BleepingComputer.com: All files show empty, no items on desk top except recycle bin, only solitare usable, cant run any program

I am using Windows 7 with IE8.

How it hsppened: I have been looking to buy a car and a guy emailed me and I thought it was a scam and then IO found the listing on eBay. On the auction page there was a tab that said "report item" I clicked it and it went to what looked to be an eBay chat, never used it beofre so I didnt know what one would look like, it looked pretty good. Person came on and asked what my problem was and I gave the auction number and the so called eBay person stated eBay backed the auction with their 50,000.00 guarantee and the user had been on since 2002 and kept on and on and offered to help me buy the car. It did have a 100% feedback 106 purchases. Ok so I called out after I figured the whoel thing was BS and he started rambling all kinds of weird stuff and then my computer acts weird. I figured he must of loaded something to me. So that is what happened. I know the guy pulled the ad and deleted the profile. I guess he won though.

What the computer is doing: all my files are stating they are empty, nothing except solitare is working, the desktop is empty except the recycle bin. If I try to run Malwarebytes from the desktop I get an error. The error states "An error has ocurred. Please report this error code to our support team. PROGRAM_ERROR_UPDATING(12007,0,WinHttpSendRequest). I went to "Am I infected" and was directed the run "Window Recovery 7" I ran the rkill and it stated it stopped "InfDefaultInstall.exe". I then ran tdsskiller and it found nothing. I ran Malwarebytes and it would not allow me to update. Per the instructions I came to this forum.

I have: Put in safe mode networking, run rkill, run Malwarebyes non-updated since I cant, unhide.exe, ran tdsskiler and can not tell I have done anything to help.

I have follow the instruction and the start of the forum and posted the log below as requested. It has been a long time since I did a back up, I know, I know, but I got lazy. I cant get it to do a back up now because of the problem. Just let me know what to do next and again thank you.



