Search redirects and blocked startup program

Forum Guidelines

Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

Posted Image

Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.

Posted Image

DO NOT RUN ComboFix unless requested to.

Posted Image

Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

Posted Image

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Posted Image

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

Page 1 of 1

You cannot start a new topic
This topic is locked

Search redirects and blocked startup program

#1 tmyers85

New Member

Group: Members
Posts: 6
Joined: 10-December 10

Posted 25 May 2011 - 02:11 PM

I recently got hit with one of those fake anti-virus viruses. I'm not sure which one it was as it was a few weeks ago. I was able to get rid of it using malwarebytes and super-antispyware. Ever since then I have been getting messages in my system tray at startup that windows as blocked a startup program. The program is malwarebytes, but it still runs when I open it. I also have been getting a few search redirects on yahoo. I'm not sure if I am still infected or not, but those problems make me think I might be.

.
DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_25
Run by Tom at 12:28:46 on 2011-05-25
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.823 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\system32\agrsmsvc.exe
C:\Windows\Explorer.EXE
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\TOSHIBA\IVP\ISM\pinger.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Program Files\Windows Media Player\wmpnetwk.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Tom\Desktop\dds.scr
C:\Windows\system32\WSCRIPT.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
mDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart
uInternet Settings,ProxyOverride = <local>
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPStart] c:\program files\synaptics\syntp\SynTPStart.exe
mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab
DPF: {474F00F5-3853-492C-AC3A-476512BBC336} - hxxp://picasaweb.google.com/s/v/52.07/uploader2.cab
DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game04.zylom.com/activex/zylomgamesplayer.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} - hxxp://zone.msn.com/bingame/feed/default/SproutLauncher.cab
DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\tom\appdata\roaming\mozilla\firefox\profiles\gbevhbb8.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=
FF - prefs.js: network.proxy.type - 0
FF - component: c:\program files\common files\spigot\wtxpcom\components\WidgiToolbarFF.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\program files\windows media player\np_plugin.dll
FF - plugin: c:\users\tom\appdata\local\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\users\tom\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\users\tom\appdata\roaming\move networks\plugins\npqmp071505000010.dll
FF - plugin: c:\users\tom\appdata\roaming\move networks\plugins\npqmp071505000011.dll
FF - plugin: c:\users\tom\appdata\roaming\move networks\plugins\npqmp071701000002.dll
FF - plugin: c:\users\tom\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\tom\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKsleb0bf8a5;MpKsleb0bf8a5;c:\programdata\microsoft\microsoft antimalware\definition updates\{626a276b-ca94-420f-a6d6-51905f0c4a82}\MpKsleb0bf8a5.sys [2011-5-25 28752]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2010-7-9 21504]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-1-17 24652]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2007-11-12 7168]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
R3 NETw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2010-1-25 6628352]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-10-28 133104]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-10-28 133104]
.
=============== Created Last 30 ================
.
2011-05-25 17:21:57 28752 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{626a276b-ca94-420f-a6d6-51905f0c4a82}\MpKsleb0bf8a5.sys
2011-05-25 17:20:36 6962000 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{626a276b-ca94-420f-a6d6-51905f0c4a82}\mpengine.dll
2011-05-22 04:59:58 -------- d-----w- c:\users\tom\appdata\roaming\Unity
2011-05-22 04:26:49 -------- d-----w- c:\users\tom\appdata\local\Unity
2011-05-20 15:15:23 439632 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll
2011-05-20 15:15:12 439632 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{7af3124f-e186-4e4c-85c9-d980134e2a7b}\gapaengine.dll
2011-05-19 15:44:23 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-15 23:12:54 0 ----a-w- c:\users\tom\appdata\local\Rcobitulobo.bin
2011-05-15 23:12:51 -------- d-----w- c:\users\tom\appdata\local\{C8C75093-1BC9-4455-8806-5EEC21DDC75C}
2011-05-15 23:10:45 -------- d-----w- c:\programdata\oF06509DfElE06509
2011-05-10 21:40:01 6962000 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2011-05-09 17:33:30 -------- d-----w- c:\program files\Microsoft Security Client
2011-05-08 18:17:27 2048 ----a-w- c:\windows\system32\winrsmgr.dll
2011-05-08 18:17:01 20480 ----a-w- c:\windows\system32\winrshost.exe
2011-05-08 18:17:01 12800 ----a-w- c:\windows\system32\wsmprovhost.exe
2011-05-08 18:17:00 40448 ----a-w- c:\windows\system32\winrs.exe
2011-05-08 18:15:55 1696256 ----a-w- c:\windows\system32\gameux.dll
2011-05-08 18:15:52 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-05-08 18:15:51 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-05-08 18:15:34 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-05-08 18:15:33 797696 ----a-w- c:\windows\system32\FntCache.dll
2011-05-08 18:15:33 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-05-08 18:14:44 876032 ----a-w- c:\windows\system32\XpsPrint.dll
.
==================== Find3M ====================
.
2011-04-17 00:35:12 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-04-17 00:32:54 4096 ----a-w- c:\windows\system32\drivers\en-us\dxgkrnl.sys.mui
2011-04-17 00:32:52 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2011-04-17 00:32:52 252928 ----a-w- c:\windows\system32\dxdiag.exe
2011-04-17 00:32:52 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2011-04-17 00:32:51 519680 ----a-w- c:\windows\system32\d3d11.dll
2011-04-17 00:32:50 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2011-04-17 00:32:50 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-04-17 00:32:50 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-04-14 10:07:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-10 17:03:51 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2011-03-10 17:03:51 1136640 ----a-w- c:\windows\system32\mfc42.dll
2011-03-03 15:42:03 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-03 13:25:11 2041856 ----a-w- c:\windows\system32\win32k.sys
2011-03-02 15:44:27 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
.
============= FINISH: 12:30:05.60 ===============

Attached File(s)

Attach.txt (22.17K)
Number of downloads: 0
ark.txt (2.88K)
Number of downloads: 1

#2 oneof4

Forum Addict

Group: Malware Study Hall Senior
Posts: 2,466
Joined: 25-December 08
Gender:Male
Location:The Collective

Posted 05 June 2011 - 10:34 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Please take note:

If you have since resolved the original problem you were having, we would appreciate you letting us know.
If you are unable to create a log because your computer cannot start up successfully please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
- If you are unsure about any of these characteristics just post what you can and we will guide you.
Please tell us if you have your original Windows CD/DVD available.
If you are unable to perform the steps we have recommended please try one more time and if unsuccessful alert us of such and we will design an alternate means of obtaining the necessary information.
If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.
Upon completing the steps below another staff member will review your topic an do their best to resolve your issues.
If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan again:

Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
- DDS.scr
- DDS.pif
Double click on the DDS icon, allow it to run.
A small box will open, with an explanation about the tool. No input is needed, the scan is running.
Notepad will open with the results.
Follow the instructions that pop up for posting the results.
Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log

Thanks and again sorry for the delay.

Best Regards,
oneof4.

#3 tmyers85

New Member

Group: Members
Posts: 6
Joined: 10-December 10

Posted 09 June 2011 - 11:15 AM

Thanks for the reply, I had almost given up hope. I haven't done anything different except for running routine malwarebytes scan, which haven't come up with anything. I am still getting search redirects, but the blocked startup program has stopped. I do not have any of the windows cds.

.
DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_25
Run by Tom at 10:07:53 on 2011-06-09
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.1007 [GMT -5:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\TOSHIBA\IVP\ISM\pinger.exe
C:\Windows\System32\ctfmon.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\taskeng.exe
C:\Users\Tom\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Tom\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Tom\Desktop\dds.scr
C:\Windows\system32\WSCRIPT.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
mDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart
uInternet Settings,ProxyOverride = <local>
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPStart] c:\program files\synaptics\syntp\SynTPStart.exe
mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab
DPF: {474F00F5-3853-492C-AC3A-476512BBC336} - hxxp://picasaweb.google.com/s/v/52.07/uploader2.cab
DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game04.zylom.com/activex/zylomgamesplayer.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} - hxxp://zone.msn.com/bingame/feed/default/SproutLauncher.cab
DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\tom\appdata\roaming\mozilla\firefox\profiles\gbevhbb8.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=
FF - prefs.js: network.proxy.type - 0
FF - component: c:\program files\common files\spigot\wtxpcom\components\WidgiToolbarFF.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\program files\windows media player\np_plugin.dll
FF - plugin: c:\users\tom\appdata\local\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\users\tom\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\users\tom\appdata\roaming\move networks\plugins\npqmp071505000010.dll
FF - plugin: c:\users\tom\appdata\roaming\move networks\plugins\npqmp071505000011.dll
FF - plugin: c:\users\tom\appdata\roaming\move networks\plugins\npqmp071701000002.dll
FF - plugin: c:\users\tom\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\tom\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKsl0b303dde;MpKsl0b303dde;c:\programdata\microsoft\microsoft antimalware\definition updates\{8652c343-d8e6-42e9-9cb6-67cf0ddbaf08}\MpKsl0b303dde.sys [2011-6-8 28752]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2010-7-9 21504]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-1-17 24652]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2007-11-12 7168]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
R3 NETw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2010-1-25 6628352]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-10-28 133104]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-10-28 133104]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
.
=============== Created Last 30 ================
.
2011-06-08 19:30:56 28752 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{8652c343-d8e6-42e9-9cb6-67cf0ddbaf08}\MpKsl0b303dde.sys
2011-06-08 19:29:41 6962000 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{8652c343-d8e6-42e9-9cb6-67cf0ddbaf08}\mpengine.dll
2011-05-22 04:59:58 -------- d-----w- c:\users\tom\appdata\roaming\Unity
2011-05-22 04:26:49 -------- d-----w- c:\users\tom\appdata\local\Unity
2011-05-20 15:15:23 439632 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll
2011-05-20 15:15:12 439632 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{7af3124f-e186-4e4c-85c9-d980134e2a7b}\gapaengine.dll
2011-05-19 15:44:23 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-15 23:12:51 -------- d-----w- c:\users\tom\appdata\local\{C8C75093-1BC9-4455-8806-5EEC21DDC75C}
2011-05-15 23:10:45 -------- d-----w- c:\programdata\oF06509DfElE06509
2011-05-10 21:40:01 6962000 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
.
==================== Find3M ====================
.
2011-04-17 00:35:12 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-04-17 00:32:54 4096 ----a-w- c:\windows\system32\drivers\en-us\dxgkrnl.sys.mui
2011-04-17 00:32:52 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2011-04-17 00:32:52 252928 ----a-w- c:\windows\system32\dxdiag.exe
2011-04-17 00:32:52 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2011-04-17 00:32:51 519680 ----a-w- c:\windows\system32\d3d11.dll
2011-04-17 00:32:50 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2011-04-17 00:32:50 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-04-17 00:32:50 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-04-14 10:07:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-12 21:55:52 876032 ----a-w- c:\windows\system32\XpsPrint.dll
.
============= FINISH: 10:08:43.53 ===============

Attached File(s)

ark.txt (2.15K)
Number of downloads: 2
Attach.txt (9.6K)
Number of downloads: 0

#4 snemelk

inżynier

Group: Malware Response Team
Posts: 1,368
Joined: 26-February 08

Posted 10 June 2011 - 10:08 AM

Hi tmyers85, and welcome to Bleeping Computer.

