---- | C] (NewTech Infosystems Corporation) -- C:\Windows\System32\drivers\UBHelper.sys [2009/12/25 13:51:37 | 00,000,000 | ---D | C] -- C:\Windows\System32\drivers\nti\Xp_x86 [2009/12/25 13:51:37 | 00,000,000 | ---D | C] -- C:\Windows\System32\drivers\nti\w2k_x86 [2009/12/25 13:51:36 | 00,000,000 | ---D | C] -- C:\Windows\System32\drivers\nti\Vista_x86 [2009/12/25 13:51:36 | 00,000,000 | ---D | C] -- C:\Windows\System32\drivers\nti\Vista_ia64 [2009/12/25 13:51:36 | 00,000,000 | ---D | C] -- C:\Windows\System32\drivers\nti\Vista_amd64 [2009/12/25 13:51:36 | 00,000,000 | ---D | C] -- C:\Windows\System32\drivers\nti\2003_x86 [2009/12/25 13:51:36 | 00,000,000 | ---D | C] -- C:\Windows\System32\drivers\nti\2003_ia64 [2009/12/25 13:51:36 | 00,000,000 | ---D | C] -- C:\Windows\System32\drivers\nti\2003_amd64 [2009/12/25 13:51:13 | 00,000,000 | ---D | C] -- C:\Windows\System32\drivers\nti [2009/12/25 13:51:13 | 00,000,000 | ---D | C] -- C:\Program Files\NewTech Infosystems [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010/01/18 14:19:54 | 08,126,464 | -HS- | M] () -- C:\Users\Zac\ntuser.dat [2010/01/18 14:13:40 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Users\Zac\Desktop\OTL.exe [2010/01/18 13:21:26 | 00,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{E6C41B86-B69F-4B9B-A559-A4FF72E6A5F9}.job [2010/01/18 13:20:35 | 00,062,985 | ---- | M] () -- C:\ProgramData\nvModes.001 [2010/01/18 13:20:30 | 00,062,985 | ---- | M] () -- C:\ProgramData\nvModes.dat [2010/01/18 13:19:13 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010/01/18 01:31:33 | 00,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010/01/18 01:31:33 | 00,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010/01/17 18:27:22 | 00,012,889 | ---- | M] () -- C:\Users\Zac\Desktop\Workout Schedule.xlsx [2010/01/17 15:39:28 | 00,703,448 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010/01/17 15:39:28 | 00,604,012 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010/01/17 15:39:28 | 00,105,040 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010/01/14 13:39:37 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010/01/14 13:39:28 | 21,454,31552 | -HS- | M] () -- C:\hiberfil.sys [2010/01/14 11:12:06 | 00,181,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2010/01/14 03:09:04 | 00,524,288 | -HS- | M] () -- C:\Users\Zac\ntuser.dat{f0b7a23a-b96c-11dc-acd3-0019b9841f84}.TMContainer00000000000000000001.regtrans-ms [2010/01/14 03:09:04 | 00,065,536 | -HS- | M] () -- C:\Users\Zac\ntuser.dat{f0b7a23a-b96c-11dc-acd3-0019b9841f84}.TM.blf [2010/01/14 03:08:05 | 02,183,971 | -H-- | M] () -- C:\Users\Zac\AppData\Local\IconCache.db [2010/01/14 03:06:41 | 00,001,849 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2010/01/12 21:55:05 | 00,000,864 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2010/01/12 21:50:40 | 07,520,288 | ---- | M] () -- C:\Users\Zac\Desktop\SUPERAntiSpyware.exe [2010/01/12 16:08:00 | 00,115,200 | ---- | M] () -- C:\Users\Zac\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/01/11 01:46:11 | 00,018,526 | ---- | M] () -- C:\Users\Zac\Documents\Resume.docx [2010/01/09 17:19:39 | 00,001,816 | ---- | M] () -- C:\Users\Public\Desktop\WinZip.lnk [2010/01/09 17:19:39 | 00,001,750 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk [2010/01/09 17:03:00 | 00,000,393 | ---- | M] () -- C:\Users\Zac\Desktop\Log In.url [2010/01/09 13:19:44 | 00,010,530 | ---- | M] () -- C:\Users\Zac\Documents\Its been a few years but I.docx [2010/01/09 12:46:36 | 00,000,180 | ---- | M] () -- C:\Users\Zac\Desktop\Facebook.url [2010/01/08 22:52:41 | 00,371,781 | R--- | M] () -- C:\Windows\System32\drivers\etc\HOSTS [2010/01/08 22:17:48 | 00,001,662 | ---- | M] () -- C:\Users\Zac\Desktop\LimeWire 5.4.6.lnk [2010/01/08 20:30:53 | 00,003,716 | ---- | M] () -- C:\Users\Zac\Documents\cc_20100108_203036.reg [2010/01/08 18:21:03 | 18,848,592 | ---- | M] (Lime Wire LLC) -- C:\Users\Zac\Desktop\LimeWireWin.exe [2010/01/08 15:28:08 | 00,001,760 | ---- | M] () -- C:\Users\Zac\Desktop\Runes of Magic.lnk [2010/01/07 16:07:14 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010/01/07 16:07:04 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2009/12/29 13:52:55 | 00,001,672 | ---- | M] () -- C:\Users\Zac\Desktop\EVE.lnk [2009/12/28 20:53:13 | 00,012,364 | ---- | M] () -- C:\Users\Zac\Documents\s.docx [2009/12/26 22:31:40 | 00,435,186 | ---- | M] () -- C:\Users\Zac\Documents\cc_20091226_223113.reg [2009/12/26 22:21:24 | 00,001,632 | ---- | M] () -- C:\Users\Zac\Desktop\CCleaner.lnk [2009/12/26 22:16:24 | 03,357,024 | ---- | M] (Piriform Ltd) -- C:\Users\Zac\Documents\ccsetup227.exe [2009/12/25 13:51:37 | 00,002,030 | ---- | M] () -- C:\Users\Public\Desktop\Backup Now EZ.lnk [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2010/01/14 03:06:41 | 00,001,849 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2010/01/12 21:55:05 | 00,000,864 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2010/01/12 21:50:05 | 07,520,288 | ---- | C] () -- C:\Users\Zac\Desktop\SUPERAntiSpyware.exe [2010/01/09 17:19:39 | 00,001,816 | ---- | C] () -- C:\Users\Public\Desktop\WinZip.lnk [2010/01/09 17:19:39 | 00,001,750 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk [2010/01/09 13:19:42 | 00,010,530 | ---- | C] () -- C:\Users\Zac\Documents\Its been a few years but I.docx [2010/01/08 22:17:48 | 00,001,662 | ---- | C] () -- C:\Users\Zac\Desktop\LimeWire 5.4.6.lnk [2010/01/08 20:30:49 | 00,003,716 | ---- | C] () -- C:\Users\Zac\Documents\cc_20100108_203036.reg [2010/01/07 20:26:09 | 00,012,889 | ---- | C] () -- C:\Users\Zac\Desktop\Workout Schedule.xlsx [2009/12/29 13:52:55 | 00,001,672 | ---- | C] () -- C:\Users\Zac\Desktop\EVE.lnk [2009/12/28 20:53:12 | 00,012,364 | ---- | C] () -- C:\Users\Zac\Documents\s.docx [2009/12/26 22:31:16 | 00,435,186 | ---- | C] () -- C:\Users\Zac\Documents\cc_20091226_223113.reg [2009/12/26 22:21:24 | 00,001,632 | ---- | C] () -- C:\Users\Zac\Desktop\CCleaner.lnk [2009/12/25 13:51:37 | 00,002,030 | ---- | C] () -- C:\Users\Public\Desktop\Backup Now EZ.lnk [2009/11/08 01:22:54 | 00,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll [2009/08/24 22:07:13 | 00,000,280 | ---- | C] () -- C:\Windows\System32\epoPGPsdk.dll.sig [2009/08/04 16:45:12 | 00,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009/08/03 14:07:42 | 00,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll [2009/05/18 21:56:24 | 00,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2009/05/10 20:22:50 | 00,000,035 | ---- | C] () -- C:\Users\Zac\AppData\Roaming\TheHunterSettings.cfg [2008/11/18 14:27:01 | 00,000,021 | ---- | C] () -- C:\Windows\atid.ini [2008/11/01 22:21:42 | 00,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest [2008/06/19 23:16:46 | 00,062,985 | ---- | C] () -- C:\ProgramData\nvModes.001 [2008/06/19 23:16:45 | 00,062,985 | ---- | C] () -- C:\ProgramData\nvModes.dat [2008/02/08 23:33:25 | 00,000,000 | ---- | C] () -- C:\Windows\iPlayer.INI [2007/09/29 18:38:27 | 00,000,025 | ---- | C] () -- C:\Windows\SIERRA.INI [2007/09/29 18:37:51 | 00,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll [2007/09/29 18:37:51 | 00,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll [2007/09/29 18:37:51 | 00,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll [2007/09/24 10:46:11 | 00,001,356 | ---- | C] () -- C:\Users\Zac\AppData\Local\d3d9caps.dat [2007/08/26 14:51:59 | 00,011,075 | ---- | C] () -- C:\ProgramData\hpzinstall.log [2007/08/23 18:30:00 | 00,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2007/08/03 03:20:51 | 00,524,288 | -HS- | C] () -- C:\ProgramData\ntuser.dat{a67dc675-4162-11dc-a2d7-0019b9841f84}.TMContainer00000000000000000002.regtrans-ms [2007/08/03 03:20:51 | 00,524,288 | -HS- | C] () -- C:\ProgramData\ntuser.dat{a67dc675-4162-11dc-a2d7-0019b9841f84}.TMContainer00000000000000000001.regtrans-ms [2007/08/03 03:20:51 | 00,524,288 | -HS- | C] () -- C:\ProgramData\ntuser.dat{a67dc666-4162-11dc-a2d7-0019b9841f84}.TMContainer00000000000000000002.regtrans-ms [2007/08/03 03:20:51 | 00,524,288 | -HS- | C] () -- C:\ProgramData\ntuser.dat{a67dc666-4162-11dc-a2d7-0019b9841f84}.TMContainer00000000000000000001.regtrans-ms [2007/08/03 03:20:51 | 00,262,144 | ---- | C] () -- C:\ProgramData\ntuser.dat [2007/08/03 03:20:51 | 00,065,536 | -HS- | C] () -- C:\ProgramData\ntuser.dat{a67dc675-4162-11dc-a2d7-0019b9841f84}.TM.blf [2007/08/03 03:20:51 | 00,065,536 | -HS- | C] () -- C:\ProgramData\ntuser.dat{a67dc666-4162-11dc-a2d7-0019b9841f84}.TM.blf [2007/08/03 03:20:51 | 00,005,120 | -H-- | C] () -- C:\ProgramData\ntuser.dat.LOG1 [2007/08/03 03:20:51 | 00,000,000 | -H-- | C] () -- C:\ProgramData\ntuser.dat.LOG2 [2007/08/02 17:53:36 | 00,056,056 | ---- | C] () -- C:\Windows\System32\DLAAPI_W.DLL [2007/08/02 17:53:33 | 00,000,163 | ---- | C] () -- C:\Windows\wininit.ini [2007/08/02 17:42:52 | 00,041,049 | ---- | C] () -- C:\Users\Zac\AppData\Roaming\nvModes.dat [2007/08/02 17:42:52 | 00,041,049 | ---- | C] () -- C:\Users\Zac\AppData\Roaming\nvModes.001 [2007/08/02 17:19:32 | 00,115,200 | ---- | C] () -- C:\Users\Zac\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007/07/24 16:51:28 | 00,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll [2007/07/24 16:51:19 | 01,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2007/07/24 09:13:00 | 00,054,784 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll [2007/02/20 12:59:08 | 00,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2007/02/20 12:59:06 | 00,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2007/02/20 12:59:06 | 00,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2007/02/20 12:59:06 | 00,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2007/02/20 12:59:06 | 00,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2007/02/20 12:59:06 | 00,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2007/02/20 12:59:06 | 00,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2007/02/20 12:59:06 | 00,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2007/02/20 12:59:04 | 00,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2007/02/20 