.
DDS (Ver_2011-06-11.01) - NTFSAMD64 NETWORK
Internet Explorer: 8.0.7600.16385
Run by Robert Hill at 7:26:32 on 2011-06-11
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3838.3116 [GMT -5:00]
.
AV: avast! Antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\windows\Explorer.EXE
C:\windows\system32\ctfmon.exe
C:\windows\System32\svchost.exe -k secsvcs
C:\windows\SysWOW64\cmd.exe
C:\windows\system32\conhost.exe
C:\windows\SysWOW64\cscript.exe
C:\windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page =
uStart Page = hxxp://www.google.com/ig?brand=TSNA&bmod=TSNA
uDefault_Page_URL = hxxp://www.google.com/ig?brand=TSNA&bmod=TSNA
uSearch Bar =
mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [Skype] "C:\Program Files (x86)\Skype\\Phone\Skype.exe" /nosplash /minimized
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [WorkForce 630(Network)] C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGBA.EXE /FU "C:\windows\TEMP\E_SF9DB.tmp" /EF "HKCU"
uRun: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
uRun: [Uqvjclgu] C:\Users\Robert Hill\Local Settings\Application Data\rwvdetkr.exe
mRun: [TUSBSleepChargeSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun: [TWebCamera] "%ProgramFiles%\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" UNATTENDED
mRun: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
mRun: [FUFAXSTM] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe"
mRunOnce: [GrpConv] grpconv -o
mRunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: Se&nd to OneNote - C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{7D5221A3-A59A-4A3F-AD7F-9FF8E83C4B3E} : DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{7D5221A3-A59A-4A3F-AD7F-9FF8E83C4B3E}\2677 : DhcpNameServer = 208.65.21.4 24.25.5.60
TCP: Interfaces\{7D5221A3-A59A-4A3F-AD7F-9FF8E83C4B3E}\2716D61646161333 : DhcpNameServer = 172.20.100.1
TCP: Interfaces\{7D5221A3-A59A-4A3F-AD7F-9FF8E83C4B3E}\353484D294530303F553234393 : DhcpNameServer = 192.168.16.1
TCP: Interfaces\{7D5221A3-A59A-4A3F-AD7F-9FF8E83C4B3E}\35C45454050294E4E4 : DhcpNameServer = 4.2.2.2
TCP: Interfaces\{7D5221A3-A59A-4A3F-AD7F-9FF8E83C4B3E}\35D434830313437574D24575343453 : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{7D5221A3-A59A-4A3F-AD7F-9FF8E83C4B3E}\E4544574541425 : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{FE0551A9-9EE4-4CAE-A7BD-03C9E4F665C1} : DhcpNameServer = 70.10.0.20 70.10.0.21
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
mASetup: Neat ADF Scanner 2008 - reg copy "HKLM\Software\Wow6432Node\The Neat Company\Neat ADF Scanner 2008" "HKCU\Software\The Neat Company\Neat ADF Scanner 2008" /s /f
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB-X64: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
mRun-x64: [TUSBSleepChargeSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun-x64: [TWebCamera] "%ProgramFiles%\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
mRun-x64: [NortonOnlineBackupReminder] "C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" UNATTENDED
mRun-x64: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
mRun-x64: [FUFAXSTM] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe"
mRunOnce-x64: [GrpConv] grpconv -o
mRunOnce-x64: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
.
============= SERVICES / DRIVERS ===============
.
R0 Thpdrv;TOSHIBA HDD Protection Driver;C:\windows\system32\DRIVERS\thpdrv.sys --> C:\windows\system32\DRIVERS\thpdrv.sys [?]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;C:\windows\system32\DRIVERS\Thpevm.SYS --> C:\windows\system32\DRIVERS\Thpevm.SYS [?]
R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\system32\DRIVERS\tos_sps64.sys --> C:\windows\system32\DRIVERS\tos_sps64.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-6-29 128752]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\system32\DRIVERS\TVALZFL.sys --> C:\windows\system32\DRIVERS\TVALZFL.sys [?]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);C:\windows\system32\DRIVERS\L1C62x64.sys --> C:\windows\system32\DRIVERS\L1C62x64.sys [?]
R3 O2MDGRDR;O2MDGRDR;C:\windows\system32\DRIVERS\o2mdgx64.sys --> C:\windows\system32\DRIVERS\o2mdgx64.sys [?]
R3 O2SDGRDR;O2SDGRDR;C:\windows\system32\DRIVERS\o2sdgx64.sys --> C:\windows\system32\DRIVERS\o2sdgx64.sys [?]
R3 QIOMem;Generic IO & Memory Access;C:\windows\system32\DRIVERS\QIOMem.sys --> C:\windows\system32\DRIVERS\QIOMem.sys [?]