Download OTL.exe by OldTimer to your Desktop.

Close all windows and double click OTL.exe.
In the "Custom Scans/Fixes" window (under the light green bar) paste the following in bold:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click Run Scan and let the program run uninterrupted.
When the scan completes, it will open two Notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL. Post both logs in this thread.
You may need to use two posts to get it all.

snemelk.hekko.pl - my site with a few computer security tips...
Silesia - that's where I live!
"If I had some duct tape, I could fix that." - MacGyver

#5 tmyers85

New Member

Group: Members
Posts: 6
Joined: 10-December 10

Posted 11 June 2011 - 07:14 PM

Thank you for the reply. I am out of town so it may take a few days for me to get that step done. Thanks again.

#6 snemelk

inżynier

Group: Malware Response Team
Posts: 1,368
Joined: 26-February 08

Posted 12 June 2011 - 03:27 PM

No problem, post the logs when ready!..

snemelk.hekko.pl - my site with a few computer security tips...
Silesia - that's where I live!
"If I had some duct tape, I could fix that." - MacGyver

#7 tmyers85

New Member

Group: Members
Posts: 6
Joined: 10-December 10

Posted 13 June 2011 - 03:14 PM

Here are the two logs you requested.

OTL logfile created on: 6/13/2011 2:58:48 PM - Run 1
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Tom\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.07 Gb Available Physical Memory | 53.98% Memory free
3.88 Gb Paging File | 2.86 Gb Available in Paging File | 73.81% Paging File free
Paging file location(s): c:\pagefile.sys 2000 3100 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 184.84 Gb Total Space | 94.75 Gb Free Space | 51.26% Space Free | Partition Type: NTFS

Computer Name: TOMS-COMPUTER | User Name: Tom | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/13 14:56:57 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Tom\Desktop\OTL.exe
PRC - [2010/11/30 13:20:36 | 000,997,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2010/11/11 12:26:42 | 000,226,984 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe
PRC - [2010/11/11 12:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
PRC - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2009/04/10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2007/10/23 19:27:16 | 000,066,928 | ---- | M] () -- c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
PRC - [2007/09/19 14:01:12 | 000,077,824 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
PRC - [2007/08/15 18:31:50 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPStart.exe
PRC - [2007/05/22 19:32:52 | 000,538,744 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
PRC - [2007/04/25 14:14:16 | 004,444,160 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/03/29 13:39:20 | 000,427,576 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
PRC - [2007/03/29 13:39:18 | 000,411,192 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
PRC - [2007/01/25 21:47:50 | 000,136,816 | ---- | M] () -- C:\TOSHIBA\IVP\ISM\pinger.exe
PRC - [2007/01/04 16:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2006/11/14 23:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
PRC - [2006/10/05 15:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
PRC - [2006/05/25 21:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe

========== Modules (SafeList) ==========

MOD - [2011/06/13 14:56:57 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Tom\Desktop\OTL.exe
MOD - [2010/08/31 10:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/11/11 12:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/03/14 00:33:48 | 000,488,960 | ---- | M] (Crawler.com) [On_Demand | Stopped] -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2007/10/23 19:27:16 | 000,066,928 | ---- | M] () [Auto | Running] -- c:\TOSHIBA\IVP\swupdate\swupdtmr.exe -- (Swupdtmr)
SRV - [2007/09/19 14:01:12 | 000,077,824 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv)
SRV - [2007/03/29 13:39:20 | 000,427,576 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV - [2007/02/26 00:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) [On_Demand | Stopped] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2007/01/25 21:47:50 | 000,136,816 | ---- | M] () [Auto | Running] -- C:\TOSHIBA\IVP\ISM\pinger.exe -- (pinger)
SRV - [2007/01/04 16:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)
SRV - [2006/11/14 23:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2006/10/05 15:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2006/08/23 19:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2006/05/25 21:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)

========== Driver Services (SafeList) ==========

DRV - [2011/06/10 18:43:47 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{833CD8C0-3CF3-4C24-9885-2819BB9DFB26}\MpKsl37ffbfa1.sys -- (MpKsl37ffbfa1)
DRV - [2010/10/24 21:25:38 | 000,054,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2010/10/24 21:25:38 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2010/05/10 13:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 13:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010/01/13 11:29:54 | 006,628,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel®
DRV - [2008/11/11 13:42:00 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008/11/11 13:41:00 | 000,019,968 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008/11/11 13:41:00 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2008/05/12 10:40:19 | 000,008,413 | ---- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\mcstrm.sys -- (MCSTRM)
DRV - [2008/02/20 14:47:34 | 000,027,936 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tbhsd.sys -- (tbhsd)
DRV - [2007/11/09 05:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)
DRV - [2007/09/19 13:59:12 | 000,285,184 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\tos_sps32.sys -- (tos_sps32)
DRV - [2007/04/27 07:09:38 | 002,216,448 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel®
DRV - [2007/04/16 13:19:10 | 000,011,776 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR)
DRV - [2007/03/22 13:57:14 | 000,028,672 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\elagopro.sys -- (elagopro)
DRV - [2007/03/22 13:57:14 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\elaunidr.sys -- (elaunidr)
DRV - [2007/01/24 17:44:06 | 000,290,304 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21)
DRV - [2006/11/28 18:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006/11/20 01:11:14 | 000,007,168 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FwLnk.sys -- (FwLnk)
DRV - [2006/11/09 01:32:00 | 000,219,264 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10i.sys -- (KR10I)
DRV - [2006/11/09 01:31:00 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10n.sys -- (KR10N)
DRV - [2006/10/18 14:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV - [2006/09/27 07:06:00 | 000,479,488 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr3npxp.sys -- (KR3NPXP)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:7
FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p="
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/02 15:17:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/27 10:42:59 | 000,000,000 | ---D | M]