11:24:46 | 00,071,208 | ---- | C] () -- C:\Windows\System32\PhysXLoader.dll [2006/11/07 14:25:58 | 00,000,000 | ---- | C] () -- C:\Windows\System32\px.ini [2006/11/02 07:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006/11/02 05:25:44 | 00,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2006/11/02 02:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006/09/16 23:36:50 | 00,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll [2006/09/16 23:36:50 | 00,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:5C321E34 @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:E73B14E2 < End of report > Extras OTL Extras logfile created on: 1/18/2010 2:14:58 PM - Run 1 OTL by OldTimer - Version 3.1.25.2 Folder = C:\Users\Zac\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18865) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 44.00% Memory free 4.00 Gb Paging File | 2.00 Gb Available in Paging File | 57.00% Paging File free Paging file location(s): c:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 136.45 Gb Total Space | 65.60 Gb Free Space | 48.08% Space Free | Partition Type: NTFS Drive D: | 10.00 Gb Total Space | 5.53 Gb Free Space | 55.34% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: LAPTOP Current User Name: Zac Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found "VistaSp2" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 "DefaultOutboundAction" = 0 "DefaultInboundAction" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 "DefaultOutboundAction" = 0 "DefaultInboundAction" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 "DefaultOutboundAction" = 0 "DefaultInboundAction" = 1 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe" = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox -- File not found ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{1674AB5F-590E-40F6-8CDE-B226F9BE7706}" = rport=1701 | protocol=17 | dir=out | app=system | "{2D0461FC-959B-4858-BFA4-F38105A4D517}" = lport=rpc | protocol=6 | dir=in | svc=policyagent | app=c:\windows\system32\svchost.exe | "{31C24EF1-34BE-4869-8ACB-7A15D6086E63}" = lport=1723 | protocol=6 | dir=in | app=system | "{42B68C42-11C0-4E14-A428-1D405126B1E4}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | "{4B5CC70B-E557-4579-9717-73DCB3CCD6BB}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe | "{526EFEBC-6A56-41D7-BF39-96AFF4D84C6D}" = rport=1723 | protocol=6 | dir=out | app=system | "{554AA018-2020-4E18-91D3-8C88941856FF}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe | "{66C1E46F-A626-49C2-AB97-1CED0272E2A6}" = lport=80 | protocol=6 | dir=in | app=system | "{76C7D8C5-5C89-4381-B5B9-0DF8F0BEE27D}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe | "{7D55A72A-93D1-4C80-BB1F-456FF1E718CC}" = lport=2869 | protocol=6 | dir=in | app=system | "{810D20A8-C9AA-4868-BD9E-5AC8940E9F9C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | "{8471C5EF-F163-474E-90B3-B667C88A2D28}" = lport=1701 | protocol=17 | dir=in | app=system | "{8B07FCD1-56E1-4A05-9220-A37CF6AFCC78}" = rport=1701 | protocol=17 | dir=out | app=system | "{8C3A933B-1C2F-4C39-90CD-548DDB873DA6}" = rport=1723 | protocol=6 | dir=out | app=system | "{8E42A3EB-51DC-484F-A322-F74285675C70}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe | "{90EAA8A4-2C1E-42F5-B587-7F9DD8A57B75}" = lport=443 | protocol=6 | dir=in | name=hunter | "{AE7D8A3C-9939-494D-8171-101F1DFD5F1F}" = lport=1723 | protocol=6 | dir=in | app=system | "{B2922005-8CEC-4E09-9E1A-515CEAFA4763}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe | "{BF23860C-4D5A-483A-B120-BA692A0C9BCD}" = lport=1701 | protocol=17 | dir=in | app=system | "{C46B8C83-A2AA-41B7-B21B-F213B479C27F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | "{FE4DB0BA-DA2D-44C2-BF5E-73EEC96F9F8B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{06B255F2-0CD3-4774-8FDC-7C84DFDF7F64}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | "{095D40E9-62D3-44A4-BA32-11A2667A136E}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | "{110F4DDC-0D32-4D02-8E83-93DE3C659550}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe | "{14D01B71-F49A-416E-AEBB-1B6238A98B5F}" = protocol=17 | dir=in | app=c:\program files\reality pump\two worlds\twoworlds_radeon.exe | "{190A9A83-1727-4128-8100-6D9F20A63A2D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{1E3569F9-26F9-4F46-8160-42335AD10844}" = dir=in | app=c:\program files\dell\mediadirect\kernel\dmp\clbrowserengine.exe | "{1E644AEC-6B44-4C2C-A218-4DD905FBD69C}" = protocol=17 | dir=in | app=c:\program files\reality pump\two worlds\twoworlds.exe | "{2172D1D7-3722-49C2-A563-50D8F11491DE}" = protocol=6 | dir=out | app=system | "{21A0C163-AC16-46D6-81D2-773AB9C02FA3}" = dir=in | app=c:\program files\dell\mediadirect\kernel\dms\clmsservice.exe | "{2A01D0C5-0BA7-4984-BC3A-C64D1A7C8F31}" = protocol=6 | dir=in | app=c:\program files\yahoo!\yahoo! music jukebox\yahoomusicengine.exe | "{30F4867D-2436-4F6C-965A-893B998B9616}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe | "{3B947B72-9373-4F37-B10A-AD931393D3C0}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe | "{45D4C2A3-F320-48E1-9E2C-669E471AE5D0}" = protocol=17 | dir=in | app=c:\program files\ruckus player\ruckus.exe | "{4B2F6E23-5D15-4256-83F2-EEDA7EBE2980}" = protocol=17 | dir=in | app=c:\program files\yahoo!\yahoo! music jukebox\yahoomusicengine.exe | "{4C2D4E66-F9E3-43CD-8E16-FE1C89DC9B9B}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe | "{4DCBD288-1B1B-4921-BB78-2AFDBA2B3CA0}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe | "{52E56291-9580-4569-879D-A6CF1006F94F}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | "{5AA3B0C0-3C2F-42F0-920E-2390C3386E69}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | "{6433338B-93D5-4812-BA69-56924CAA66C9}" = protocol=6 | dir=out | svc=msiscsi | app=c:\windows\system32\svchost.exe | "{6663D5FE-F297-4360-AFDB-649984C689C6}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe | "{71BF7388-E6EE-434D-AA1D-5AB5FACF6B85}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe | "{95796909-DF24-4B9B-8DEB-F20415B22DB3}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | "{97A27E8B-81E1-44B7-BE1E-458514B9D0DB}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | "{9BC07FF0-D82C-4D81-9E30-A41146309DA8}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | "{9D97C064-9950-474B-A9F9-A3DF90571D56}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | "{A6F809D9-C2D3-420F-97AF-7EF51BC2487D}" = dir=in | app=c:\program files\dell\mediadirect\pcmservice.exe | "{A70F1988-3D04-4BD7-9DD9-B0F90C0A93F0}" = protocol=6 | dir=in | app=c:\program files\ruckus player\ruckus.exe | "{B0CEC4A3-C9DA-4B0E-87C3-6D804BE18B0C}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{BABC0CA1-5915-4D1C-BEB8-6DF26E82D187}" = protocol=6 | dir=in | app=c:\program files\reality pump\two worlds\twoworlds_radeon.exe | "{BD095099-11A2-4EE5-854D-5427819DFBA4}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{C4F4282A-ED2B-433D-B186-5B3AD06E4455}" = protocol=6 | dir=in | svc=msiscsi | app=c:\windows\system32\svchost.exe | "{C8A59694-A8B9-4D5F-9750-5663A24E86C9}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{E30E4848-2620-4CF2-980C-48A01E888DD6}" = protocol=6 | dir=in | app=c:\program files\mcafee\common framework\frameworkservice.exe | "{E39E1242-A1DD-4409-9528-3219C844F6B2}" = protocol=17 | dir=in | app=c:\program files\mcafee\common framework\frameworkservice.exe | "{E8168DAA-A12A-4624-90DE-4A7C0DECA532}" = dir=in | app=c:\program files\dell\mediadirect\powercinema.exe | "{F374CB18-4471-4266-97BA-1B4AFB5FEC92}" = protocol=6 | dir=in | app=c:\program files\reality pump\two worlds\twoworlds.exe | "TCP Query User{2746121E-5D3C-4DAC-9E51-30367F037216}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | "TCP Query User{2F1F6499-7424-437D-B467-DBAB67092689}C:\program files\gametap web player\bin\release\gametapplayer.exe" = protocol=6 | dir=in | app=c:\program files\gametap web player\bin\release\gametapplayer.exe | "TCP Query User{39B057A2-E1DD-43AC-B486-F528AF70AE8E}C:\sierra\empire earth\empire earth.exe" = protocol=6 | dir=in | app=c:\sierra\empire earth\empire earth.exe | "TCP Query User{40E6439D-A91D-42FE-BE4B-22C5F79FA16F}C:\program files\aim6\aim6.exe" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe | "TCP Query User{426B61B7-AFB8-46B3-BCDF-1FEA8982E7CA}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe | "TCP Query User{4B5A66F9-5F41-4630-A877-C4C87C89D776}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | "TCP Query User{4CF4039E-76B4-4C8E-9179-152F64FD5DD7}C:\program files\microsoft games\rise of nations\nations.exe" = protocol=6 | dir=in | app=c:\program files\microsoft games\rise of nations\nations.exe | "TCP Query User{605BDA17-4493-4215-97FB-577772771C67}C:\program files\aim6\aim6.exe" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe | "TCP Query User{6F8E3068-45DF-47DE-8B61-1D4FF2A50294}C:\program files\ccp\eve\bin\exefile.exe" = protocol=6 | dir=in | app=c:\program files\ccp\eve\bin\exefile.exe | "TCP Query User{71D5ACBA-BA94-4F82-A7E5-FA8E9000EC72}C:\sierra\empire earth\empire earth.exe" = protocol=6 | dir=in | app=c:\sierra\empire earth\empire earth.exe | "TCP Query User{7DC69292-3D69-47C9-9193-3DA3365C2080}C:\users\zac\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\zac\program files\dna\btdna.exe | "TCP Query User{825EDDF1-B31F-4032-9151-ADB4C290FEA0}C:\users\zac\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\zac\program files\dna\btdna.exe | "TCP Query User{8798F1CF-39CA-48F6-A217-D5B14E31F29A}E:\bin\ia\core\mdm_util.exe" = protocol=6 | dir=in | app=e:\bin\ia\core\mdm_util.exe | "TCP Query User{A1378E3A-2331-45D1-BD64-40D91D8B1DCA}C:\program files\microsoft games\rise of nations\nations.exe" = protocol=6 | dir=in | app=c:\program files\microsoft games\rise of nations\nations.exe | "TCP Query User{ACBD6C32-3738-4F5D-A6C2-921498C57B15}C:\program files\emote\launcher\launcher.exe" = protocol=6 | dir=in | app=c:\program files\emote\launcher\launcher.exe | "TCP Query User{BDCEA0E5-6AB9-4646-BB31-63C1852B71FB}C:\program