R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;C:\windows\system32\DRIVERS\rtl8192se.sys --> C:\windows\system32\DRIVERS\rtl8192se.sys [?]
S1 aswSP;aswSP;C:\windows\system32\drivers\aswSP.sys --> C:\windows\system32\drivers\aswSP.sys [?]
S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920]
S1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360]
S2 AMD External Events Utility;AMD External Events Utility;C:\windows\system32\atiesrxx.exe --> C:\windows\system32\atiesrxx.exe [?]
S2 aswFsBlk;aswFsBlk;C:\windows\system32\drivers\aswFsBlk.sys --> C:\windows\system32\drivers\aswFsBlk.sys [?]
S2 aswMonFlt;aswMonFlt;\??\C:\windows\system32\drivers\aswMonFlt.sys --> C:\windows\system32\drivers\aswMonFlt.sys [?]
S2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-1-17 40384]
S2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-8-10 248688]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 ConfigFree Gadget Service;ConfigFree Gadget Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2009-7-14 42368]
S2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-5-13 135664]
S2 HsfXAudioService;HsfXAudioService;C:\windows\system32\svchost.exe -k HsfXAudioService [2009-7-13 20992]
S2 MSSQL$XACTWARE;SQL Server (XACTWARE);C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 RSELSVC;TOSHIBA Modem region select service;C:\Program Files\TOSHIBA\rselect\RSelSvc.exe [2009-7-7 65904]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2009-8-11 252272]
S3 CAXHWAZL;CAXHWAZL;C:\windows\system32\DRIVERS\CAXHWAZL.sys --> C:\windows\system32\DRIVERS\CAXHWAZL.sys [?]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-5-13 135664]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 PGEffect;Pangu effect driver;C:\windows\system32\DRIVERS\pgeffect.sys --> C:\windows\system32\DRIVERS\pgeffect.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\windows\system32\DRIVERS\VSTAZL6.SYS --> C:\windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\windows\system32\DRIVERS\VSTDPV6.SYS --> C:\windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-12-16 51512]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-8-3 137560]
S3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2009-8-4 826224]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2011-06-03 04:29:51 -------- d-----w- C:\Users\Robert Hill\AppData\Local\{B045CD3D-7331-4646-9711-8B74319DA974}
2011-06-03 04:08:48 -------- d-----w- C:\Users\Robert Hill\AppData\Local\{C1CA0450-4492-4FA5-8CF0-C55F72A1359D}
2011-06-03 04:07:51 1207808 ------w- C:\Users\Robert Hill\AppData\Local\ejiqrgxe.exe
2011-06-02 10:29:05 1207808 ------w- C:\Users\Robert Hill\AppData\Local\rwvdetkr.exe
2011-06-02 04:05:34 -------- d-----w- C:\Users\Robert Hill\AppData\Local\30921202
2011-05-31 10:57:17 8718160 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EE5E9E7E-A0D1-4458-9C71-DCF502284076}\mpengine.dll
2011-05-26 00:44:35 27008 ----a-w- C:\windows\System32\drivers\Diskdump.sys
2011-05-26 00:40:08 404640 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-05-26 00:39:18 -------- d-----w- C:\Users\Robert Hill\AppData\Local\{8EF76F4A-B91E-4F27-B8A1-6A64DE51C78A}
2011-05-25 04:10:47 -------- d-----w- C:\fd79fef46c6d633f084673548344
2011-05-21 02:44:59 -------- d-----w- C:\Users\Robert Hill\AppData\Local\{D43D6909-7DC9-4574-93F0-770ECCF8B131}
2011-05-19 00:49:58 142336 ----a-w- C:\windows\System32\poqexec.exe
2011-05-19 00:49:58 123904 ----a-w- C:\windows\SysWow64\poqexec.exe
2011-05-14 00:33:22 -------- d-----w- C:\Users\Robert Hill\AppData\Local\{AD718A0B-4980-4753-88A1-334059E06002}
.
==================== Find3M ====================
.
2011-04-09 06:45:48 5509504 ----a-w- C:\windows\System32\ntoskrnl.exe
2011-04-09 06:13:06 3957632 ----a-w- C:\windows\SysWow64\ntkrnlpa.exe
2011-04-09 06:13:06 3901824 ----a-w- C:\windows\SysWow64\ntoskrnl.exe
2011-03-25 03:23:22 343040 ----a-w- C:\windows\System32\drivers\usbhub.sys
2011-03-25 03:23:03 98816 ----a-w- C:\windows\System32\drivers\usbccgp.sys
2011-03-25 03:23:03 324608 ----a-w- C:\windows\System32\drivers\usbport.sys
2011-03-25 03:22:57 52224 ----a-w- C:\windows\System32\drivers\usbehci.sys
2011-03-25 03:22:56 25600 ----a-w- C:\windows\System32\drivers\usbohci.sys
2011-03-25 03:22:55 30720 ----a-w- C:\windows\System32\drivers\usbuhci.sys
2011-03-25 03:22:51 7936 ----a-w- C:\windows\System32\drivers\usbd.sys
.
============= FINISH: 7:27:01.88 ===============