[2009/01/06 11:55:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tom\AppData\Roaming\Mozilla\Extensions
[2011/05/24 00:31:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\gbevhbb8.default\extensions
[2010/10/09 08:59:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\gbevhbb8.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/05/24 12:16:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/11 09:48:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/19 22:43:30 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011/05/24 12:16:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
File not found (No name found) --
[2011/02/09 14:33:15 | 000,000,000 | ---D | M] (Widgi Toolbar Platform) -- C:\PROGRAM FILES\COMMON FILES\SPIGOT\WTXPCOM
[2011/05/15 18:12:51 | 000,000,000 | ---D | M] (XULRunner) -- C:\USERS\TOM\APPDATA\LOCAL\{C8C75093-1BC9-4455-8806-5EEC21DDC75C}
[2011/05/27 14:25:32 | 000,000,000 | ---D | M] (Move Media Player) -- C:\USERS\TOM\APPDATA\ROAMING\MOVE NETWORKS
() (No name found) -- C:\USERS\TOM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GBEVHBB8.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI
[2011/05/02 15:17:15 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/04/14 05:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/25 21:50:23 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
[2010/01/01 03:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,736 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: ::1 localhost
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10q_Plugin.exe (Adobe Systems, Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} http://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB (PogoWebLauncher Control)
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} http://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab (Windows Live OneCare safety scanner control)
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} http://picasaweb.google.com/s/v/52.07/uploader2.cab (UploadListView Class)
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} http://upload.facebook.com/controls/FacebookPhotoUploader3.cab (Reg Error: Key error.)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://game04.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} http://zone.msn.com/bingame/feed/default/SproutLauncher.cab (SproutLauncherCtrl Class)
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab (Facebook Photo Uploader 4)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Tom\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Tom\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{001dc1b6-c28c-11dd-9613-00a0d1916f6b}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
O33 - MountPoints2\{001dc1b6-c28c-11dd-9613-00a0d1916f6b}\Shell\open\command - "" = E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
O33 - MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\Shell\AutoRun\command - "" = E:\Autorun.exe /run
O33 - MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\Shell\Shell00\Command - "" = E:\Autorun.exe /run
O33 - MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\Shell\Shell01\Command - "" = E:\Autorun.exe /action
O33 - MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\Shell\Shell02\Command - "" = E:\Autorun.exe /uninstall
O33 - MountPoints2\{4cfcd365-2f12-11df-80fd-001de04c5bb9}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O33 - MountPoints2\{91c5bd70-16c9-11df-9a30-00a0d1916f6b}\Shell - "" = AutoRun
O33 - MountPoints2\{91c5bd70-16c9-11df-9a30-00a0d1916f6b}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{cdccbf55-441b-11df-bf00-00a0d1916f6b}\Shell\AutoRun\command - "" = F:\Setup_FlipShare.exe
O33 - MountPoints2\{cdccbf55-441b-11df-bf00-00a0d1916f6b}\Shell\Setup FlipShare\command - "" = F:\Setup_FlipShare.exe
O33 - MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\Shell\AutoRun\command - "" = E:\Autorun.exe /run
O33 - MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\Shell\Shell00\Command - "" = E:\Autorun.exe /run
O33 - MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\Shell\Shell01\Command - "" = E:\Autorun.exe /action
O33 - MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\Shell\Shell02\Command - "" = E:\Autorun.exe /uninstall
O33 - MountPoints2\E\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\vio\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codec - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/06/13 14:56:51 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Tom\Desktop\OTL.exe
[2011/06/01 10:49:47 | 000,000,000 | ---D | C] -- C:\Users\Tom\Desktop\Megan Scholarship stuff
[2011/05/25 12:32:05 | 000,000,000 | ---D | C] -- C:\Users\Tom\Desktop\gmer
[2011/05/24 12:16:13 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2011/05/24 12:16:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2011/05/24 12:16:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2011/05/23 00:41:43 | 000,606,738 | R--- | C] (Swearware) -- C:\Users\Tom\Desktop\dds.scr
[2011/05/21 23:59:58 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Roaming\Unity
[2011/05/21 23:26:49 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\Unity
[2011/05/19 10:44:23 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/05/15 18:12:51 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\{C8C75093-1BC9-4455-8806-5EEC21DDC75C}
[2011/05/15 18:10:45 | 000,000,000 | ---D | C] -- C:\ProgramData\oF06509DfElE06509
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/13 14:56:57 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Tom\Desktop\OTL.exe
[2011/06/13 14:55:47 | 000,000,876 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/13 14:53:00 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/13 14:50:18 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2196673572-3011006676-317100187-1000UA.job
[2011/06/13 14:50:14 | 000,000,848 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2196673572-3011006676-317100187-1000Core.job
[2011/06/13 14:50:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/06/13 14:50:09 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/13 14:50:09 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/10 18:43:48 | 000,000,308 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2011/06/10 18:43:30 | 2137,415,680 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/09 10:10:48 | 000,000,000 | ---- | M] () -- C:\Users\Tom\defogger_reenable
[2011/06/06 19:21:02 | 000,002,611 | ---- | M] () -- C:\Users\Tom\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007.lnk
[2011/05/24 00:32:22 | 000,001,356 | ---- | M] () -- C:\Users\Tom\AppData\Local\d3d9caps.dat
[2011/05/23 14:21:35 | 000,322,672 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/05/23 00:43:46 | 000,293,775 | ---- | M] () -- C:\Users\Tom\Desktop\gmer.zip
[2011/05/23 00:41:43 | 000,606,738 | R--- | M] (Swearware) -- C:\Users\Tom\Desktop\dds.scr
[2011/05/23 00:40:33 | 000,050,477 | ---- | M] () -- C:\Users\Tom\Desktop\Defogger.exe
[2011/05/19 11:25:14 | 000,000,877 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/19 10:44:23 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/05/17 15:52:48 | 000,013,724 | -HS- | M] () -- C:\ProgramData\c25v536q0haag77cku307l2142ma5s
[2011/05/17 15:52:47 | 000,013,724 | -HS- | M] () -- C:\Users\Tom\AppData\Local\c25v536q0haag77cku307l2142ma5s
[2011/05/16 14:52:59 | 000,597,784 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/05/16 14:52:59 | 000,102,350 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/05/15 20:02:12 | 000,008,132 | -HS- | M] () -- C:\ProgramData\503un8db1411b5g2wg6o2oiix4u16cj
[2011/05/15 20:02:11 | 000,008,132 | -HS- | M] () -- C:\Users\Tom\AppData\Local\503un8db1411b5g2wg6o2oiix4u16cj
[2011/05/15 18:12:53 | 000,000,120 | ---- | M] () -- C:\Users\Tom\AppData\Local\Ilagofowacehe.dat
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/09 10:10:48 | 000,000,000 | ---- | C] () -- C:\Users\Tom\defogger_reenable
[2011/05/24 10:59:49 | 2137,415,680 | -HS- | C] () -- C:\hiberfil.sys
[2011/05/23 00:43:49 | 000,293,775 | ---- | C] () -- C:\Users\Tom\Desktop\gmer.zip
[2011/05/23 00:40:37 | 000,050,477 | ---- | C] () -- C:\Users\Tom\Desktop\Defogger.exe
[2011/05/19 10:02:29 | 000,000,877 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/17 14:40:14 | 000,013,724 | -HS- | C] () -- C:\Users\Tom\AppData\Local\c25v536q0haag77cku307l2142ma5s
[2011/05/17 14:40:14 | 000,013,724 | -HS- | C] () -- C:\ProgramData\c25v536q0haag77cku307l2142ma5s
[2011/05/15 19:29:14 | 000,008,132 | -HS- | C] () -- C:\Users\Tom\AppData\Local\503un8db1411b5g2wg6o2oiix4u16cj
[2011/05/15 19:29:14 | 000,008,132 | -HS- | C] () -- C:\ProgramData\503un8db1411b5g2wg6o2oiix4u16cj
[2011/05/15 18:12:53 | 000,000,120 | ---- | C] () -- C:\Users\Tom\AppData\Local\Ilagofowacehe.dat
[2011/04/21 08:45:26 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011/04/20 11:07:18 | 000,008,490 | -HS- | C] () -- C:\Users\Tom\AppData\Local\u583lc6udh7ii85kd17e5
[2011/04/20 11:07:18 | 000,008,490 | -HS- | C] () -- C:\ProgramData\u583lc6udh7ii85kd17e5
[2011/02/09 14:32:24 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010/12/05 18:37:45 | 000,131,584 | ---- | C] () -- C:\Windows\System32\SpoonUninstall.exe
[2010/12/05 18:37:45 | 000,041,647 | ---- | C] () -- C:\Windows\System32\SpoonUninstall-DDXL Student.dat
[2010/07/10 00:03:31 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/07/10 00:02:23 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010/07/10 00:02:23 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010/05/10 19:54:38 | 000,188,836 | ---- | C] () -- C:\Windows\hpwins22.dat
[2010/05/10 19:54:38 | 000,002,979 | ---- | C] () -- C:\Windows\hpwmdl22.dat
[2010/03/27 23:08:15 | 000,009,822 | -HS- | C] () -- C:\Users\Tom\AppData\Local\FWQQE
[2010/03/27 23:08:15 | 000,009,822 | -HS- | C] () -- C:\ProgramData\FWQQE
[2010/03/14 18:10:54 | 000,000,036 | ---- | C] () -- C:\Users\Tom\AppData\Local\housecall.guid.cache
[2010/03/14 00:33:45 | 000,142,592 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2010/03/13 21:13:11 | 000,008,354 | -HS- | C] () -- C:\Users\Tom\AppData\Local\Ce7km4
[2009/10/12 20:12:34 | 000,554,496 | ---- | C] () -- C:\Windows\System32\dvmsg.dll
[2009/10/11 14:59:27 | 000,000,467 | ---- | C] () -- C:\Windows\topocr.INI
[2009/08/20 19:53:37 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/07/28 02:25:36 | 000,001,356 | ---- | C] () -- C:\Users\Tom\AppData\Local\d3d9caps.dat
[2009/07/20 01:10:09 | 000,024,206 | ---- | C] () -- C:\Users\Tom\AppData\Roaming\UserTile.png
[2009/04/20 23:11:58 | 000,148,954 | ---- | C] () -- C:\Windows\hpoins19.dat
[2009/04/20 23:10:55 | 000,026,952 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2009/01/05 15:44:10 | 000,053,248 | ---- | C] () -- C:\Windows\bdoscandel.exe
[2009/01/05 15:44:10 | 000,000,453 | ---- | C] () -- C:\Windows\bdoscandellang.ini
[2008/03/16 20:53:04 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2008/02/27 22:15:09 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008/02/27 21:52:54 | 000,139,008 | ---- | C] () -- C:\Windows\System32\guard32.dll
[2008/02/03 22:52:43 | 000,055,808 | ---- | C] () -- C:\Users\Tom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/01/16 22:19:59 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2008/01/16 22:11:54 | 000,000,067 | ---- | C] () -- C:\Windows\swupdate.INI
[2007/12/05 22:42:49 | 000,000,005 | RHS- | C] () -- C:\Windows\System32\drivers\taishop.sys
[2007/11/13 09:29:21 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2007/11/12 19:27:16 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2007/11/12 19:27:16 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2007/11/12 19:27:16 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2007/11/12 19:27:16 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2007/11/12 19:27:16 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2007/11/12 19:27:16 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2007/11/12 18:41:22 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
[2007/11/12 18:41:22 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
[2007/11/12 18:41:22 | 000,010,150 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
[2007/11/12 18:41:22 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
[2007/11/12 18:34:58 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ3.dat
[2007/11/12 18:34:58 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ2.dat
[2007/11/12 18:34:58 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat
[2007/11/12 18:34:58 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat
[2007/09/13 18:31:06 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1329.dll
[2007/09/13 18:22:46 | 001,238,832 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2007/09/13 18:22:46 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll
[2007/09/13 18:11:18 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2007/04/24 13:22:02 | 000,274,432 | ---- | C] () -- C:\Windows\System32\MFT_anet.dll
[2007/03/06 19:54:04 | 000,995,328 | ---- | C] () -- C:\Windows\System32\WLIHVUI.dll
[2006/12/05 16:05:04 | 000,114,688 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll
[2006/11/02 07:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,322,672 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,597,784 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,102,350 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 05:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/03/09 13:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2005/07/23 00:30:18 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 16:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/04/10 23:36:38 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2007/11/12 16:47:58 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2006/09/18 16:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2011/06/10 18:43:30 | 2137,415,680 | -HS- | M] () -- C:\hiberfil.sys
[2010/06/30 13:32:47 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2008/01/17 21:32:09 | 000,000,429 | -H-- | M] () -- C:\IPH.PH
[2008/05/13 22:14:47 | 000,000,273 | ---- | M] () -- C:\Log.txt
[2010/06/30 13:32:47 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/06/10 18:43:28 | 2097,152,000 | -HS- | M] () -- C:\pagefile.sys
[2010/06/30 20:21:09 | 000,000,348 | ---- | M] () -- C:\rkill.log
[2009/12/12 18:56:24 | 000,000,937 | ---- | M] () -- C:\Wireless Network Connection-Mills.xml
[2008/01/21 16:05:42 | 000,004,972 | ---- | M] () -- C:\WirelessDiagLog.csv

< %systemroot%\*. /mp /s >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-26 17:27:51

< End of report >

OTL Extras logfile created on: 6/13/2011 2:58:48 PM - Run 1
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Tom\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.07 Gb Available Physical Memory | 53.98% Memory free
3.88 Gb Paging File | 2.86 Gb Available in Paging File | 73.81% Paging File free
Paging file location(s): c:\pagefile.sys 2000 3100 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 184.84 Gb Total Space | 94.75 Gb Free Space | 51.26% Space Free | Partition Type: NTFS

Computer Name: TOMS-COMPUTER | User Name: Tom | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\TOSHIBA\ivp\NetInt\Netint.exe" = C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine -- (TOSHIBA Corporation)
"C:\TOSHIBA\Ivp\ISM\pinger.exe" = C:\TOSHIBA\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger -- ()