files\gametap web player\bin\release\gametapplayer.exe" = protocol=6 | dir=in | app=c:\program files\gametap web player\bin\release\gametapplayer.exe | "TCP Query User{C8AF8E80-5FE7-4056-BC82-A1E65C605745}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | "TCP Query User{DC0D3916-14CB-404C-8C93-C62AA54E6227}C:\program files\ruckus player\ruckus.exe" = protocol=6 | dir=in | app=c:\program files\ruckus player\ruckus.exe | "TCP Query User{E4DD0505-6434-49CF-9EAB-632D18D7EA55}C:\program files\gametap\bin\release\gametap.exe" = protocol=6 | dir=in | app=c:\program files\gametap\bin\release\gametap.exe | "UDP Query User{0268F43E-6C65-4E8E-AA52-E4C02592E51E}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe | "UDP Query User{1CFAD234-1CFA-460B-BAB9-815D55BA9C38}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | "UDP Query User{2264D8D3-AC3A-4669-AA42-9AE391E01CC5}C:\program files\gametap\bin\release\gametap.exe" = protocol=17 | dir=in | app=c:\program files\gametap\bin\release\gametap.exe | "UDP Query User{2872F8E1-D538-4ED3-A862-D9F96C824C56}C:\sierra\empire earth\empire earth.exe" = protocol=17 | dir=in | app=c:\sierra\empire earth\empire earth.exe | "UDP Query User{2CC26596-B816-49F0-BCF4-B0BC74752F3C}C:\program files\ccp\eve\bin\exefile.exe" = protocol=17 | dir=in | app=c:\program files\ccp\eve\bin\exefile.exe | "UDP Query User{38C5E6C4-BB2D-4685-B1E0-F17049D3A6B8}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | "UDP Query User{40C7465B-0B75-44B6-9CA7-C7FF98EF63E8}C:\sierra\empire earth\empire earth.exe" = protocol=17 | dir=in | app=c:\sierra\empire earth\empire earth.exe | "UDP Query User{46B5581C-4B71-4FDD-A177-A92C56DAFC47}C:\program files\gametap web player\bin\release\gametapplayer.exe" = protocol=17 | dir=in | app=c:\program files\gametap web player\bin\release\gametapplayer.exe | "UDP Query User{53753BC4-97F4-4FAC-B1F0-F8259D9689F1}C:\program files\emote\launcher\launcher.exe" = protocol=17 | dir=in | app=c:\program files\emote\launcher\launcher.exe | "UDP Query User{5BC102B2-6FAE-427A-9EB4-701FCF1F05FB}E:\bin\ia\core\mdm_util.exe" = protocol=17 | dir=in | app=e:\bin\ia\core\mdm_util.exe | "UDP Query User{63AF5365-0303-4FB8-857F-C84A5F6F4579}C:\program files\microsoft games\rise of nations\nations.exe" = protocol=17 | dir=in | app=c:\program files\microsoft games\rise of nations\nations.exe | "UDP Query User{7A2641E9-E0B1-4BF1-8620-7B875220E2EA}C:\users\zac\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\zac\program files\dna\btdna.exe | "UDP Query User{7D2766B3-886B-49CF-A29C-99F588CDCEB9}C:\users\zac\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\zac\program files\dna\btdna.exe | "UDP Query User{8A8BBB96-1546-456C-BD5B-3A5007B4A720}C:\program files\microsoft games\rise of nations\nations.exe" = protocol=17 | dir=in | app=c:\program files\microsoft games\rise of nations\nations.exe | "UDP Query User{8D00C06B-7853-406F-A2A8-CEDB9BF026F4}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | "UDP Query User{B0E1C4A9-B7AB-4FE0-A49B-EA7907F8E181}C:\program files\aim6\aim6.exe" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe | "UDP Query User{B172EC49-239E-478D-9C18-04B89EC0D853}C:\program files\ruckus player\ruckus.exe" = protocol=17 | dir=in | app=c:\program files\ruckus player\ruckus.exe | "UDP Query User{B28A2C77-4434-41CD-85F4-F4544D4FB4EE}C:\program files\aim6\aim6.exe" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe | "UDP Query User{E4B43872-D0B8-4DF9-A07C-B21B85727621}C:\program files\gametap web player\bin\release\gametapplayer.exe" = protocol=17 | dir=in | app=c:\program files\gametap web player\bin\release\gametapplayer.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{001E7FB6-BB6B-4ED0-BEDC-B5404ED96D4E}" = DocProc "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser "{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools "{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime "{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data "{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp "{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard "{1753255A-0AEB-4220-8C75-607B73F0C133}" = Copy "{22466889-7642-488d-AA0E-F619704CF7AB}" = DeviceDiscovery "{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2 "{25F6C900-C138-4888-A56C-91D3D063023A}" = HP Update "{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java™ 6 Update 17 "{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg "{2C6C74C2-042F-4D36-B7B0-0C538FCF01AB}" = Dell DataSafe Online "{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan "{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager "{35C03C04-3F1F-42C2-A989-A757EE691F65}" = McAfee VirusScan Enterprise "{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module "{38B39865-D988-4945-9A22-6107B8B40953}" = C4200 "{3E25E350-949F-4DB7-8288-2A60E018B4C1}" = Games, Music, & Photos Launcher "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting "{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}" = Banctec Service Agreement "{50CE21D8-0F44-4f3f-A392-7F9AD3194DEF}" = PS_AIO_Software "{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport "{56DF5C9E-6392-46D3-B366-297B14E1DAAF}" = Bonjour Core for Windows "{582610B8-E496-4813-993C-4B027173FE38}" = PixiePack Codec Pack "{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides "{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler "{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com "{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0 "{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport "{7F0C4457-8E64-491B-8D7B-991504365D1E}" = QuickSet "{824D3839-DAA1-4315-A822-7AE3E620E528}" = VideoToolkit01 "{82D8304F-73D7-4EE6-8472-D0684BAA2865}" = AGEIA PhysX v7.05.06 "{8389382B-53BA-4A87-8854-91E3D80A5AC7}" = HP Photosmart Essential2.01 "{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio "{8641C1CB-03B3-41d4-8DEC-79826A4B5C0E}" = HP Photosmart All-In-One Software 8.0 "{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin "{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007 "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007 "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup "{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect "{A2F166A0-F031-4E27-A057-C69733219434}_is1" = Runes of Magic "{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio "{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable "{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3 "{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant "{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan "{B045B608-4A47-4C77-9EAD-06C394503306}" = iTunes "{B09BCBF6-87EE-4403-A336-3A9510856535}" = HP Photosmart All-In-One Software 9.0 "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0 "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{B668B2B8-70D4-4754-A890-17C1DDDA9418}" = PS_AIO_Software_min "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player "{B74D4E10-1033-0000-0000-000000000001}" = Adobe Bridge 1.0 "{B9ECA41B-55CC-4654-B6B5-6731D009EC69}" = NTI Backup Now EZ "{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter "{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries "{C716522C-3731-4667-8579-40B098294500}" = Toolbox "{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE "{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CCFF1E13-77A2-4032-8B12-7566982A27DF}" = Internet Service Offers Launcher "{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}" = WinZip 11.1 "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader "{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component "{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE "{D8B7A682-20DA-4797-8415-B1FB14D4D32B}" = PS_AIO_Software "{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer "{DC858602-D984-4F08-8B88-039CD82ECBB8}" = Preclick PhotoMovieMaker "{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm "{E28750A2-45F2-4b63-99F7-9F81A94B1E2D}" = PS_AIO_Software_min "{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software) "{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect "{E65CA2A8-1F2A-4400-AE55-FFD43D3B6980}" = c4200_Help "{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0 "{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox "{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential "{EBBE2FB2-FBED-44F6-B95F-230AB5A65B28}" = Goombah Partner COM Server "{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}" = Adobe Flash Player 10 Plugin "{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729) "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01 "{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool "{F72E2DDC-3DB8-4190-A21D-63883D955FE7}" = PSSWCORE "{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status "{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner "{FE0C305A-37EE-4499-B4CF-0182E37B20C4}" = PS_AIO_ProductContext "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2 "Adobe Shockwave Player" = Adobe Shockwave Player 11 "Advanced Audio FX Engine" = Advanced Audio FX Engine "Advanced Video FX Engine" = Advanced Video FX Engine "AIM_6" = AIM 6 "Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.3 (Unicode) "Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card "CameraWindowDC" = Canon Utilities CameraWindow DC "CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX "CameraWindowLauncher" = Canon Utilities CameraWindow "Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder "CCleaner" = CCleaner "CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F" = Conexant HDA D330 MDC V.92 Modem "Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011) "DELL Webcam Center" = DELL Webcam Center "DELL Webcam Manager" = DELL Webcam Manager "DVD Decrypter" = DVD Decrypter (Remove Only) "EVE" = EVE Online (remove only) "ffdshow_is1" = ffdshow [rev 1909] [2008-03-20] "HOMESTUDENTR" = Microsoft Office Home and Student 2007 "HP Imaging Device Functions" = HP Imaging Device Functions 9.0 "HP Photosmart Essential" = HP Photosmart Essential 2.01 "HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0 "HPOCR" = HP OCR Software 9.0 "InstallShield_{B9ECA41B-55CC-4654-B6B5-6731D009EC69}" = NTI Backup Now EZ "LimeWire" = LimeWire 5.4.6 "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "McAfee Anti-Spyware Enterprise Module" = McAfee AntiSpyware Enterprise Module "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX "Mozilla ActiveX Control v1.7.12" = Mozilla ActiveX Control v1.7.12 "MyCamera" = Canon Utilities MyCamera "MyCameraDC" = Canon Utilities MyCamera DC "NVIDIA Drivers" = NVIDIA Drivers "OpenSource Flash Video Splitter" = OpenSource Flash Video Splitter (remove only) "PhotoStitch" = Canon Utilities PhotoStitch "RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX "RemoteCaptureDC" = Canon Utilities RemoteCapture DC "RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX "RiseOfNations 1.0" = Microsoft Rise Of Nations "SafeConnect" = SafeConnect "SerifDrawPlus40" = Serif DrawPlus 4.0 "SynTPDeinstKey" = Dell Touchpad "SystemRequirementsLab" = System Requirements Lab "ZoomBrowser EX" = Canon Utilities ZoomBrowser EX "ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-2241642629-384779116-2283715535-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Move Networks Player - IE" = Move Networks Media Player for Internet Explorer ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 12/16/2009 2:24:13 AM | Computer Name = Laptop | Source = Application Error | ID = 1000 Description = Faulting application TeaTimer.exe, version 1.6.6.32, time stamp 0x2a425e19, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821, exception code 0xc0000005, fault offset 0x0004a4e3, process id 0xa64, application start time 0x01ca794406b460b0. Error - 12/16/2009 4:39:25 PM | Computer Name = Laptop | Source = Application Error | ID = 1000 Description = Faulting application bcmwltry.exe, version 4.170.25.12, time stamp 0x46f3437a, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x047190da, process id 0x6b0, application start time 0x01ca7e8f964b283d. Error - 12/19/2009 3:13:24 AM | Computer Name = Laptop | Source = Application Hang | ID = 1002 Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 7b4 Start Time: 01ca7e8f9a18c26d Termination Time: 2106 Error - 12/19/2009 3:14:02 AM | Computer Name = Laptop | Source = Application Hang | ID = 1002 Description = The program iexplore.exe version 8.0.6001.18865 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 16c4 Start Time: 01ca8079dc839710 Termination Time: 359 Error - 12/19/2009 4:02:52 AM | Computer Name = Laptop | Source = EventSystem | ID = 4622 Description = Error - 12/19/2009 4:39:03 AM | Computer Name = Laptop | Source = EventSystem | ID = 4621 Description = Error - 12/19/2009 4:41:36 AM | Computer Name = Laptop | Source = EventSystem | ID = 4609 Description = Error - 12/23/2009 4:37:27 AM | Computer Name = Laptop | Source = Application Hang | ID = 1002 Description = The program wmplayer.exe version 11.0.6002.18111 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 150c Start Time: 01ca83ab0dbae980 Termination Time: 44 Error - 12/25/2009 2:48:40 PM | Computer Name = Laptop | Source = VSS | ID = 8194 Description = Error - 12/25/2009 11:22:45 PM | Computer Name = Laptop | Source = EventSystem | ID = 4621 Description = [ Broadcom Wireless LAN Events ] Error - 7/15/2009 4:32:30 PM | Computer Name = Laptop | Source = WLAN-Tray | ID = 0 Description = 16:32:28, Wed, Jul 15, 09 Error - Unable to gain access to user store Error - 9/14/2009 6:49:27 PM | Computer Name = Laptop | Source = WLAN-Tray | ID = 0 Description = 18:49:25, Mon, Sep 14, 09 Error - Unable to gain access to user store Error - 12/19/2009 12:51:57 PM | Computer Name = Laptop | Source = WLAN-Tray | ID = 0 Description = 11:51:53, Sat, Dec 19, 09 Error - Unable to gain access to user store [ Media Center Events ] Error - 11/30/2007 6:58:57 PM | Computer Name = Laptop | Source = MCUpdate | ID = 0 Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Error - 12/1/2007 4:50:20 PM | Computer Name = Laptop | Source = MCUpdate | ID = 0 Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Error - 12/1/2007 6:45:51 PM | Computer Name = Laptop | Source = MCUpdate | ID = 0 Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Error - 12/2/2007 8:46:39 PM | Computer Name = Laptop | Source = MCUpdate | ID = 0 Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Error - 12/5/2007 10:43:47 PM | Computer Name = Laptop | Source = MCUpdate | ID = 0 Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Error - 4/16/2008 10:44:42 PM | Computer Name = Laptop | Source = MCUpdate | ID = 0 Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight. Error - 12/15/2008 4:42:47 PM | Computer Name = Laptop | Source = MCUpdate | ID = 0 Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Error - 4/5/2009 1:43:59 AM | Computer Name = Laptop | Source = MCUpdate | ID = 0 Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Error - 4/30/2009 12:09:40 AM | Computer Name = Laptop | Source = MCUpdate | ID = 0 Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Error - 10/2/2009 11:54:04 PM | Computer Name = Laptop | Source = MCUpdate | ID = 0 Description = Failed to wait on MCUpdate mutex with exception: 'The wait completed due to an abandoned mutex.'. [ OSession Events ] Error - 3/31/2009 12:54:54 AM | Computer Name = Laptop | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 94 seconds with 60 seconds of active time. This session ended with a crash. Error - 4/14/2009 1:51:49 AM | Computer Name = Laptop | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 23 seconds with 0 seconds of active time. This session ended with a crash. Error - 4/17/2009 4:26:22 AM | Computer Name = Laptop | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 11 seconds with 0 seconds of active time. This session ended with a crash. Error - 4/21/2009 10:32:47 PM | Computer Name = Laptop | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 309 seconds with 120 seconds of active time. This session ended with a crash. Error - 4/21/2009 10:49:19 PM | Computer Name = Laptop | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 185 seconds with 120 seconds of active time. This session ended with a crash. Error - 4/24/2009 12:56:37 AM | Computer Name = Laptop | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 35 seconds with 0 seconds of active time. This session ended with a crash. Error - 5/7/2009 7:21:36 PM | Computer Name = Laptop | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 980 seconds with 120 seconds of active time. This session ended with a crash. Error - 10/15/2009 2:33:42 PM | Computer Name = Laptop | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2055 seconds with 1560 seconds of active time. This session ended with a crash. Error - 12/10/2009 11:22:09 PM | Computer Name = Laptop | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 33182 seconds with 3660 seconds of active time. This session ended with a crash. Error - 1/17/2010 6:46:54 PM | Computer Name = Laptop | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1221 seconds with 0 seconds of active time. This session ended with a crash. [ System Events ] Error - 1/17/2010 6:08:40 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7000 Description = Error - 1/17/2010 6:08:42 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7000 Description = Error - 1/17/2010 6:08:46 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7000 Description = Error - 1/17/2010 6:08:48 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7000 Description = Error - 1/17/2010 6:08:49 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7000 Description = Error - 1/17/2010 6:08:50 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7000 Description = Error - 1/17/2010 6:08:50 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7000 Description = Error - 1/17/2010 6:10:39 PM | Computer Name = Laptop | Source = netbt | ID = 4321 Description = The name "LAPTOP :0" could not be registered on the interface with IP address 158.65.205.56. The computer with the IP address 158.65.100.11 did not allow the name to be claimed by this computer. Error - 1/18/2010 2:19:19 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7000 Description = Error - 1/18/2010 2:19:22 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7000 Description = < End of report > |
|
|
|
|
Jan 19 2010, 10:56 AM
Post
#4
|
|
|
bleepin' _temp_ Group: Malware Response Instructor Posts: 14,927 Joined: 25-January 08 From: At home Member No.: 186,120 |
Hi,
please also provide a log from gmer: Please download GMER from one of the following locations and save it to your desktop:
regards myrti -------------------- Help request via PM will be ignored, unless I am already helping you. Please use the forums! If I have helped you please consider to to help me continue the malware fight! Thank you! |
|
|
|
|
Jan 19 2010, 05:53 PM
Post
#5
|
|
|
Member Group: Members Posts: 32 Joined: 8-November 08 Member No.: 254,096 |
I tried running GMER in both normal and safe mode, but in each mode the scan would not finish. In normal booting mode, the error came up saying "jfkx0ggg is no longer responding", and that it encountered a random error and had to close. Each and every time I tried to scan I got the same result. So then I tried the scan in safe mode. Even in safe mode, the program ran into the same error, causing the same error message to pop up before it could finish the scan. While in safe mode I tried right clicking on GMER and runing as an administrator, and oddly enough the "Blue screen of death" popped up, saying something along the lines of "Windows has encounter a fatal error and must restart". The blue screen disappeared before I could read the rest of the specifics.
|
|
|
|
|
Jan 20 2010, 02:02 PM
Post
#6
|
|
|
bleepin' _temp_ Group: Malware Response Instructor Posts: 14,927 Joined: 25-January 08 From: At home Member No.: 186,120 |
Hi,
please try running the following tools instead: Please download mbr.exe and save it to your root directory, usually C:\ <- (Important!).