I have let this sit here since June 11 and I know it states do not bump. If someone could please review I would be very grateful.

EDIT: Please be patient. There are over 300 unanswered topics in this forum at present and the current average wait time to receive help is 8 days. ~Budapest

This post has been edited by Budapest: 17 June 2011 - 06:55 PM

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you.

I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  
  
• Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  
  
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  
  
• In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
  
  
• If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  
  
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  
  
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  
  
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
  Because of this, you must reply within three days failure to reply will result in the topic being closed!
  
  
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Running OTL

We need to create a FULL OTL Report

• Please download OTL from here:
  
  • Main Mirror
    
  • Mirror
  
  
• Save it to your desktop.
  
• Double click on the icon on your desktop.
  
• Click the "Scan All Users" checkbox.
  
• Change the "Extra Registry" option to "SafeList"
  
• Push the button.
  
• Two reports will open, copy and paste them in a reply here:
  
  • OTL.txt <-- Will be opened
    
  • Extras.txt <-- Will be minimized

NEXT:


Please provide an update on how things are running in your next reply.

First and foremost, thank you for helping me and I am sorry to bump my log butI thought I had been missed. Here are the logs:

OTL logfile created on: 6/19/2011 7:01:44 AM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Robert Hill\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 2.38 Gb Available Physical Memory | 63.42% Memory free
7.49 Gb Paging File | 5.80 Gb Available in Paging File | 77.38% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 454.33 Gb Total Space | 408.71 Gb Free Space | 89.96% Space Free | Partition Type: NTFS
Drive E: | 983.22 Mb Total Space | 873.97 Mb Free Space | 88.89% Space Free | Partition Type: FAT

Computer Name: ROBERTHILL-PC | User Name: Robert Hill | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found -- C:\Users\Robert Hill\Local Settings\Application Data\rwvdetkr.exe
PRC - File not found --
PRC - File not found -- C:\Users\Robert Hill\Local Settings\Application Data\ejiqrgxe.exe
PRC - [2011/06/19 06:59:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Robert Hill\Desktop\OTL.exe
PRC - [2011/03/28 12:45:27 | 004,481,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SoftwareDistribution\Download\Install\vcredist_x86.exe
PRC - [2011/01/13 03:47:34 | 003,396,624 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/01/13 03:47:33 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2011/01/11 06:32:52 | 000,560,464 | ---- | M] (Microsoft Corporation) -- c:\b1f9673cbfe99523740a\install.exe
PRC - [2009/12/03 11:12:12 | 000,976,320 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
PRC - [2009/12/03 01:00:00 | 000,847,872 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe
PRC - [2009/07/28 23:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2009/07/14 22:10:30 | 000,042,368 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
PRC - [2009/07/13 18:24:00 | 000,304,496 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2009/03/10 21:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
PRC - [2006/12/19 19:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe


========== Modules (SafeList) ==========

MOD - [2011/06/19 06:59:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Robert Hill\Desktop\OTL.exe
MOD - [2011/01/20 00:33:04 | 000,189,728 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
MOD - [2010/08/21 00:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/01/13 03:47:33 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2010/06/29 12:49:27 | 000,128,752 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
SRV:64bit: - [2009/08/21 12:31:06 | 000,488,800 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:64bit: - [2009/08/11 19:10:48 | 000,252,272 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\TECO\TecoService.exe -- (TOSHIBA eco Utility Service)
SRV:64bit: - [2009/08/04 14:15:06 | 000,826,224 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe -- (TPCHSrv)
SRV:64bit: - [2009/08/03 21:17:56 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:64bit: - [2009/07/30 02:54:22 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/07/28 18:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/08 12:41:02 | 000,531,520 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\ThpSrv.exe -- (Thpsrv)
SRV:64bit: - [2009/07/07 12:38:24 | 000,065,904 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\rselect\RSelSvc.exe -- (RSELSVC)
SRV:64bit: - [2007/02/12 19:43:00 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Windows\SysNative\drivers\o2flash.exe -- (O2FLASH)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/08/17 13:48:42 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/08/10 22:55:58 | 000,248,688 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)
SRV - [2009/07/14 22:10:30 | 000,042,368 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe -- (ConfigFree Gadget Service)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/04/29 14:21:18 | 000,436,736 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\XAudio64.dll -- (HsfXAudioService)
SRV - [2009/03/10 21:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)
SRV - [2006/12/19 19:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe -- (EpsonBidirectionalService)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/03/11 01:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/01/13 03:37:23 | 000,062,032 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2010/02/17 13:23:05 | 000,014,920 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV:64bit: - [2010/02/17 13:23:05 | 000,012,360 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV:64bit: - [2009/09/07 22:42:22 | 000,073,376 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\o2mdgx64.sys -- (O2MDGRDR)
DRV:64bit: - [2009/08/26 21:11:12 | 000,942,080 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192se.sys -- (rtl8192se)
DRV:64bit: - [2009/08/18 21:41:06 | 000,049,568 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\o2sdgx64.sys -- (O2SDGRDR)
DRV:64bit: - [2009/07/30 23:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:64bit: - [2009/07/30 21:20:18 | 000,281,648 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009/07/30 15:07:12 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009/07/27 18:04:36 | 000,058,880 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20)
DRV:64bit: - [2009/07/24 18:57:08 | 000,482,384 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tos_sps64.sys -- (tos_sps64)
DRV:64bit: - [2009/07/14 18:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 19:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009/07/13 18:31:10 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2009/06/29 19:16:20 | 000,014,784 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Thpevm.sys -- (Thpevm)
DRV:64bit: - [2009/06/29 13:25:22 | 000,034,880 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\thpdrv.sys -- (Thpdrv)
DRV:64bit: - [2009/06/23 04:28:22 | 000,684,544 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2009/06/22 20:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:64bit: - [2009/06/19 22:15:22 | 000,014,472 | ---- | M] (TOSHIBA Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TVALZFL.sys -- (TVALZFL)
DRV:64bit: - [2009/06/15 16:58:00 | 000,012,800 | ---- | M] (TOSHIBA) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\QIOMem.sys -- (QIOMem)
DRV:64bit: - [2009/06/10 16:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009/06/10 16:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009/06/10 16:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/09 00:14:20 | 000,015,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr)
DRV:64bit: - [2009/05/05 03:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2009/04/29 14:21:08 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio)
DRV:64bit: - [2009/02/13 01:24:56 | 001,485,824 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV)
DRV:64bit: - [2009/02/13 01:20:56 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL)
DRV:64bit: - [2009/02/13 01:19:34 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf)
DRV:64bit: - [2009/01/09 15:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2006/06/18 09:27:24 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig?brand=TSNA&bmod=TSNA
IE - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig?brand=TSNA&bmod=TSNA
IE - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