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01829674-2672-479F-A722-1AAAA9D34DBB}" = lport=2869 | protocol=6 | dir=in | app=system |
"{05A78102-3CBF-448B-9994-C94B9C21581B}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\netproj.exe |
"{17ED79D9-5878-47CE-BF85-74E4580F4776}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{2909936B-3CDF-4E8D-B772-B6367BD81D52}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{2A0FC61A-F0E0-4C39-854E-4C7A06CEFBE2}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{2F70D10D-6FC4-4348-9EBF-9A7D5BDFFFC9}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{3249C741-10EC-46AE-B7E0-26149711EE20}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{32B16C20-B3E5-4B6E-AEE7-AC3DD988D3D5}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{370F7DF9-1C76-44C7-AFBC-33EC1A3089C2}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{38C8629B-ECDD-4623-B4E0-44CAF3EB8252}" = rport=5357 | protocol=6 | dir=out | app=system |
"{3A895F6E-E17E-40AF-8014-C5DF6753ED21}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{43A9F5C5-63C4-4574-BDA0-E34B00D0D035}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\netproj.exe |
"{4F74E268-6049-403A-BDE0-A7C82A233EF3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5CDD12A1-C214-46B6-9C3A-16C2BADE2E2D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5E84BAA5-43E9-4FCF-9B65-31A8940B6B4A}" = rport=5358 | protocol=6 | dir=out | app=system |
"{5EF09E6A-5613-4D22-A04C-63066DCEB6CB}" = lport=5357 | protocol=6 | dir=in | app=system |
"{610EBF67-FE96-4457-8BFA-1C4D547500CA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{65AEB5FC-5F34-4E39-9096-0EC611CE8380}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{713BF6BB-4CF3-45F0-9AA8-C4731C9A84B4}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{7DAE7E53-27EF-4A92-975A-5337F6585132}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{85C9BA39-BC6A-41EE-A690-23D7BFB1F787}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\netproj.exe |
"{875F1A64-6111-4170-AC41-C2871E0669D3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8A376BD2-B38F-47B0-9C25-A087BB8A7F04}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\netproj.exe |
"{8B4931DB-1FF4-4E55-A140-CDE4CECFA62F}" = lport=10243 | protocol=6 | dir=in | app=system |
"{8CCA36FF-9185-492F-B850-7FC28983E418}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{93526A3B-24FE-4042-87FA-9175749FD775}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9C91ED65-8A7D-4CAB-9C24-9683D85F1B67}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{9CEFBD88-D633-4D36-9DEF-E8F00127EF73}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{9CEFE23B-EED7-4EA6-A99C-D934B17FE669}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{A37B5C96-5BAF-436E-98F6-741517D4A44C}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{B706C24B-5729-4BBF-8E8B-31A5EF9C9AAC}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{B7A297EF-784B-4ACC-B05D-23EC17C96642}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{B8950D34-3108-4064-9097-9F2E5ECDA77C}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |
"{BB0AA34D-224D-45B1-9254-CB3B26DF547F}" = lport=5358 | protocol=6 | dir=in | app=system |
"{C894A302-4833-4AB1-9D72-6CC0687A250E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{D61383E7-2730-472D-885B-7A5940514348}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{EB63DC18-C342-4D41-9B7A-A6C285EC28D6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F8E6F0BB-B416-4DEC-A5A0-C4C463B8D64F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{022400BC-6B24-4949-8C2A-FE70A54BD529}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{036B01AA-22AC-45A9-8F3E-6E7F221E187B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{0840A24E-F8F6-4B56-8821-ACB26344D202}" = protocol=17 | dir=in | app=c:\program files\tobit clipinc\server\clipinc-server.exe |
"{09BB8F66-BF89-411F-80D9-2FCE2F72F1EA}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{0BDD66CF-5413-4585-9C96-4ECED3019066}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{0F2F87F3-B6CC-4EB2-B3AE-AA329D2EE7C0}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{1272022D-F30E-41D6-95A2-03E2556598B5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{15B8D0D0-19EA-4B19-9771-FD03EC380347}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqnrs08.exe |
"{1C6ACDAE-D6E5-4839-826C-9BE93FE6CB4B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{22328271-B12D-4AC6-B139-F063452C2388}" = protocol=6 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"{23060AF1-C1E1-4D46-8BAA-CD755D53300E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{23C905DA-2F15-4952-A452-EF4C05C951A6}" = protocol=6 | dir=in | app=c:\program files\tobit clipinc\player\clipinc-player.exe |
"{248D9521-5586-4883-A59B-773496FA6CC8}" = protocol=6 | dir=out | app=%systemroot%\system32\netproj.exe |
"{250DD272-A092-47A3-BE2A-F03086DF8F01}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{27FD49EC-812B-41B3-AA7E-A354BD7AA719}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{2934A9D9-2D0F-4B37-AA1C-91C06056ED1C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpofxm08.exe |
"{32F4A4A6-43FF-42CA-821E-A33E2795967E}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{343CCCA4-A4BD-4F9C-8909-B8C39D7511E9}" = protocol=17 | dir=in | app=c:\program files\rapidsolution\tunebite\tunebitehelper.exe |
"{381A3FF9-DFEE-4C8F-BA71-C28951102F14}" = protocol=17 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"{40E2DD7A-5B46-4128-A3AD-5396807E17D9}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{41B95D9B-514F-47EE-A5EA-CC896CA534A3}" = protocol=6 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{4389151B-A621-4CB7-AAEB-447BE14C35D1}" = protocol=6 | dir=out | app=system |
"{47E16E8C-D0E1-4BAA-854F-686AED23603D}" = protocol=6 | dir=in | app=c:\program files\rapidsolution\tunebite\tunebitehelper.exe |
"{516E0F1C-43BB-4552-BD7A-FD50FF8126A4}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{52C79278-FFF2-4F58-A967-129A837685F5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpzwiz01.exe |
"{5CA96E53-1718-430A-8692-A6D3E54563DD}" = protocol=6 | dir=in | app=c:\users\tom\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{6418E0B9-6209-445C-84D6-2B2E8E1E0F9F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{648B173F-658E-46CC-A0D1-9169C1FF5D83}" = protocol=6 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"{69B3F2A1-851B-4937-921F-6B83908058C4}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{72E9DA56-C747-4A10-8CDB-315A5353F209}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{73644188-4C79-4BBC-89EB-64A8F3F924E0}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{7364D751-AA97-4A10-966E-B45E1221B54B}" = protocol=6 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{73854637-03C7-4C04-A99A-17FA8C6B9D65}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{747CCFBC-9655-42BC-BDB1-02729E404040}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7650C983-453B-4427-9B2D-5CEA5EC2F559}" = dir=in | app=d:\setup\hpznui01.exe |
"{768A50EC-73C8-41BB-AE0A-1801EB58F561}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{79615FE1-2958-4C10-AB9F-E81C5E25D856}" = protocol=17 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"{7A71C626-1397-4D4E-A830-1B39F4049D53}" = protocol=6 | dir=in | app=%systemroot%\system32\netproj.exe |
"{7F9C4497-055E-497E-98BD-EDC066732292}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposfx08.exe |
"{82A9C478-C0E2-4FE2-B530-352A644D2C9F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8805CF5E-4190-4FBC-AE49-1A57B5083410}" = protocol=17 | dir=in | app=c:\users\tom\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{88B18C1E-B810-4536-8C2C-D09AF988D67F}" = protocol=6 | dir=in | app=c:\program files\tobit clipinc\server\clipinc-server.exe |
"{8F2C17CF-8E9E-4119-B867-88A19E2DAEAC}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{93E80BD6-C12C-47B3-BDED-5509D0E4A61D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9586E136-25B4-43C9-92F4-C4545C297954}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{964A065B-E691-40AE-A5AD-4FFEEA31E04E}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{A4BF3B23-0E97-4979-A0D9-46728731FE6F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{A5D7F079-D3B7-49D1-8047-248A46015853}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A8D262E3-AFAC-4C06-B84B-B9C93725861A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AFB37DD8-46A3-4B21-BCE9-3B83CD7A3955}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{B5887D31-1655-4DB4-85AD-1724FA843388}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B6419696-3CAD-456D-8246-9CD46617735A}" = protocol=17 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{B68BF229-0BD7-498F-B13A-BE48F48B46A0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C006F634-BA98-41FE-BB45-98804F4EAA36}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C16376C4-1F79-4FC8-8B42-7A25072CECAE}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{C5B94495-B8E3-42F6-9EE8-748D70E8C84A}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D21805C9-3B4A-4C03-9163-E2B67C9D4554}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{DDCF20FF-3A59-4998-87B9-E5C6D06F4F3D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E2945C49-406B-401E-93C0-BB5C10DAC1D5}" = protocol=17 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{ED05E015-3285-490E-9E3E-A6E3552044D4}" = protocol=17 | dir=in | app=c:\program files\tobit clipinc\player\clipinc-player.exe |
"{F3D429CE-08D0-4245-B9D5-A36FD773078A}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{F454D91E-7596-480C-ADB7-818A7825EA58}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{F97F5B01-2862-419B-91F8-B39BE451D7ED}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{FCA42188-FA45-4853-A91B-752BD2F004DC}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"TCP Query User{07F9E387-1287-4796-9076-2E686CE9ED18}C:\program files\orbitdownloader\orbitnet.exe" = protocol=6 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"TCP Query User{1E677E60-8E25-4A13-BEA7-CDC446A49C17}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=6 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"TCP Query User{28D7ACD9-6D53-4074-9527-CACC2D4B4D95}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{2DE639B9-1D3B-4F82-B81F-37F4A9D41FF6}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{3D305392-EED5-445A-8A9C-B4007987A92B}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{53AD768A-FC9C-43E3-8D9C-71481691B261}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{8424FBEF-3CA7-4596-9740-E7EA0FF39EE2}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{86C29660-83AC-4F5D-B6E6-54D3099F3A3D}C:\program files\boxee\boxee.exe" = protocol=6 | dir=in | app=c:\program files\boxee\boxee.exe |
"TCP Query User{BEBAADF0-2C83-4909-AE58-39399AB902CD}C:\program files\camfrog\camfrog video chat\camfrog video chat.exe" = protocol=6 | dir=in | app=c:\program files\camfrog\camfrog video chat\camfrog video chat.exe |
"TCP Query User{DE7C5D77-271B-48D8-8BA4-B1F46F78286E}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{F60DE94C-F6FB-4156-BD27-8DEB79956E89}C:\program files\rhapsody\rhapsody.exe" = protocol=6 | dir=in | app=c:\program files\rhapsody\rhapsody.exe |
"UDP Query User{0F44122F-AF6D-4EDB-AC06-454F04FEDE1A}C:\program files\rhapsody\rhapsody.exe" = protocol=17 | dir=in | app=c:\program files\rhapsody\rhapsody.exe |
"UDP Query User{1EE54358-1578-419D-A143-CEB122B8EC2D}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{451127E8-3F67-4623-9668-1593163A1219}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{630DF87E-6BAC-46B3-82AE-5B5F6125E533}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{6C3D7676-4902-4EF7-9BD1-A4B8BA2C6C1B}C:\program files\camfrog\camfrog video chat\camfrog video chat.exe" = protocol=17 | dir=in | app=c:\program files\camfrog\camfrog video chat\camfrog video chat.exe |
"UDP Query User{73746ABE-CD09-4997-8019-6DA9E9DE8B2F}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{7395E476-7092-4F0A-A672-D52201DC3978}C:\program files\boxee\boxee.exe" = protocol=17 | dir=in | app=c:\program files\boxee\boxee.exe |
"UDP Query User{87E39774-5F86-48BB-8DB4-117CAAE207FA}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{920643BA-3B0D-4DFE-A34D-C1440987B068}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=17 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"UDP Query User{A6BCD498-DF74-43F2-A127-47F019B8E4B4}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{E9ED1F82-F571-474C-900C-37F3B95D669A}C:\program files\orbitdownloader\orbitnet.exe" = protocol=17 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{005F78AF-110D-398A-8430-BE98950A1E22}" = Google Talk Plugin
"{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
"{03A7C57A-B2C8-409b-92E5-524A0DFD0DD3}" = Status
"{087A66B8-1F0F-4a8d-A649-0CFE276AA7C0}" = WebReg
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{102CBC47-7FDE-4E6C-8A3A-67B79833FAC8}" = BPDSoftware_Ini
"{11B2F891-91C8-47ce-945A-A91003EA27FB}" = BPDSoftware
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{18AB082B-6584-4F74-8ABC-D5935CF46E4C}" = 8500A909_eDocs
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 25
"{2BDF38E0-1A7F-4220-B4B7-118DD45E5E13}" = TOSHIBA Supervisor Password
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
"{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
"{425A2BC2-AA64-4107-9C29-484245BBEA05}" = TOSHIBA Software Upgrades
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{432A850B-3558-4BFF-B1F9-30626835B523}" = BPD_DSWizards
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D304678-738E-42a0-931A-2B022F49DEB8}" = TrayApp
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{57F60D52-630B-43C5-BD20-176F5CD4EED6}" = bpd_scan
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5E6D6161-5509-4f55-9372-1E01792F843A}" = F300_Help
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{624E7452-BA43-4f55-B9D5-FC75EEA0808B}" = Officejet Pro 8500 A909 Series
"{6421F085-1FAA-DE13-D02A-CFB412C522A4}" = Acrobat.com
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
"{77A776C4-D10F-416D-88F0-53F2D9DCD9B3}" = Microsoft Security Client
"{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}" = TOSHIBA ConfigFree
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87A9A9A9-FAB7-4224-9328-0FA2058C0FD5}" = Network
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9CCCFD9C-248F-47FE-9496-1680E3E5C163}" = Scan
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A0B139A7-E8D5-49E8-A7BF-12421E652208}" = pdfforge Toolbar v4.3
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A1960A82-DB70-474D-A86B-FA74466103C6}" = Drivers Install For Linksys Easylink Advisor
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC13BA3A-336B-45a4-B3FE-2D3058A7B533}" = Toolbox
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.4
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B495547C-01F8-4836-A2E6-749B5F3EA691}" = 8500A909_Help
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{BE53BB2F-FD8F-48b9-AC90-207D0D8EE028}" = 8500A909a
"{BFC85CDC-BD7C-4FDD-9507-8D74B5A79404}" = TOSHIBA Hardware Setup
"{BFD96B89-B769-4CD6-B11E-E79FFD46F067}" = QuickTime
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{C53D16CC-E56F-47B8-906E-70AAF8EABB4F}" = Toshiba Registration
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DA8BF070-1358-4a30-A68F-21E0E9421AEF}" = ProductContext
"{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
"{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1568757-E564-4cb5-8980-9333119A4384}" = F300
"{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA
"{F5D7FAB5-A1FD-4DD3-983E-4155B09D7102}" = mCore
"{F6AC5364-2FB7-437a-811A-D645F22AA6AC}" = F300Trb
"{F769B78E-FF0E-4db5-95E2-9F4C8D6352FE}" = DeviceDiscovery
"{FA61D601-A0FC-48BD-AE7A-54946BCD7FB6}_is1" = BitPim 1.0.7
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"7-Zip" = 7-Zip 4.65
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
"CCleaner" = CCleaner
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"DDXL Student" = DDXL Student
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"EasyLinkAdvisor" = Linksys EasyLink Advisor 1.6 (0044)
"Glary Utilities_is1" = Glary Utilities 2.33.0.1158
"HDMI" = Intel® Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 12.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"ImgBurn" = ImgBurn
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaMonkey_is1" = MediaMonkey 3.2
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"MiniLyrics" = Minilyrics(remove only)
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"ProInst" = Intel® PROSet/Wireless Software
"Revo Uninstaller" = Revo Uninstaller 1.83
"Spyware Terminator_is1" = Spyware Terminator
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 1.1.7
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinGimp-2.0_is1" = GIMP 2.6.6