regards myrti -------------------- Help request via PM will be ignored, unless I am already helping you. Please use the forums! If I have helped you please consider to to help me continue the malware fight! Thank you! |
|
|
|
on your desktop.|
Jan 20 2010, 11:32 PM
Post
#7
|
|
|
Member Group: Members Posts: 32 Joined: 8-November 08 Member No.: 254,096 |
The only way I could save the mbr file to my root directory was via safe mode with networking (thank you vista protection...) After saving it there, I was able to have it scan, and a quick log appeared with the following results:
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll intelide.sys PCIIDEX.SYS atapi.sys kernel: MBR read successfully user & kernel MBR OK After that I tried the RootRepeal program in safe mode with networking as well. It would scan for a long time, approximately 30-40 mins, and then right near what I'm assuming the end of the scan would be, an error message popped up saying "Could not read our index block!". As soon as I closed the error message the program exited itself out, and no scan log could be saved. I tried again and again with the same results. Finally, I rebooted in normal start up mode to try the rootrepeal program again, and this time after scanning for a while, and error message popped up with the title "RootRepeal Error". Unfortunately the contents of the error window were transparent so no further details were provided. After closing that error window, a new window popped up without a title, and again with a transparent interior. Sorry to be so vague, but these error messages provided no further information. Is it a bad sign that I can't do these scans? |
|
|
|
|
Jan 21 2010, 07:04 AM
Post
#8
|
|
|
bleepin' _temp_ Group: Malware Response Instructor Posts: 14,927 Joined: 25-January 08 From: At home Member No.: 186,120 |
Hi,
rootkitscanners are tricky programs, they don't always run as we wish them to. The mbr-log looks fine.  There may also be some interference from other programs. Please try RootRepeal again, but before the scan do the following: Please start RootRepeal, and, before doing anything else, try changing the "Disk Access Level" in the Settings->Options dialog. Try moving it to the "Special" or "High" level. Also, click on the Files tab, and uncheck "Use lowest level for MBR check". Please let me know if this fixes the problem. regarsd myrti -------------------- Help request via PM will be ignored, unless I am already helping you. Please use the forums! If I have helped you please consider to to help me continue the malware fight! Thank you! |
|
|
|
|
Jan 21 2010, 08:22 PM
Post
#9
|
|
|
Member Group: Members Posts: 32 Joined: 8-November 08 Member No.: 254,096 |
Well thats good at least. Thank you so much for all of the time and effort you have put into this with me; I know this isn't easy. I tried adjusting the settings you suggested, and after running RootRepeal in both Safe and Normal boot modes, I got the following error messages in both modes: "RootRepeal Error; Attempt to write to address: 0x00000004" Then after exiting out of that error, this one popped up: "Could not read our index block!".
|
|
|
|
|
Jan 22 2010, 11:55 AM
Post
#10
|
|
|
bleepin' _temp_ Group: Malware Response Instructor Posts: 14,927 Joined: 25-January 08 From: At home Member No.: 186,120 |
Hi,
please try the following tool instead: Please download Sysprot Antirootkit from here http://sites.google.com/site/sysprotantirootkit/ Unzip it into a folder on your desktop.
regards myrti -------------------- Help request via PM will be ignored, unless I am already helping you. Please use the forums! If I have helped you please consider to to help me continue the malware fight! Thank you! |
|
|
|
|
Jan 23 2010, 02:11 PM
Post
#11
|
|
|
Member Group: Members Posts: 32 Joined: 8-November 08 Member No.: 254,096 |
I tried this new program, but with similar results... After clicking the "get log" button, an error message popped up saying: "Failed to start service. Sysprot AntiRootKit needs to be run with Admin privileges!" It's getting a little annoying to read this error message since I HAVE administrator privileges on my account, and the fact that I even see this in safe mode. Am I doing something wrong, maybe logged in with the wrong credentials or something?
|
|
|
|
|
Jan 23 2010, 06:25 PM
Post
#12
|
|
|
bleepin' _temp_ Group: Malware Response Instructor Posts: 14,927 Joined: 25-January 08 From: At home Member No.: 186,120 |
Hi,
please try to launch it by doing a right click on the file and select "run as administrator" regards myrti -------------------- Help request via PM will be ignored, unless I am already helping you. Please use the forums! If I have helped you please consider to to help me continue the malware fight! Thank you! |
|
|
|
|
Jan 23 2010, 08:47 PM
Post
#13
|
|
|
Member Group: Members Posts: 32 Joined: 8-November 08 Member No.: 254,096 |
Wow, I cannot believe I didn't do that before complaining about my problem haha. Doing that worked, thanks a bunch. Here's the log:
SysProt AntiRootkit v1.0.1.0 by swatkat ****************************************************************************************** ****************************************************************************************** Process: Name: [System Idle Process] PID: 0 Hidden: No Window Visible: No Name: System PID: 4 Hidden: No Window Visible: No Name: C:\Windows\System32\smss.exe PID: 432 Hidden: No Window Visible: No Name: C:\Windows\System32\csrss.exe PID: 484 Hidden: No Window Visible: No Name: C:\Windows\System32\wininit.exe PID: 544 Hidden: No Window Visible: No Name: C:\Windows\System32\csrss.exe PID: 556 Hidden: No Window Visible: No Name: C:\Windows\System32\services.exe PID: 588 Hidden: No Window Visible: No Name: C:\Windows\System32\lsass.exe PID: 600 Hidden: No Window Visible: No Name: C:\Windows\System32\lsm.exe PID: 612 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 760 Hidden: No Window Visible: No Name: C:\Windows\System32\nvvsvc.exe PID: 824 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 856 Hidden: No Window Visible: No Name: C:\Windows\System32\winlogon.exe PID: 896 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 920 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 992 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 1068 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 1084 Hidden: No Window Visible: No Name: C:\Windows\System32\audiodg.exe PID: 1180 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 1224 Hidden: No Window Visible: No Name: C:\Windows\System32\SLsvc.exe PID: 1248 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 1288 Hidden: No Window Visible: No Name: C:\Windows\System32\rundll32.exe PID: 1376 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 1488 Hidden: No Window Visible: No Name: C:\Windows\System32\WLTRYSVC.EXE PID: 1684 Hidden: No Window Visible: No Name: C:\Windows\System32\BCMWLTRY.EXE PID: 1696 Hidden: No Window Visible: No Name: C:\Windows\System32\wlanext.exe PID: 1732 Hidden: No Window Visible: No Name: C:\Windows\System32\spoolsv.exe PID: 1796 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 1852 Hidden: No Window Visible: No Name: C:\Windows\System32\dwm.exe PID: 696 Hidden: No Window Visible: No Name: C:\Windows\System32\taskeng.exe PID: 536 Hidden: No Window Visible: No Name: C:\Windows\explorer.exe PID: 1500 Hidden: No Window Visible: No Name: C:\Windows\System32\taskeng.exe PID: 660 Hidden: No Window Visible: No Name: C:\Windows\System32\AEstSrv.exe PID: 2428 Hidden: No Window Visible: No Name: C:\Program Files\Bonjour\mDNSResponder.exe PID: 2440 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 2476 Hidden: No Window Visible: No Name: C:\Program Files\McAfee\Common Framework\FrameworkService.exe PID: 2520 Hidden: No Window Visible: No Name: C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe PID: 2652 Hidden: No Window Visible: No Name: C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe PID: 2708 Hidden: No Window Visible: No Name: C:\Program Files\McAfee\Common Framework\naPrdMgr.exe PID: 2732 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 2948 Hidden: No Window Visible: No Name: C:\Program Files\SafeConnect\scManager.sys PID: 2964 Hidden: No Window Visible: No Name: C:\Program Files\Dell Support Center\bin\sprtsvc.exe PID: 2992 Hidden: No Window Visible: No Name: C:\Windows\System32\stacsv.exe PID: 3024 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 3096 Hidden: No Window Visible: No Name: C:\Windows\System32\svchost.exe PID: 3136 Hidden: No Window Visible: No Name: C:\Windows\System32\SearchIndexer.exe PID: 3172 Hidden: No Window Visible: No Name: C:\Windows\System32\drivers\XAudio.exe PID: 3232 Hidden: No Window Visible: No Name: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe PID: 2352 Hidden: No Window Visible: Yes Name: C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe PID: 1872 Hidden: No Window Visible: No Name: C:\Windows\System32\WLTRAY.EXE PID: 584 Hidden: No Window Visible: No Name: C:\Windows\System32\rundll32.exe PID: 2584 Hidden: No Window Visible: No Name: C:\Program Files\Dell Support Center\bin\sprtcmd.exe PID: 2308 Hidden: No Window Visible: No Name: C:\Windows\OEM02Mon.exe PID: 752 Hidden: No Window Visible: No Name: C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe PID: 2900 Hidden: No Window Visible: No Name: C:\Program Files\Java\jre6\bin\jusched.exe PID: 2988 Hidden: No Window Visible: No Name: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe PID: 3116 Hidden: No Window Visible: No Name: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe PID: 3120 Hidden: No Window Visible: No Name: C:\Program Files\Digital Line Detect\DLG.exe PID: 3168 Hidden: No Window Visible: No Name: C:\Program Files\Dell\QuickSet\quickset.exe PID: 2160 Hidden: No Window Visible: No Name: C:\Program Files\SafeConnect\SCClient.exe PID: 2264 Hidden: No Window Visible: No Name: C:\Windows\System32\wbem\WmiPrvSE.exe PID: 2780 Hidden: No Window Visible: No Name: C:\Windows\System32\mobsync.exe PID: 2220 Hidden: No Window Visible: No Name: C:\Program Files\Internet Explorer\iexplore.exe PID: 1236 Hidden: No Window Visible: No Name: C:\Program Files\Internet Explorer\iexplore.exe PID: 4232 Hidden: No Window Visible: No Name: C:\Windows\System32\Macromed\Flash\FlashUtil10d.exe PID: 5056 Hidden: No Window Visible: No Name: C:\Program Files\Internet Explorer\iexplore.exe PID: 5224 Hidden: No Window Visible: No Name: C:\Users\Zac\Desktop\SysProt\SysProt.exe PID: 4944 Hidden: No Window Visible: Yes Name: C:\Windows\System32\SearchProtocolHost.exe PID: 5028 Hidden: No Window Visible: No Name: C:\Windows\System32\SearchFilterHost.exe PID: 1440 Hidden: No Window Visible: No ****************************************************************************************** ****************************************************************************************** Kernel Modules: Module Name: \??