Hosts file not found
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg64.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [SmartFaceVWatcher] C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [ThpSrv] C:\windows\SysNative\thpsrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [EEventManager] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [FUFAXSTM] C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe (Toshiba)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TUSBSleepChargeSrv] C:\Program Files (x86)\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe (TOSHIBA)
O4 - HKLM..\Run: [TWebCamera] C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001..\Run: [Uqvjclgu] C:\Users\Robert Hill\Local Settings\Application Data\rwvdetkr.exe File not found
O4 - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001..\Run: [WorkForce 630(Network)] File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} http://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{a29c0a6e-7d9c-11e0-b9ab-00269eaf51d9}\Shell - "" = AutoRun
O33 - MountPoints2\{a29c0a6e-7d9c-11e0-b9ab-00269eaf51d9}\Shell\AutoRun\command - "" = E:\ToolLauncher-Bootstrap.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\ToolLauncher-Bootstrap.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/19 07:00:50 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\Robert Hill\Desktop\OTL.exe
[2011/06/19 06:59:41 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{491DF868-FB8E-471F-B356-0A34045983CD}
[2011/06/11 07:26:21 | 000,607,249 | R--- | C] (Swearware) -- C:\Users\Robert Hill\Desktop\dds.scr
[2011/06/11 06:53:51 | 001,437,488 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Robert Hill\Desktop\tdsskiller.exe
[2011/06/02 23:29:51 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{B045CD3D-7331-4646-9711-8B74319DA974}
[2011/06/02 23:08:48 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{C1CA0450-4492-4FA5-8CF0-C55F72A1359D}
[2011/06/01 23:05:34 | 000,000,000 | -H-D | C] -- C:\Users\Robert Hill\AppData\Local\30921202
[2011/05/25 19:44:35 | 000,027,008 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\Diskdump.sys
[2011/05/25 19:40:08 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/05/25 19:39:18 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{8EF76F4A-B91E-4F27-B8A1-6A64DE51C78A}
[2011/05/24 23:10:47 | 000,000,000 | ---D | C] -- C:\fd79fef46c6d633f084673548344
[2011/05/20 21:44:59 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{D43D6909-7DC9-4574-93F0-770ECCF8B131}
[2011/05/20 21:36:40 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\Desktop\Phone Videos
[2011/05/20 21:34:08 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\Desktop\Phone pics
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/19 07:04:44 | 000,015,792 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/19 07:04:44 | 000,015,792 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/19 07:03:54 | 000,792,000 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2011/06/19 07:03:54 | 000,670,886 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2011/06/19 07:03:54 | 000,124,044 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2011/06/19 06:59:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Robert Hill\Desktop\OTL.exe
[2011/06/19 06:58:37 | 000,000,894 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/19 06:56:36 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2011/06/19 06:56:13 | 3018,608,640 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/11 08:24:42 | 000,607,249 | R--- | M] (Swearware) -- C:\Users\Robert Hill\Desktop\dds.scr
[2011/06/11 08:20:10 | 000,050,477 | ---- | M] () -- C:\Users\Robert Hill\Desktop\Defogger.exe
[2011/06/11 07:52:12 | 001,437,488 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Robert Hill\Desktop\tdsskiller.exe
[2011/06/11 07:47:20 | 001,007,120 | ---- | M] () -- C:\Users\Robert Hill\Desktop\rkill.com
[2011/06/11 07:22:40 | 000,000,000 | ---- | M] () -- C:\Users\Robert Hill\defogger_reenable
[2011/06/03 19:45:58 | 000,001,108 | ---- | M] () -- C:\Users\Robert Hill\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/06/03 19:45:58 | 000,001,084 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B3
[2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B2
[2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B1
[2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B0
[2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AF
[2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AE
[2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AD
[2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AC
[2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AB
[2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AA
[2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\918B
[2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\918A
[2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9189
[2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9188
[2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9187
[2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9186
[2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9185
[2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9184