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager
"Move Media Player" = Move Media Player
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/21/2011 9:43:05 PM | Computer Name = Toms-Computer | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 5/21/2011 10:54:26 PM | Computer Name = Toms-Computer | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 5/21/2011 10:54:26 PM | Computer Name = Toms-Computer | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 5/21/2011 10:54:26 PM | Computer Name = Toms-Computer | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 5/21/2011 11:00:51 PM | Computer Name = Toms-Computer | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 5/21/2011 11:02:38 PM | Computer Name = Toms-Computer | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 5/21/2011 11:02:38 PM | Computer Name = Toms-Computer | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 5/22/2011 7:50:41 PM | Computer Name = Toms-Computer | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 5/22/2011 7:50:41 PM | Computer Name = Toms-Computer | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 5/22/2011 7:50:41 PM | Computer Name = Toms-Computer | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

[ Media Center Events ]
Error - 4/16/2008 2:48:34 PM | Computer Name = Toms-Computer | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 6/9/2008 7:57:02 AM | Computer Name = Toms-Computer | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 8/28/2008 9:08:49 AM | Computer Name = Toms-Computer | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 12/1/2008 10:46:42 PM | Computer Name = Toms-Computer | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 1/12/2009 8:59:46 PM | Computer Name = Toms-Computer | Source = MCUpdate | ID = 0
Description = Failed to wait on MCUpdate mutex with exception: 'The wait completed
due to an abandoned mutex.'.

Error - 3/22/2009 7:38:45 PM | Computer Name = Toms-Computer | Source = MCUpdate | ID = 0
Description = Failed to wait on MCUpdate mutex with exception: 'The wait completed
due to an abandoned mutex.'.

Error - 4/29/2009 10:20:55 PM | Computer Name = Toms-Computer | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 7/16/2010 10:52:49 AM | Computer Name = Toms-Computer | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerAccumulate failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

[ OSession Events ]
Error - 7/2/2008 6:33:45 PM | Computer Name = Toms-Computer | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 13, Application Name: Microsoft Office OneNote, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 191303
seconds with 600 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 6/11/2011 8:40:46 PM | Computer Name = Toms-Computer | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort2.

Error - 6/11/2011 8:40:46 PM | Computer Name = Toms-Computer | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort2.

Error - 6/11/2011 8:40:46 PM | Computer Name = Toms-Computer | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort2.

Error - 6/11/2011 8:40:46 PM | Computer Name = Toms-Computer | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort2.

Error - 6/11/2011 8:40:46 PM | Computer Name = Toms-Computer | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort2.

Error - 6/11/2011 8:40:46 PM | Computer Name = Toms-Computer | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort2.

Error - 6/11/2011 8:40:46 PM | Computer Name = Toms-Computer | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort2.

Error - 6/11/2011 8:40:46 PM | Computer Name = Toms-Computer | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort2.

Error - 6/11/2011 8:40:46 PM | Computer Name = Toms-Computer | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort2.

Error - 6/11/2011 11:03:16 PM | Computer Name = Toms-Computer | Source = bowser | ID = 8003
Description =

< End of report >

#8 snemelk

inżynier

Group: Malware Response Team
Posts: 1,368
Joined: 26-February 08

Posted 14 June 2011 - 04:01 PM

Hi again tmyers85!!..

Firstly,
Optional programs to remove (just decide if you want to keep them...):

- Viewpoint Media Player
Viewpoint Manager is considered as foistware instead of malware. It is installed on your computer without your permission. It is known to be intrusive and there is also some possibility that it is now being used by various companies to give them info about your habits.

I suggest you remove the program now.
Use Start -> Control Panel -> Programs and Features.

- Spyware Terminator - used to be listed as a rogue anti-spyware program (pretty long time ago, though), a vendor was involved in the distribution of adware (General consensus of Wilders veterans re:Spyware Terminator)... I suggest you uninstall this program - your choice...

- pdfforge Toolbar v4.3 - an adware toolbar, installed with PDFCreator - detected by Sophos, McAfee, Malwarebyte's Antimalware and others as "Adware.WidgiToolbar"... Looking over your log, it looks like it was already partially removed (that's why I included some leftovers associated with it in the script below)... I recommend you uninstall this product...

Secondly,
Please run OTL.exe.

Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:OTL
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"
FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p="
[2011/02/09 14:33:15 | 000,000,000 | ---D | M] (Widgi Toolbar Platform) -- C:\PROGRAM FILES\COMMON FILES\SPIGOT\WTXPCOM
[2011/05/15 18:12:51 | 000,000,000 | ---D | M] (XULRunner) -- C:\USERS\TOM\APPDATA\LOCAL\{C8C75093-1BC9-4455-8806-5EEC21DDC75C}
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O33 - MountPoints2\{001dc1b6-c28c-11dd-9613-00a0d1916f6b}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
O33 - MountPoints2\{001dc1b6-c28c-11dd-9613-00a0d1916f6b}\Shell\open\command - "" = E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
O33 - MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\Shell\AutoRun\command - "" = E:\Autorun.exe /run
O33 - MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\Shell\Shell00\Command - "" = E:\Autorun.exe /run
O33 - MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\Shell\Shell01\Command - "" = E:\Autorun.exe /action
O33 - MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\Shell\Shell02\Command - "" = E:\Autorun.exe /uninstall
O33 - MountPoints2\{4cfcd365-2f12-11df-80fd-001de04c5bb9}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O33 - MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\Shell\AutoRun\command - "" = E:\Autorun.exe /run
O33 - MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\Shell\Shell00\Command - "" = E:\Autorun.exe /run
O33 - MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\Shell\Shell01\Command - "" = E:\Autorun.exe /action
O33 - MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\Shell\Shell02\Command - "" = E:\Autorun.exe /uninstall
O33 - MountPoints2\E\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
[2011/05/15 18:12:51 | 000,000,000 | ---D | C] -- C:\Users\Tom\AppData\Local\{C8C75093-1BC9-4455-8806-5EEC21DDC75C}
[2011/05/15 18:10:45 | 000,000,000 | ---D | C] -- C:\ProgramData\oF06509DfElE06509
[2011/05/17 15:52:48 | 000,013,724 | -HS- | M] () -- C:\ProgramData\c25v536q0haag77cku307l2142ma5s
[2011/05/17 15:52:47 | 000,013,724 | -HS- | M] () -- C:\Users\Tom\AppData\Local\c25v536q0haag77cku307l2142ma5s
[2011/05/15 20:02:12 | 000,008,132 | -HS- | M] () -- C:\ProgramData\503un8db1411b5g2wg6o2oiix4u16cj
[2011/05/15 20:02:11 | 000,008,132 | -HS- | M] () -- C:\Users\Tom\AppData\Local\503un8db1411b5g2wg6o2oiix4u16cj
[2011/05/15 18:12:53 | 000,000,120 | ---- | M] () -- C:\Users\Tom\AppData\Local\Ilagofowacehe.dat
[2011/05/17 14:40:14 | 000,013,724 | -HS- | C] () -- C:\Users\Tom\AppData\Local\c25v536q0haag77cku307l2142ma5s
[2011/05/17 14:40:14 | 000,013,724 | -HS- | C] () -- C:\ProgramData\c25v536q0haag77cku307l2142ma5s
[2011/05/15 19:29:14 | 000,008,132 | -HS- | C] () -- C:\Users\Tom\AppData\Local\503un8db1411b5g2wg6o2oiix4u16cj
[2011/05/15 19:29:14 | 000,008,132 | -HS- | C] () -- C:\ProgramData\503un8db1411b5g2wg6o2oiix4u16cj
[2011/05/15 18:12:53 | 000,000,120 | ---- | C] () -- C:\Users\Tom\AppData\Local\Ilagofowacehe.dat
[2011/04/20 11:07:18 | 000,008,490 | -HS- | C] () -- C:\Users\Tom\AppData\Local\u583lc6udh7ii85kd17e5
[2011/04/20 11:07:18 | 000,008,490 | -HS- | C] () -- C:\ProgramData\u583lc6udh7ii85kd17e5
[2010/03/27 23:08:15 | 000,009,822 | -HS- | C] () -- C:\Users\Tom\AppData\Local\FWQQE
[2010/03/27 23:08:15 | 000,009,822 | -HS- | C] () -- C:\ProgramData\FWQQE
[2010/03/13 21:13:11 | 000,008,354 | -HS- | C] () -- C:\Users\Tom\AppData\Local\Ce7km4
:Commands
[EmptyTemp]
[EMPTYFLASH]
Return to OTL.exe, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
Click the red Run Fix button.
A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTL.exe

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Thirdly,

Download TDSSKiller.zip and extract TDSSKiller.exe to your Desktop.
Execute TDSSKiller.exe by doubleclicking on it.
Press Start Scan

If Malicious objects are found, ensure Cure is selected (it should be by default).
Click Continue then click Reboot now.
Once complete, a log will be produced at the root drive which is typically C:\

For example, C:\TDSSKiller.2.4.0.0_24.07.2010_13.10.52_log.txt
Please post that log here.

snemelk.hekko.pl - my site with a few computer security tips...
Silesia - that's where I live!
"If I had some duct tape, I could fix that." - MacGyver

#9 tmyers85

New Member

Group: Members
Posts: 6
Joined: 10-December 10

Posted 15 June 2011 - 06:26 PM

I uninstalled all the programs that you suggested and ran the two scans. Here are the logs. Thank you.

All processes killed
========== OTL ==========
Prefs.js: "chr-greentree_ff&type=827316" removed from browser.search.param.yahoo-fr
Prefs.js: wtxpcom@mybrowserbar.com:4.3 removed from extensions.enabledItems
Prefs.js: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=" removed from keyword.URL
Folder C:\PROGRAM FILES\COMMON FILES\SPIGOT\WTXPCOM\ not found.
C:\USERS\TOM\APPDATA\LOCAL\{C8C75093-1BC9-4455-8806-5EEC21DDC75C}\chrome\content folder moved successfully.
C:\USERS\TOM\APPDATA\LOCAL\{C8C75093-1BC9-4455-8806-5EEC21DDC75C}\chrome folder moved successfully.
C:\USERS\TOM\APPDATA\LOCAL\{C8C75093-1BC9-4455-8806-5EEC21DDC75C} folder moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{001dc1b6-c28c-11dd-9613-00a0d1916f6b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{001dc1b6-c28c-11dd-9613-00a0d1916f6b}\ not found.
File E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{001dc1b6-c28c-11dd-9613-00a0d1916f6b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{001dc1b6-c28c-11dd-9613-00a0d1916f6b}\ not found.
File E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\ not found.
File E:\Autorun.exe /run not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\ not found.
File E:\Autorun.exe /run not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\ not found.
File E:\Autorun.exe /action not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40b49e7c-c0b9-11dc-8edc-00a0d1916f6b}\ not found.
File E:\Autorun.exe /uninstall not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4cfcd365-2f12-11df-80fd-001de04c5bb9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4cfcd365-2f12-11df-80fd-001de04c5bb9}\ not found.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\ not found.
File E:\Autorun.exe /run not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\ not found.
File E:\Autorun.exe /run not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\ not found.
File E:\Autorun.exe /action not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{df44c6b9-51a2-11dd-b9de-00a0d1916f6b}\ not found.
File E:\Autorun.exe /uninstall not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe not found.
Folder C:\Users\Tom\AppData\Local\{C8C75093-1BC9-4455-8806-5EEC21DDC75C}\ not found.
Folder C:\ProgramData\oF06509DfElE06509\ not found.
C:\ProgramData\c25v536q0haag77cku307l2142ma5s moved successfully.
C:\Users\Tom\AppData\Local\c25v536q0haag77cku307l2142ma5s moved successfully.
C:\ProgramData\503un8db1411b5g2wg6o2oiix4u16cj moved successfully.
C:\Users\Tom\AppData\Local\503un8db1411b5g2wg6o2oiix4u16cj moved successfully.
C:\Users\Tom\AppData\Local\Ilagofowacehe.dat moved successfully.
File C:\Users\Tom\AppData\Local\c25v536q0haag77cku307l2142ma5s not found.
File C:\ProgramData\c25v536q0haag77cku307l2142ma5s not found.
File C:\Users\Tom\AppData\Local\503un8db1411b5g2wg6o2oiix4u16cj not found.
File C:\ProgramData\503un8db1411b5g2wg6o2oiix4u16cj not found.
File C:\Users\Tom\AppData\Local\Ilagofowacehe.dat not found.
C:\Users\Tom\AppData\Local\u583lc6udh7ii85kd17e5 moved successfully.
C:\ProgramData\u583lc6udh7ii85kd17e5 moved successfully.
C:\Users\Tom\AppData\Local\FWQQE moved successfully.
C:\ProgramData\FWQQE moved successfully.
C:\Users\Tom\AppData\Local\Ce7km4 moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 566784 bytes
->Temporary Internet Files folder emptied: 70655 bytes
->FireFox cache emptied: 6736747 bytes
->Flash cache emptied: 405 bytes

User: Public

User: Tom
->Temp folder emptied: 150627773 bytes
->Temporary Internet Files folder emptied: 65295009 bytes
->Java cache emptied: 2049085 bytes
->FireFox cache emptied: 726268486 bytes
->Flash cache emptied: 180461 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 99494609 bytes
RecycleBin emptied: 40192 bytes

Total Files Cleaned = 1,003.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: Public

User: Tom
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.24.0 log created on 06152011_155816