\C:\Users\Zac\Desktop\SysProt\SysProtDrv.sys Service Name: SysProtDrv.sys Module Base: 8D9F4000 Module End: 8D9FF000 Hidden: No Module Name: C:\Windows\system32\ntkrnlpa.exe Service Name: --- Module Base: 82404000 Module End: 827BD000 Hidden: No Module Name: C:\Windows\system32\hal.dll Service Name: --- Module Base: 827BD000 Module End: 827F0000 Hidden: No Module Name: C:\Windows\system32\kdcom.dll Service Name: --- Module Base: 8040E000 Module End: 80415000 Hidden: No Module Name: C:\Windows\system32\mcupdate_GenuineIntel.dll Service Name: --- Module Base: 80415000 Module End: 80485000 Hidden: No Module Name: C:\Windows\system32\PSHED.dll Service Name: --- Module Base: 80485000 Module End: 80496000 Hidden: No Module Name: C:\Windows\system32\BOOTVID.dll Service Name: --- Module Base: 80496000 Module End: 8049E000 Hidden: No Module Name: C:\Windows\system32\CLFS.SYS Service Name: CLFS Module Base: 8049E000 Module End: 804DF000 Hidden: No Module Name: C:\Windows\system32\CI.dll Service Name: --- Module Base: 804DF000 Module End: 805BF000 Hidden: No Module Name: C:\Windows\system32\drivers\Wdf01000.sys Service Name: Wdf01000 Module Base: 80602000 Module End: 8067E000 Hidden: No Module Name: C:\Windows\system32\drivers\WDFLDR.SYS Service Name: --- Module Base: 8067E000 Module End: 8068B000 Hidden: No Module Name: C:\Windows\system32\drivers\acpi.sys Service Name: ACPI Module Base: 8068B000 Module End: 806D1000 Hidden: No Module Name: C:\Windows\system32\drivers\WMILIB.SYS Service Name: --- Module Base: 806D1000 Module End: 806DA000 Hidden: No Module Name: C:\Windows\system32\drivers\msisadrv.sys Service Name: msisadrv Module Base: 806DA000 Module End: 806E2000 Hidden: No Module Name: C:\Windows\system32\drivers\pci.sys Service Name: pci Module Base: 806E2000 Module End: 80709000 Hidden: No Module Name: C:\Windows\System32\drivers\partmgr.sys Service Name: partmgr Module Base: 80709000 Module End: 80718000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\compbatt.sys Service Name: Compbatt Module Base: 80718000 Module End: 8071B000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\BATTC.SYS Service Name: BattC Module Base: 8071B000 Module End: 80725000 Hidden: No Module Name: C:\Windows\system32\drivers\volmgr.sys Service Name: volmgr Module Base: 80725000 Module End: 80734000 Hidden: No Module Name: C:\Windows\System32\drivers\volmgrx.sys Service Name: volmgrx Module Base: 80734000 Module End: 8077E000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\intelide.sys Service Name: intelide Module Base: 8077E000 Module End: 80785000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\PCIIDEX.SYS Service Name: --- Module Base: 80785000 Module End: 80793000 Hidden: No Module Name: C:\Windows\system32\drivers\pciide.sys Service Name: pciide Module Base: 80793000 Module End: 8079A000 Hidden: No Module Name: C:\Windows\System32\drivers\mountmgr.sys Service Name: MountMgr Module Base: 8079A000 Module End: 807AA000 Hidden: No Module Name: C:\Windows\system32\drivers\iastorv.sys Service Name: iaStorV Module Base: 82A02000 Module End: 82AA2000 Hidden: No Module Name: C:\Windows\system32\drivers\iastor.sys Service Name: iaStor Module Base: 82AA2000 Module End: 82B60000 Hidden: No Module Name: C:\Windows\system32\drivers\atapi.sys Service Name: atapi Module Base: 82B60000 Module End: 82B68000 Hidden: No Module Name: C:\Windows\system32\drivers\ataport.SYS Service Name: --- Module Base: 82B68000 Module End: 82B86000 Hidden: No Module Name: C:\Windows\system32\drivers\fltmgr.sys Service Name: FltMgr Module Base: 82B86000 Module End: 82BB8000 Hidden: No Module Name: C:\Windows\system32\drivers\fileinfo.sys Service Name: FileInfo Module Base: 82BB8000 Module End: 82BC8000 Hidden: No Module Name: C:\Windows\System32\Drivers\DRVMCDB.SYS Service Name: DRVMCDB Module Base: 82BC8000 Module End: 82BDE000 Hidden: No Module Name: C:\Windows\System32\Drivers\PxHelp20.sys Service Name: PxHelp20 Module Base: 82BDE000 Module End: 82BE7000 Hidden: No Module Name: C:\Windows\System32\Drivers\ksecdd.sys Service Name: KSecDD Module Base: 88408000 Module End: 88479000 Hidden: No Module Name: C:\Windows\system32\drivers\ndis.sys Service Name: NDIS Module Base: 88479000 Module End: 88584000 Hidden: No Module Name: C:\Windows\system32\drivers\NETIO.SYS Service Name: --- Module Base: 885AF000 Module End: 885EA000 Hidden: No Module Name: C:\Windows\System32\drivers\tcpip.sys Service Name: Tcpip Module Base: 88606000 Module End: 886F0000 Hidden: No Module Name: C:\Windows\System32\drivers\fwpkclnt.sys Service Name: --- Module Base: 886F0000 Module End: 8870B000 Hidden: No Module Name: C:\Windows\system32\drivers\mfetdik.sys Service Name: mfetdik Module Base: 8870B000 Module End: 88717000 Hidden: No Module Name: C:\Windows\system32\drivers\TDI.SYS Service Name: --- Module Base: 88717000 Module End: 88722000 Hidden: No Module Name: C:\Windows\System32\Drivers\Ntfs.sys Service Name: Ntfs Module Base: 88807000 Module End: 88917000 Hidden: No Module Name: C:\Windows\system32\drivers\volsnap.sys Service Name: volsnap Module Base: 88917000 Module End: 88950000 Hidden: No Module Name: C:\Windows\System32\Drivers\spldr.sys Service Name: spldr Module Base: 88950000 Module End: 88958000 Hidden: No Module Name: C:\Windows\System32\Drivers\mup.sys Service Name: Mup Module Base: 88958000 Module End: 88967000 Hidden: No Module Name: C:\Windows\System32\drivers\ecache.sys Service Name: Ecache Module Base: 88967000 Module End: 8898E000 Hidden: No Module Name: C:\Windows\system32\drivers\disk.sys Service Name: disk Module Base: 8898E000 Module End: 8899F000 Hidden: No Module Name: C:\Windows\system32\drivers\CLASSPNP.SYS Service Name: --- Module Base: 8899F000 Module End: 889C0000 Hidden: No Module Name: C:\Windows\system32\drivers\crcdisk.sys Service Name: crcdisk Module Base: 889C0000 Module End: 889C9000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\tunnel.sys Service Name: tunnel Module Base: 889E9000 Module End: 889F4000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\tunmp.sys Service Name: tunmp Module Base: 889F4000 Module End: 889FD000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\intelppm.sys Service Name: intelppm Module Base: 88722000 Module End: 88731000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\nvlddmkm.sys Service Name: nvlddmkm Module Base: 8C204000 Module End: 8C931000 Hidden: No Module Name: C:\Windows\System32\drivers\dxgkrnl.sys Service Name: DXGKrnl Module Base: 8C931000 Module End: 8C9D2000 Hidden: No Module Name: C:\Windows\System32\drivers\watchdog.sys Service Name: --- Module Base: 8C9D2000 Module End: 8C9DE000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\usbuhci.sys Service Name: usbuhci Module Base: 8C9DE000 Module End: 8C9E9000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\USBPORT.SYS Service Name: --- Module Base: 88731000 Module End: 8876F000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\usbehci.sys Service Name: usbehci Module Base: 8C9E9000 Module End: 8C9F8000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\HDAudBus.sys Service Name: HDAudBus Module Base: 8876F000 Module End: 887FC000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\bcmwl6.sys Service Name: BCM43XX Module Base: 8CC00000 Module End: 8CD02000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\bcm4sbxp.sys Service Name: bcm4sbxp Module Base: 8CD02000 Module End: 8CD13000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\ohci1394.sys Service Name: ohci1394 Module Base: 8CD13000 Module End: 8CD23000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\1394BUS.SYS Service Name: --- Module Base: 8CD23000 Module End: 8CD31000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\sdbus.sys Service Name: sdbus Module Base: 8CD31000 Module End: 8CD4B000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\rimmptsk.sys Service Name: rimmptsk Module Base: 8CD4B000 Module End: 8CD59000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\rimsptsk.sys Service Name: rimsptsk Module Base: 8CD59000 Module End: 8CD6D000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\rixdptsk.sys Service Name: rismxdp Module Base: 8CD6D000 Module End: 8CDBE000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\i8042prt.sys Service Name: i8042prt Module Base: 8CDBE000 Module End: 8CDD1000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\SynTP.sys Service Name: SynTP Module Base: 8CDD1000 Module End: 8CDFC000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\USBD.SYS Service Name: --- Module Base: 8CDFC000 Module End: 8CDFE000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\mouclass.sys Service Name: mouclass Module Base: 885EA000 Module End: 885F5000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\kbdclass.sys Service Name: kbdclass Module Base: 885F5000 Module End: 88600000 Hidden: No Module Name: \??\C:\Windows\system32\drivers\UBHelper.sys Service Name: UBHelper Module Base: 8C9F8000 Module End: 8CA00000 Hidden: No Module Name: C:\Windows\System32\Drivers\DLACDBHM.SYS Service Name: DLACDBHM Module Base: 8CDFE000 Module End: 8CE00000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\cdrom.sys Service Name: cdrom Module Base: 82BE7000 Module End: 82BFF000 Hidden: No Module Name: \??\C:\Windows\system32\drivers\NTIDrvr.sys Service Name: NTIDrvr Module Base: 88400000 Module End: 88408000 Hidden: No Module Name: C:\Windows\System32\Drivers\GEARAspiWDM.sys Service Name: GEARAspiWDM Module Base: 88800000 Module End: 88807000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\CmBatt.sys Service Name: CmBatt Module Base: 8C200000 Module End: 8C204000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\wmiacpi.sys Service Name: WmiAcpi Module Base: 807AA000 Module End: 807B3000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\msiscsi.sys Service Name: iScsiPrt Module Base: 807B3000 Module End: 807E2000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\storport.sys Service Name: --- Module Base: 805BF000 Module End: 80600000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\rasl2tp.sys Service Name: Rasl2tp Module Base: 807E2000 Module End: 807F9000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\ndistapi.sys Service Name: NdisTapi Module Base: 80400000 Module End: 8040B000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\ndiswan.sys Service Name: NdisWan Module Base: 8D00D000 Module End: 8D030000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\raspppoe.sys Service Name: RasPppoe Module Base: 8D030000 Module End: 8D03F000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\raspptp.sys Service Name: PptpMiniport Module Base: 8D03F000 Module End: 8D053000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\rassstp.sys Service Name: RasSstp Module Base: 8D053000 Module End: 8D068000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\termdd.sys Service Name: TermDD Module Base: 8D068000 Module End: 8D078000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\swenum.sys Service Name: swenum Module Base: 8D078000 Module End: 8D07A000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\ks.sys Service Name: --- Module Base: 8D07A000 Module End: 8D0A4000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\mssmbios.sys Service Name: mssmbios Module Base: 8D0A4000 Module End: 8D0AE000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\umbus.sys Service Name: umbus Module Base: 