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

2011/06/15 18:20:46.0687 1204 TDSS rootkit removing tool 2.5.4.0 Jun 7 2011 17:31:48
2011/06/15 18:20:47.0196 1204 ================================================================================
2011/06/15 18:20:47.0196 1204 SystemInfo:
2011/06/15 18:20:47.0196 1204
2011/06/15 18:20:47.0196 1204 OS Version: 6.0.6002 ServicePack: 2.0
2011/06/15 18:20:47.0197 1204 Product type: Workstation
2011/06/15 18:20:47.0197 1204 ComputerName: TOMS-COMPUTER
2011/06/15 18:20:47.0197 1204 UserName: Tom
2011/06/15 18:20:47.0197 1204 Windows directory: C:\Windows
2011/06/15 18:20:47.0197 1204 System windows directory: C:\Windows
2011/06/15 18:20:47.0197 1204 Processor architecture: Intel x86
2011/06/15 18:20:47.0198 1204 Number of processors: 2
2011/06/15 18:20:47.0198 1204 Page size: 0x1000
2011/06/15 18:20:47.0198 1204 Boot type: Normal boot
2011/06/15 18:20:47.0198 1204 ================================================================================
2011/06/15 18:20:49.0285 1204 Initialize success
2011/06/15 18:20:55.0435 2908 ================================================================================
2011/06/15 18:20:55.0435 2908 Scan started
2011/06/15 18:20:55.0435 2908 Mode: Manual;
2011/06/15 18:20:55.0435 2908 ================================================================================
2011/06/15 18:20:56.0260 2908 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2011/06/15 18:20:56.0364 2908 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/06/15 18:20:56.0492 2908 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/06/15 18:20:56.0596 2908 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/06/15 18:20:56.0639 2908 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/06/15 18:20:57.0107 2908 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
2011/06/15 18:20:57.0259 2908 AgereSoftModem (ce91b158fa490cf4c4d487a4130f4660) C:\Windows\system32\DRIVERS\AGRSM.sys
2011/06/15 18:20:57.0479 2908 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/06/15 18:20:57.0532 2908 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/06/15 18:20:57.0577 2908 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/06/15 18:20:57.0676 2908 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/06/15 18:20:57.0765 2908 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/06/15 18:20:57.0815 2908 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/06/15 18:20:57.0846 2908 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
2011/06/15 18:20:57.0955 2908 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/06/15 18:20:58.0012 2908 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/06/15 18:20:58.0092 2908 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/06/15 18:20:58.0204 2908 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2011/06/15 18:20:58.0351 2908 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/06/15 18:20:58.0518 2908 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
2011/06/15 18:20:58.0579 2908 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/06/15 18:20:58.0666 2908 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/06/15 18:20:58.0737 2908 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/06/15 18:20:58.0780 2908 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/06/15 18:20:58.0815 2908 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/06/15 18:20:58.0906 2908 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/06/15 18:20:58.0951 2908 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/06/15 18:20:59.0035 2908 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/06/15 18:20:59.0138 2908 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2011/06/15 18:20:59.0202 2908 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2011/06/15 18:20:59.0410 2908 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2011/06/15 18:20:59.0509 2908 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/06/15 18:20:59.0559 2908 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/06/15 18:20:59.0695 2908 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/06/15 18:20:59.0749 2908 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/06/15 18:20:59.0791 2908 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/06/15 18:21:00.0027 2908 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
2011/06/15 18:21:00.0173 2908 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2011/06/15 18:21:00.0300 2908 Dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys
2011/06/15 18:21:00.0483 2908 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys
2011/06/15 18:21:00.0556 2908 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys
2011/06/15 18:21:00.0621 2908 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/06/15 18:21:00.0717 2908 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
2011/06/15 18:21:00.0825 2908 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/06/15 18:21:00.0918 2908 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2011/06/15 18:21:01.0061 2908 elagopro (7ec42ec12a4bac14bcca99fb06f2d125) C:\Windows\system32\DRIVERS\elagopro.sys
2011/06/15 18:21:01.0101 2908 elaunidr (dfeabb7cfffadea4a912ab95bdc3177a) C:\Windows\system32\DRIVERS\elaunidr.sys
2011/06/15 18:21:01.0176 2908 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/06/15 18:21:01.0407 2908 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2011/06/15 18:21:01.0507 2908 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2011/06/15 18:21:01.0557 2908 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/06/15 18:21:01.0698 2908 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/06/15 18:21:01.0735 2908 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/06/15 18:21:01.0778 2908 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/06/15 18:21:01.0848 2908 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2011/06/15 18:21:01.0999 2908 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/06/15 18:21:02.0045 2908 FwLnk (cbc22823628544735625b280665e434e) C:\Windows\system32\DRIVERS\FwLnk.sys
2011/06/15 18:21:02.0072 2908 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/06/15 18:21:02.0479 2908 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/06/15 18:21:02.0558 2908 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/06/15 18:21:02.0653 2908 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/06/15 18:21:02.0711 2908 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/06/15 18:21:02.0767 2908 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
2011/06/15 18:21:02.0849 2908 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/06/15 18:21:02.0988 2908 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
2011/06/15 18:21:03.0067 2908 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/06/15 18:21:03.0172 2908 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/06/15 18:21:03.0242 2908 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/06/15 18:21:03.0595 2908 igfx (038815297078d236d8cc064c295a74c6) C:\Windows\system32\DRIVERS\igdkmd32.sys
2011/06/15 18:21:03.0850 2908 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/06/15 18:21:04.0211 2908 IntcAzAudAddService (b84732d9f8459abf6323d28a3270dc19) C:\Windows\system32\drivers\RTKVHDA.sys
2011/06/15 18:21:04.0387 2908 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/06/15 18:21:04.0535 2908 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/06/15 18:21:04.0966 2908 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/06/15 18:21:05.0085 2908 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/06/15 18:21:05.0148 2908 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/06/15 18:21:05.0384 2908 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/06/15 18:21:05.0690 2908 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/06/15 18:21:05.0811 2908 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/06/15 18:21:05.0856 2908 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/06/15 18:21:06.0032 2908 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/06/15 18:21:06.0126 2908 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/06/15 18:21:06.0173 2908 kbdhid (d2600cb17b7408b4a83f231dc9a11ac3) C:\Windows\system32\drivers\kbdhid.sys
2011/06/15 18:21:06.0260 2908 KR10I (e8ca038f51f7761bd6e3a3b0b8014263) C:\Windows\system32\drivers\kr10i.sys
2011/06/15 18:21:06.0412 2908 KR10N (6a4adb9186dd0e114e623daf57e42b31) C:\Windows\system32\drivers\kr10n.sys
2011/06/15 18:21:06.0473 2908 KR3NPXP (485e005cd51ff502fb16483eb4b69c17) C:\Windows\system32\drivers\kr3npxp.sys
2011/06/15 18:21:06.0821 2908 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2011/06/15 18:21:06.0989 2908 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/06/15 18:21:07.0071 2908 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/06/15 18:21:07.0108 2908 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/06/15 18:21:07.0215 2908 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/06/15 18:21:07.0292 2908 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/06/15 18:21:07.0396 2908 MCSTRM (5bb01b9f582259d1fb7653c5c1da3653) C:\Windows\system32\drivers\MCSTRM.sys
2011/06/15 18:21:07.0540 2908 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/06/15 18:21:07.0624 2908 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/06/15 18:21:07.0710 2908 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/06/15 18:21:07.0917 2908 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/06/15 18:21:08.0114 2908 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/06/15 18:21:08.0193 2908 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/06/15 18:21:08.0370 2908 MpFilter (7e34bfa1a7b60bba1da03d677f16cd63) C:\Windows\system32\DRIVERS\MpFilter.sys
2011/06/15 18:21:08.0509 2908 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/06/15 18:21:08.0778 2908 MpKsl0a3cf093 (5f53edfead46fa7adb78eee9ecce8fdf) c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C8F4AFA7-2E56-4921-BAED-E4E27B0F6DDD}\MpKsl0a3cf093.sys
2011/06/15 18:21:11.0320 2908 MpKslf17844ba (5f53edfead46fa7adb78eee9ecce8fdf) c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C8F4AFA7-2E56-4921-BAED-E4E27B0F6DDD}\MpKslf17844ba.sys
2011/06/15 18:21:11.0574 2908 MpNWMon (f32e2d6a1640a469a9ed4f1929a4a861) C:\Windows\system32\DRIVERS\MpNWMon.sys
2011/06/15 18:21:11.0684 2908 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/06/15 18:21:11.0909 2908 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/06/15 18:21:12.0036 2908 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2011/06/15 18:21:12.0121 2908 mrxsmb (5fe5cf325f5b02ebc60832d3440cb414) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/06/15 18:21:12.0168 2908 mrxsmb10 (30b9c769446af379a2afb72b0392604d) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/06/15 18:21:12.0215 2908 mrxsmb20 (fea239b3ec4877e2b7e23204af589ddf) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/06/15 18:21:12.0373 2908 msahci (5457dcfa7c0da43522f4d9d4049c1472) C:\Windows\system32\drivers\msahci.sys
2011/06/15 18:21:12.0646 2908 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/06/15 18:21:12.0865 2908 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/06/15 18:21:12.0981 2908 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/06/15 18:21:13.0147 2908 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/06/15 18:21:13.0335 2908 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/06/15 18:21:13.0439 2908 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/06/15 18:21:13.0571 2908 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2011/06/15 18:21:13.0745 2908 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/06/15 18:21:14.0016 2908 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/06/15 18:21:14.0179 2908 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2011/06/15 18:21:14.0299 2908 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2011/06/15 18:21:14.0525 2908 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2011/06/15 18:21:14.0685 2908 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/06/15 18:21:14.0723 2908 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/06/15 18:21:14.0801 2908 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/06/15 18:21:14.0922 2908 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/06/15 18:21:14.0989 2908 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/06/15 18:21:15.0061 2908 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
2011/06/15 18:21:15.0520 2908 NETw4v32 (c4f27ba95327b6441ca44ddcfb47562a) C:\Windows\system32\DRIVERS\NETw4v32.sys
2011/06/15 18:21:16.0315 2908 NETw5v32 (feb745e4669476c8d368f6c1ca7c7442) C:\Windows\system32\DRIVERS\NETw5v32.sys
2011/06/15 18:21:16.0660 2908 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/06/15 18:21:16.0811 2908 NisDrv (17e2c08c5ecfbe94a7c67b1c275ee9d9) C:\Windows\system32\DRIVERS\NisDrvWFP.sys
2011/06/15 18:21:16.0877 2908 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2011/06/15 18:21:16.0959 2908 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/06/15 18:21:17.0220 2908 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2011/06/15 18:21:17.0521 2908 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/06/15 18:21:17.0683 2908 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/06/15 18:21:17.0802 2908 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/06/15 18:21:17.0916 2908 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/06/15 18:21:17.0983 2908 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/06/15 18:21:18.0322 2908 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/06/15 18:21:18.0482 2908 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/06/15 18:21:18.0607 2908 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2011/06/15 18:21:18.0706 2908 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/06/15 18:21:18.0794 2908 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2011/06/15 18:21:18.0912 2908 pciide (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys
2011/06/15 18:21:19.0016 2908 pcmcia (3bb2244f343b610c29c98035504c9b75) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/06/15 18:21:19.0213 2908 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/06/15 18:21:19.0518 2908 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/06/15 18:21:19.0599 2908 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/06/15 18:21:19.0858 2908 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2011/06/15 18:21:20.0081 2908 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/06/15 18:21:20.0370 2908 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/06/15 18:21:20.0629 2908 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/06/15 18:21:20.0796 2908 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/06/15 18:21:21.0027 2908 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/06/15 18:21:21.0332 2908 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/06/15 18:21:21.0397 2908 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2011/06/15 18:21:21.0626 2908 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2011/06/15 18:21:21.0716 2908 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/06/15 18:21:21.0814 2908 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/06/15 18:21:21.0995 2908 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/06/15 18:21:22.0096 2908 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2011/06/15 18:21:22.0381 2908 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys
2011/06/15 18:21:22.0596 2908 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
2011/06/15 18:21:22.0660 2908 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/06/15 18:21:22.0909 2908 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/06/15 18:21:22.0989 2908 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
2011/06/15 18:21:23.0248 2908 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/06/15 18:21:23.0504 2908 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys
2011/06/15 18:21:23.0640 2908 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/06/15 18:21:23.0707 2908 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/06/15 18:21:23.0743 2908 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/06/15 18:21:23.0896 2908 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/06/15 18:21:24.0097 2908 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/06/15 18:21:24.0353 2908 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/06/15 18:21:24.0495 2908 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/06/15 18:21:24.0546 2908 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/06/15 18:21:24.0691 2908 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/06/15 18:21:24.0888 2908 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/06/15 18:21:25.0067 2908 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/06/15 18:21:25.0206 2908 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2011/06/15 18:21:25.0456 2908 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/06/15 18:21:25.0625 2908 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
2011/06/15 18:21:25.0780 2908 srv2 (a5940ca32ed206f90be9fabdf6e92de4) C:\Windows\system32\DRIVERS\srv2.sys
2011/06/15 18:21:25.0873 2908 srvnet (37aa1d560d5fa486c4b11c2f276ada61) C:\Windows\system32\DRIVERS\srvnet.sys
2011/06/15 18:21:26.0060 2908 StillCam (ef70b3d22b4bffda6ea851ecb063efaa) C:\Windows\system32\DRIVERS\serscan.sys
2011/06/15 18:21:26.0125 2908 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/06/15 18:21:26.0303 2908 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/06/15 18:21:26.0337 2908 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/06/15 18:21:26.0378 2908 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/06/15 18:21:26.0524 2908 SynTP (70534d1e4f9ac990536d5fb5b550b3de) C:\Windows\system32\DRIVERS\SynTP.sys
2011/06/15 18:21:26.0639 2908 tbhsd (0a396237c3c4164de12d7c26450bd69c) C:\Windows\system32\drivers\tbhsd.sys
2011/06/15 18:21:26.0833 2908 Tcpip (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\drivers\tcpip.sys
2011/06/15 18:21:27.0023 2908 Tcpip6 (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\DRIVERS\tcpip.sys
2011/06/15 18:21:27.0146 2908 tcpipreg (9bf343f4c878d6ad6922b2c5a4fefe0d) C:\Windows\system32\drivers\tcpipreg.sys
2011/06/15 18:21:27.0195 2908 tdcmdpst (1825bceb47bf41c5a9f0e44de82fc27a) C:\Windows\system32\DRIVERS\tdcmdpst.sys
2011/06/15 18:21:27.0286 2908 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/06/15 18:21:27.0401 2908 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/06/15 18:21:27.0499 2908 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2011/06/15 18:21:27.0563 2908 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2011/06/15 18:21:27.0758 2908 tifm21 (e4c85c291ddb3dc5e4a2f227ca465ba6) C:\Windows\system32\drivers\tifm21.sys
2011/06/15 18:21:28.0000 2908 tos_sps32 (1ea5f27c29405bf49799feca77186da9) C:\Windows\system32\DRIVERS\tos_sps32.sys
2011/06/15 18:21:28.0298 2908 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/06/15 18:21:28.0405 2908 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/06/15 18:21:28.0540 2908 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
2011/06/15 18:21:28.0615 2908 TVALZ (792a8b80f8188aba4b2be271583f3e46) C:\Windows\system32\DRIVERS\TVALZ_O.SYS
2011/06/15 18:21:28.0770 2908 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/06/15 18:21:28.0921 2908 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2011/06/15 18:21:29.0064 2908 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/06/15 18:21:29.0114 2908 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/06/15 18:21:29.0171 2908 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/06/15 18:21:29.0275 2908 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/06/15 18:21:29.0363 2908 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/06/15 18:21:29.0507 2908 usbbus (9419faac6552a51542dbba02971c841c) C:\Windows\system32\DRIVERS\lgusbbus.sys
2011/06/15 18:21:29.0606 2908 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/06/15 18:21:29.0668 2908 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/06/15 18:21:29.0804 2908 UsbDiag (c0a466fa4ffec464320e159bc1bbdc0c) C:\Windows\system32\DRIVERS\lgusbdiag.sys
2011/06/15 18:21:29.0857 2908 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/06/15 18:21:29.0901 2908 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2011/06/15 18:21:30.0034 2908 USBModem (f74a54774a9b0afeb3c40adec68aa600) C:\Windows\system32\DRIVERS\lgusbmodem.sys
2011/06/15 18:21:30.0089 2908 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/06/15 18:21:30.0177 2908 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/06/15 18:21:30.0355 2908 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/06/15 18:21:30.0432 2908 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/06/15 18:21:30.0565 2908 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/06/15 18:21:30.0679 2908 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2011/06/15 18:21:30.0843 2908 UVCFTR (3b929a72aaea96dc0150d3a6da268c89) C:\Windows\system32\Drivers\UVCFTR_S.SYS
2011/06/15 18:21:30.0997 2908 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/06/15 18:21:31.0088 2908 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/06/15 18:21:31.0247 2908 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/06/15 18:21:31.0424 2908 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/06/15 18:21:31.0468 2908 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/06/15 18:21:31.0599 2908 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/06/15 18:21:31.0699 2908 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2011/06/15 18:21:31.0850 2908 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
2011/06/15 18:21:31.0908 2908 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/06/15 18:21:32.0107 2908 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/06/15 18:21:32.0183 2908 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/15 18:21:32.0219 2908 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/15 18:21:32.0426 2908 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/06/15 18:21:32.0547 2908 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/06/15 18:21:32.0864 2908 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
2011/06/15 18:21:33.0130 2908 WpdUsb (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/06/15 18:21:33.0304 2908 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/06/15 18:21:33.0481 2908 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/06/15 18:21:33.0581 2908 yukonwlh (1dd951cf8a69fa2bea82f3e3a811fa95) C:\Windows\system32\DRIVERS\yk60x86.sys
2011/06/15 18:21:33.0635 2908 MBR (0x1B8) (5b5e648d12fcadc244c1ec30318e1eb9) \Device\Harddisk0\DR0
2011/06/15 18:21:33.0651 2908 ================================================================================
2011/06/15 18:21:33.0651 2908 Scan finished
2011/06/15 18:21:33.0651 2908 ================================================================================
2011/06/15 18:21:33.0679 3072 Detected object count: 0
2011/06/15 18:21:33.0679 3072 Actual detected object count: 0
2011/06/15 18:22:05.0830 1540 Deinitialize success

#10 snemelk

inżynier

Group: Malware Response Team
Posts: 1,368
Joined: 26-February 08

Posted 16 June 2011 - 06:31 AM

Hi again tmyers85!!..

That looks better!!.. There was an entry in the logfile which belonged to an infection causing redirects in Firefox, it was removed with the script... Tell me what problem remains...

Also, please do the following:

Firstly,
We need to update outdated programs (with security vulnerabilities) on your machine:

- Adobe Acrobat Reader:

You're using an old version of Adobe Acrobat Reader, this can leave your PC open to vulnerabilities, you can update it here (uninstall version 9.3.4 first):
Adobe Reader X

Note: I suggest you uncheck an optional, third-party download (eg. McAfee Security Scan Plus).

After successfully installing Adobe Reader X, see this article on how to make this program more secure: Adobe Reader X secures itself by playing in the sandbox.

- Java

Go to Start -> Control Panel -> Programs and Features, highlight a program to see the available option on the toolbar for it. Choose Uninstall for:
Java™ 6 Update 25
Java™ 6 Update 2

Then,

Download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says Java Platform, Standard Edition / "Java SE 6 Update 26".
Click the "Download JRE" button to the right.
In the Window that opens, check the box that says: "Accept License Agreement".
Click on the link: jre-6u26-windows-i586.exe to download an offline installer for Windows x86. Save the file to your Desktop.
Close any programs you may have running - especially your web browser.
Then from your Desktop double-click on the file that you've downloaded to install the newest version.

- Adobe Flash Player:

To make sure you have the latest version of Adobe Flash Player installed:
1. To uninstall an older version, download this file to your Desktop: uninstall_flash_player.exe
2. Quit ALL running applications, including all Internet Explorer or other browser windows, and messenger applications (like AOL Instant Messenger, Yahoo Messenger, MSN Messenger.
3. Double-click on the file you've downloaded to uninstall Flash.
4. If uninstalled successfully, go to this site: Install Adobe Flash Player, and choose Agree and install now. This will install the newest version of Flash for your browser (note: Flash plugins for IE and Firefox must be installed separately).
Note: I recommend you uncheck an optional install (Free McAfee Security Scan or Free Google Toolbar).

- Skype™ 4.2 - I suggest you upgrade to the newest version: Skype 5.3

Secondly,
Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer (32 bit version - Start --> All programs --> Internet Explorer) for this scan. Internet Explorer must be run as administrator - right click and choose: Run as administrator.

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use Notepad to open the logfile located at C:\Program Files (x86)\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

snemelk.hekko.pl - my site with a few computer security tips...
Silesia - that's where I live!
"If I had some duct tape, I could fix that." - MacGyver

#11 tmyers85

New Member

Group: Members
Posts: 6
Joined: 10-December 10

Posted 16 June 2011 - 07:34 PM

I have updated all the programs you suggested and here is the log. Thank you.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6526
# api_version=3.0.2
# EOSSerial=62342f5888da57448065bbc51593146e
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-06-16 11:17:23
# local_time=2011-06-16 06:17:23 (-0600, Central Daylight Time)
# country="United States"
# lang=9
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1029 16777214 0 1 28479688 28479688 0 0
# compatibility_mode=5892 16776574 66 100 28598427 144867343 0 0
# compatibility_mode=7937 16777214 0 25 2401 2401 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=156851
# found=0
# cleaned=0
# scan_time=6428

#12 snemelk

inżynier

Group: Malware Response Team
Posts: 1,368
Joined: 26-February 08

Posted 17 June 2011 - 04:42 AM

Hi again tmyers85!!..

Ok, if no problem remains, you're good to go!..

Firstly,
To remove all of the tools we used and the files and folders they created do the following:
Double click OTL.exe.

Click the CleanUp button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Secondly,
Please set a new Restore Point to prevent infection from any previous Restore Points.
The easiest and safest way to do this is:

Open Control Panel (Start --> Control Panel) and double-click the System icon.
Click on the System Protection link on the left. If an UAC (User Account Control) prompt appears, click Continue. Close the System window.
Make sure that you have System Protection turned on for your System drive (usually C:\):
- In Windows 7: On under Protection,
- In Windows Vista: a box on the left will be checked.
Click on the Create button. Give the restore point a name, and click Create. Wait till the new system restore point is created, and click Close.
Then go to "Disk Cleanup" which can be found by going to Start > All Programs > Accessories > System Tools.
Click "OK" to select the partition or drive you desire (usually C:\).
Click the "More Options" Tab.
Click "Clean Up" in the System Restore section to remove all previous Restore Points except the newly created one. More details and screenshots for Disk Cleanup in Windows Vista can be found here and for Windows 7 here.

Please check my site - snemelk.hekko.pl:

Step 1: After removing malware
Step 2: A few steps to make your web browsing safer

Also, I recommend you to read Grinler's excellent article: How did I get infected?, With steps so it does not happen again!

snemelk.hekko.pl - my site with a few computer security tips...
Silesia - that's where I live!
"If I had some duct tape, I could fix that." - MacGyver

#13 snemelk

inżynier

Group: Malware Response Team
Posts: 1,368
Joined: 26-February 08

Posted 01 July 2011 - 07:25 AM

Glad we could help.

If you need this topic reopened, just send me a PM (Send message from my profile) with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

snemelk.hekko.pl - my site with a few computer security tips...
Silesia - that's where I live!
"If I had some duct tape, I could fix that." - MacGyver