8D0AE000 Module End: 8D0BB000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\usbhub.sys Service Name: usbhub Module Base: 8D0BB000 Module End: 8D0F0000 Hidden: No Module Name: C:\Windows\System32\Drivers\NDProxy.SYS Service Name: NDProxy Module Base: 8D0F0000 Module End: 8D101000 Hidden: No Module Name: C:\Windows\system32\drivers\stwrt.sys Service Name: STHDA Module Base: 8D101000 Module End: 8D156000 Hidden: No Module Name: C:\Windows\system32\drivers\portcls.sys Service Name: --- Module Base: 8D156000 Module End: 8D183000 Hidden: No Module Name: C:\Windows\system32\drivers\drmk.sys Service Name: --- Module Base: 8D183000 Module End: 8D1A8000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\HSXHWAZL.sys Service Name: HSXHWAZL Module Base: 8D1A8000 Module End: 8D1E5000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\HSX_DPV.sys Service Name: HSF_DPV Module Base: 8D20D000 Module End: 8D310000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\HSX_CNXT.sys Service Name: winachsf Module Base: 8D310000 Module End: 8D3C4000 Hidden: No Module Name: C:\Windows\system32\drivers\modem.sys Service Name: Modem Module Base: 8D3C4000 Module End: 8D3D1000 Hidden: No Module Name: C:\Windows\System32\Drivers\Beep.SYS Service Name: Beep Module Base: 8D3E1000 Module End: 8D3E8000 Hidden: No Module Name: C:\Windows\System32\Drivers\DLARTL_M.SYS Service Name: DLARTL_M Module Base: 8D3E8000 Module End: 8D3EE000 Hidden: No Module Name: C:\Windows\System32\drivers\vga.sys Service Name: vga Module Base: 8D3EE000 Module End: 8D3FA000 Hidden: No Module Name: C:\Windows\System32\drivers\VIDEOPRT.SYS Service Name: --- Module Base: 8D801000 Module End: 8D822000 Hidden: No Module Name: C:\Windows\System32\DRIVERS\RDPCDD.sys Service Name: RDPCDD Module Base: 8D822000 Module End: 8D82A000 Hidden: No Module Name: C:\Windows\system32\drivers\rdpencdd.sys Service Name: RDPENCDD Module Base: 8D82A000 Module End: 8D832000 Hidden: No Module Name: C:\Windows\System32\Drivers\Npfs.SYS Service Name: Npfs Module Base: 8D83D000 Module End: 8D84B000 Hidden: No Module Name: C:\Windows\System32\DRIVERS\rasacd.sys Service Name: RasAcd Module Base: 8D84B000 Module End: 8D854000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\tdx.sys Service Name: tdx Module Base: 8D854000 Module End: 8D86A000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\smb.sys Service Name: Smb Module Base: 8D86A000 Module End: 8D87E000 Hidden: No Module Name: C:\Windows\System32\DRIVERS\netbt.sys Service Name: netbt Module Base: 8D87E000 Module End: 8D8B0000 Hidden: No Module Name: C:\Windows\system32\drivers\afd.sys Service Name: AFD Module Base: 8D8B0000 Module End: 8D8F8000 Hidden: No Module Name: C:\Windows\System32\Drivers\avgtdix.sys Service Name: AvgTdiX Module Base: 8D8F8000 Module End: 8D911000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\pacer.sys Service Name: PSched Module Base: 8D911000 Module End: 8D927000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\netbios.sys Service Name: NetBIOS Module Base: 8D927000 Module End: 8D935000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\wanarp.sys Service Name: Wanarp Module Base: 8D935000 Module End: 8D948000 Hidden: No Module Name: \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys Service Name: SASKUTIL Module Base: 8D948000 Module End: 8D96D000 Hidden: No Module Name: \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS Service Name: SASDIFSV Module Base: 8D96D000 Module End: 8D973000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\rdbss.sys Service Name: rdbss Module Base: 8D973000 Module End: 8D9AF000 Hidden: No Module Name: C:\Windows\system32\drivers\nsiproxy.sys Service Name: nsiproxy Module Base: 8D9AF000 Module End: 8D9B9000 Hidden: No Module Name: \??\C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys Service Name: mferkdk Module Base: 8D9B9000 Module End: 8D9C0000 Hidden: No Module Name: C:\Windows\System32\Drivers\dfsc.sys Service Name: DfsC Module Base: 8D9C0000 Module End: 8D9D7000 Hidden: No Module Name: C:\Windows\System32\Drivers\avgmfx86.sys Service Name: AvgMfx86 Module Base: 8D9D7000 Module End: 8D9DD000 Hidden: No Module Name: C:\Windows\System32\Drivers\avgldx86.sys Service Name: AvgLdx86 Module Base: 8DC04000 Module End: 8DC53000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\usbccgp.sys Service Name: usbccgp Module Base: 8DC53000 Module End: 8DC6A000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\OEM02Dev.sys Service Name: OEM02Dev Module Base: 8DC6A000 Module End: 8DCA4000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\OEM02Vfx.sys Service Name: OEM02Vfx Module Base: 8DCA4000 Module End: 8DCA6000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\hidusb.sys Service Name: HidUsb Module Base: 8DCA6000 Module End: 8DCAF000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\HIDCLASS.SYS Service Name: --- Module Base: 8DCAF000 Module End: 8DCBF000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\HIDPARSE.SYS Service Name: --- Module Base: 8DCBF000 Module End: 8DCC6000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\mouhid.sys Service Name: mouhid Module Base: 8DCC6000 Module End: 8DCCE000 Hidden: No Module Name: C:\Windows\System32\Drivers\crashdmp.sys Service Name: --- Module Base: 8DCCE000 Module End: 8DCDB000 Hidden: No Module Name: \SystemRoot\System32\Drivers\dump_dumpata.sys Service Name: --- Module Base: 8DCDB000 Module End: 8DCE6000 Hidden: Yes Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys Service Name: --- Module Base: 8DCE6000 Module End: 8DCEE000 Hidden: Yes Module Name: C:\Windows\System32\drivers\Dxapi.sys Service Name: --- Module Base: 8DCEE000 Module End: 8DCF8000 Hidden: No Module Name: C:\Windows\system32\drivers\luafv.sys Service Name: luafv Module Base: 8DD07000 Module End: 8DD22000 Hidden: No Module Name: C:\Windows\System32\Drivers\DRVNDDM.SYS Service Name: DRVNDDM Module Base: 8DD22000 Module End: 8DD2D000 Hidden: No Module Name: C:\Windows\System32\DLA\DLADResM.SYS Service Name: DLADResM Module Base: 8DD2D000 Module End: 8DD2E000 Hidden: No Module Name: C:\Windows\System32\DLA\DLAIFS_M.SYS Service Name: DLAIFS_M Module Base: 8DD2E000 Module End: 8DD46000 Hidden: No Module Name: C:\Windows\System32\DLA\DLAOPIOM.SYS Service Name: DLAOPIOM Module Base: 8DD46000 Module End: 8DD4B000 Hidden: No Module Name: C:\Windows\System32\DLA\DLAPoolM.SYS Service Name: DLAPoolM Module Base: 8DD4B000 Module End: 8DD4D000 Hidden: No Module Name: C:\Windows\System32\DLA\DLABMFSM.SYS Service Name: DLABMFSM Module Base: 8DD4D000 Module End: 8DD54000 Hidden: No Module Name: C:\Windows\System32\DLA\DLABOIOM.SYS Service Name: DLABOIOM Module Base: 8DD54000 Module End: 8DD5B000 Hidden: No Module Name: C:\Windows\System32\DLA\DLAUDFAM.SYS Service Name: DLAUDFAM Module Base: 8DD5B000 Module End: 8DD71000 Hidden: No Module Name: C:\Windows\System32\DLA\DLAUDF_M.SYS Service Name: DLAUDF_M Module Base: 8DD71000 Module End: 8DD88000 Hidden: No Module Name: C:\Windows\system32\drivers\spsys.sys Service Name: --- Module Base: 9BC04000 Module End: 9BCB4000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\lltdio.sys Service Name: lltdio Module Base: 9BCB4000 Module End: 9BCC4000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\nwifi.sys Service Name: NativeWifiP Module Base: 9BCC4000 Module End: 9BCEE000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\ndisuio.sys Service Name: Ndisuio Module Base: 9BCEE000 Module End: 9BCF8000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\rspndr.sys Service Name: rspndr Module Base: 9BCF8000 Module End: 9BD0B000 Hidden: No Module Name: C:\Windows\system32\drivers\HTTP.sys Service Name: HTTP Module Base: 9BD0B000 Module End: 9BD78000 Hidden: No Module Name: C:\Windows\System32\DRIVERS\srvnet.sys Service Name: srvnet Module Base: 9BD78000 Module End: 9BD95000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\bowser.sys Service Name: bowser Module Base: 9BD95000 Module End: 9BDAE000 Hidden: No Module Name: C:\Windows\System32\drivers\mpsdrv.sys Service Name: mpsdrv Module Base: 9BDAE000 Module End: 9BDC3000 Hidden: No Module Name: C:\Windows\system32\drivers\mrxdav.sys Service Name: MRxDAV Module Base: 9BDC3000 Module End: 9BDE4000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\mrxsmb.sys Service Name: mrxsmb Module Base: 8DD90000 Module End: 8DDAF000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\mrxsmb10.sys Service Name: mrxsmb10 Module Base: 8DDAF000 Module End: 8DDE8000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\mrxsmb20.sys Service Name: mrxsmb20 Module Base: 9BDE4000 Module End: 9BDFC000 Hidden: No Module Name: C:\Windows\System32\DRIVERS\srv2.sys Service Name: srv2 Module Base: 9D601000 Module End: 9D628000 Hidden: No Module Name: C:\Windows\System32\DRIVERS\srv.sys Service Name: srv Module Base: 9D628000 Module End: 9D674000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\dsunidrv.sys Service Name: dsunidrv Module Base: 9D68C000 Module End: 9D68E000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\mdmxsdk.sys Service Name: mdmxsdk Module Base: 9D68E000 Module End: 9D692000 Hidden: No Module Name: C:\Windows\System32\Drivers\fastfat.SYS Service Name: fastfat Module Base: 9D692000 Module End: 9D6BA000 Hidden: No Module Name: C:\Windows\system32\drivers\peauth.sys Service Name: PEAUTH Module Base: 9D6BA000 Module End: 9D798000 Hidden: No Module Name: C:\Windows\System32\Drivers\secdrv.SYS Service Name: secdrv Module Base: 9D798000 Module End: 9D7A2000 Hidden: No Module Name: C:\Windows\System32\drivers\tcpipreg.sys Service Name: tcpipreg Module Base: 9D7A2000 Module End: 9D7AE000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\xaudio.sys Service Name: XAudio Module Base: 9D7AE000 Module End: 9D7B6000 Hidden: No Module Name: C:\Windows\system32\drivers\mfehidk.sys Service Name: mfehidk Module Base: 9D7B6000 Module End: 9D7E0000 Hidden: No Module Name: C:\Windows\system32\drivers\mfebopk.sys Service Name: mfebopk Module Base: 9D7E0000 Module End: 9D7E7000 Hidden: No Module Name: C:\Windows\system32\drivers\mfeapfk.sys Service Name: mfeapfk Module Base: 9D7E7000 Module End: 9D7F6000 Hidden: No Module Name: C:\Windows\system32\drivers\mfeavfk.sys Service Name: mfeavfk Module Base: 9D674000 Module End: 9D685000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\cdfs.sys Service Name: cdfs Module Base: 8DDE8000 Module End: 8DDFE000 Hidden: No Module Name: \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS Service Name: SASENUM Module Base: 9D685000 Module End: 9D68A000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\asyncmac.sys Service Name: AsyncMac Module Base: 9D7F6000 Module End: 9D7FF000 Hidden: No Module Name: C:\Windows\system32\DRIVERS\monitor.sys Service Name: monitor Module Base: 8DCF8000 Module End: 8DD07000 Hidden: No Module Name: C:\Windows\System32\Drivers\Null.SYS Service Name: Null Module Base: 8D3DA000 Module End: 8D3E1000 Hidden: No Module Name: C:\Windows\System32\Drivers\Msfs.SYS Service Name: Msfs Module Base: 8D832000 Module End: 8D83D000 Hidden: No ****************************************************************************************** ****************************************************************************************** SSDT: Function Name: ZwTerminateProcess Address: 8D9510B0 Driver Base: 8D948000 Driver End: 8D96D000 Driver Name: \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys ****************************************************************************************** ****************************************************************************************** Kernel Hooks: Hooked Function: ZwTerminateProcess At Address: 825F4D5D Jump To: 9D7CA19B Module Name: C:\Windows\system32\drivers\mfehidk.sys Hooked Function: ZwProtectVirtualMemory At Address: 8261DE7D Jump To: 9D7CA1C3 Module Name: C:\Windows\system32\drivers\mfehidk.sys Hooked Function: ZwCreateProcess At Address: 8269574B Jump To: 9D7CA1D9 Module Name: C:\Windows\system32\drivers\mfehidk.sys Hooked Function: ZwCreateFile At Address: 82645D59 Jump To: 9D7CA1AF Module Name: C:\Windows\system32\drivers\mfehidk.sys ****************************************************************************************** ****************************************************************************************** No IRP Hooks found ****************************************************************************************** ****************************************************************************************** Ports: Local Address: LAPTOP.KEENE.EDU:62132 Remote Address: 12.120.78.253:HTTP Type: TCP Process: C:\Program Files\McAfee\Common Framework\FrameworkService.exe State: CLOSE_WAIT Local Address: LAPTOP.KEENE.EDU:56285 Remote Address: A96-6-41-121.DEPLOY.AKAMAITECHNOLOGIES.COM:HTTP Type: TCP Process: C:\Program Files\Java\jre6\bin\jusched.exe State: CLOSE_WAIT Local Address: LAPTOP.KEENE.EDU:51570 Remote Address: VX-IN-F138.1E100.NET:HTTP Type: TCP Process: C:\Program Files\Internet Explorer\iexplore.exe State: ESTABLISHED Local Address: LAPTOP.KEENE.EDU:51559 Remote Address: WWW.PAYPAL.CO.NZ:HTTPS Type: TCP Process: C:\Program Files\Internet Explorer\iexplore.exe State: ESTABLISHED Local Address: LAPTOP.KEENE.EDU:NETBIOS-SSN Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51632 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51631 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51630 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51629 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51628 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51627 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51626 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51625 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51624 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51623 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51622 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51621 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51620 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51619 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51618 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51617 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51616 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51615 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51614 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51613 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51612 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51611 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51610 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51609 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51608 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51607 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51606 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51605 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51604 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51603 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51602 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51601 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51600 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51599 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51598 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51597 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51596 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51595 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51594 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51593 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51592 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51591 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51574 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51573 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51572 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51571 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51569 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51546 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51545 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51542 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51541 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51540 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51539 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51538 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51537 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51536 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51535 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51534 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: LOCALHOST:51533 Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: LAPTOP:8585 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\SafeConnect\scManager.sys State: LISTENING Local Address: LAPTOP:5354 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\Bonjour\mDNSResponder.exe State: LISTENING Local Address: LAPTOP:49158 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\svchost.exe State: LISTENING Local Address: LAPTOP:49156 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\services.exe State: LISTENING Local Address: LAPTOP:49155 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\lsass.exe State: LISTENING Local Address: LAPTOP:49154 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\svchost.exe State: LISTENING Local Address: LAPTOP:49153 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\svchost.exe State: LISTENING Local Address: LAPTOP:49152 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\wininit.exe State: LISTENING Local Address: LAPTOP:5357 Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: LAPTOP:MICROSOFT-DS Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: LAPTOP:EPMAP Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Windows\System32\svchost.exe State: LISTENING Local Address: LAPTOP.KEENE.EDU:63530 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP.KEENE.EDU:5353 Remote Address: NA Type: UDP Process: C:\Program Files\Bonjour\mDNSResponder.exe State: NA Local Address: LAPTOP.KEENE.EDU:SSDP Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP.KEENE.EDU:138 Remote Address: NA Type: UDP Process: System State: NA Local Address: LAPTOP.KEENE.EDU:NETBIOS-NS Remote Address: NA Type: UDP Process: System State: NA Local Address: LAPTOP:63531 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP:55422 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP:55029 Remote Address: NA Type: UDP Process: C:\Program Files\Internet Explorer\iexplore.exe State: NA Local Address: LAPTOP:52298 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP:SSDP Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP:49288 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP:49286 Remote Address: NA Type: UDP Process: C:\Program Files\Bonjour\mDNSResponder.exe State: NA Local Address: LAPTOP:LLMNR Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP:IPSEC-MSFT Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP:UPNP-DISCOVERY Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP:UPNP-DISCOVERY Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP:500 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA Local Address: LAPTOP:123 Remote Address: NA Type: UDP Process: C:\Windows\System32\svchost.exe State: NA ****************************************************************************************** ****************************************************************************************** Hidden files/folders: Object: C:\System Volume Information\DFSR Status: Access denied Object: C:\System Volume Information\MountPointManagerRemoteDatabase Status: Access denied Object: C:\System Volume Information\SPP Status: Access denied Object: C:\System Volume Information\SystemRestore Status: Access denied Object: C:\System Volume Information\tracking.log Status: Access denied Object: C:\System Volume Information\{19733c53-013c-11df-bc53-001c23ab7700}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{19733d1d-013c-11df-bc53-001c23ab7700}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{19733d36-013c-11df-bc53-001c23ab7700}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{327f15bf-07c1-11df-9dc9-001c23ab7700}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{327f15dd-07c1-11df-9dc9-001c23ab7700}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{73e6b85e-063d-11df-9611-001c23ab7700}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{73e6b87a-063d-11df-9611-001c23ab7700}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\System Volume Information\{8164e859-053a-11df-9548-001c23ab7700}{3808876b-c176-4e48-b7ae-04046e6cc752} Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl Status: Access denied Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession.etl Status: Access denied |
|
|
|
|
Jan 23 2010, 09:33 PM
Post
#14
|
|
|
bleepin' _temp_ Group: Malware Response Instructor Posts: 14,927 Joined: 25-January 08 From: At home Member No.: 186,120 |
Hi,
please run ComboFix: Please download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
 Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply. This tool is not a toy and not for everyday use. ComboFix SHOULD NOT be used unless requested by a forum helper If you need help, see this link: http://www.bleepingcomputer.com/combofix/how-to-use-combofix regards myrti -------------------- Help request via PM will be ignored, unless I am already helping you. Please use the forums! If I have helped you please consider to to help me continue the malware fight! Thank you! |
|
|
|
|
Jan 24 2010, 11:39 PM
Post
#15
|
|
|
Member Group: Members Posts: 32 Joined: 8-November 08 Member No.: 254,096 |
I tried running Combofix like you said, but in the process a Dell Support Center installer popped up, tried to install the support center, but could not find what it needed. I clicked cancel, then waited and waited, but nothing was happening. I exited out of combofix, and now all of my icons are gone.. Its like everything just vanished! What happened? I'm a little freaked out, especially after reading the announcement above that combofix was bugged.
|
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 6th September 2010 - 04:33 AM |
© 2003-2010 All Rights Reserved Bleeping Computer LLC.