[2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9183
[2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9182
[2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907D
[2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907C
[2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907B
[2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907A
[2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9079
[2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9078
[2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9077
[2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9076
[2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9075
[2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9074
[2011/06/02 22:31:36 | 000,000,898 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/01 23:05:36 | 001,207,808 | -H-- | M] () -- C:\Users\Robert Hill\AppData\Local\ejiqrgxe.exe
[2011/06/01 23:05:36 | 001,207,808 | ---- | M] () -- C:\Users\Robert Hill\AppData\Local\rwvdetkr.exe
[2011/05/25 19:40:08 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/11 07:22:40 | 000,000,000 | ---- | C] () -- C:\Users\Robert Hill\defogger_reenable
[2011/06/11 07:22:11 | 000,050,477 | ---- | C] () -- C:\Users\Robert Hill\Desktop\Defogger.exe
[2011/06/11 06:53:40 | 001,007,120 | ---- | C] () -- C:\Users\Robert Hill\Desktop\rkill.com
[2011/06/03 19:45:58 | 000,001,108 | ---- | C] () -- C:\Users\Robert Hill\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/06/03 19:45:58 | 000,001,084 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/02 23:07:51 | 001,207,808 | -H-- | C] () -- C:\Users\Robert Hill\AppData\Local\ejiqrgxe.exe
[2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B3
[2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B2
[2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B1
[2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B0
[2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AF
[2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AE
[2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AD
[2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AC
[2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AB
[2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AA
[2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\918B
[2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\918A
[2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9189
[2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9188
[2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9187
[2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9186
[2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9185
[2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9184
[2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9183
[2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9182
[2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907D
[2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907C
[2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907B
[2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907A
[2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9079
[2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9078
[2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9077
[2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9076
[2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9075
[2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9074
[2011/06/02 05:29:05 | 001,207,808 | ---- | C] () -- C:\Users\Robert Hill\AppData\Local\rwvdetkr.exe
[2010/12/18 20:37:18 | 000,000,097 | ---- | C] () -- C:\windows\SysWow64\PICSDK.ini
[2010/12/18 20:37:17 | 000,073,220 | ---- | C] () -- C:\windows\SysWow64\EPPICPrinterDB.dat
[2010/12/18 20:37:17 | 000,031,053 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern131.dat
[2010/12/18 20:37:17 | 000,029,114 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern1.dat
[2010/12/18 20:37:17 | 000,027,417 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern121.dat
[2010/12/18 20:37:17 | 000,021,021 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern3.dat
[2010/12/18 20:37:17 | 000,015,670 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern5.dat
[2010/12/18 20:37:17 | 000,013,280 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern2.dat
[2010/12/18 20:37:17 | 000,010,673 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern4.dat
[2010/12/18 20:37:17 | 000,004,943 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern6.dat
[2010/12/18 20:37:17 | 000,001,140 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_PT.dat
[2010/12/18 20:37:17 | 000,001,140 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_BP.dat
[2010/12/18 20:37:17 | 000,001,137 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_ES.dat
[2010/12/18 20:37:17 | 000,001,130 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_FR.dat
[2010/12/18 20:37:17 | 000,001,130 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_CF.dat
[2010/12/18 20:37:17 | 000,001,104 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_EN.dat
[2010/12/18 20:26:13 | 000,000,079 | ---- | C] () -- C:\windows\EWF630.ini
[2010/08/23 20:51:59 | 000,136,542 | ---- | C] () -- C:\windows\hphins33.dat
[2010/08/23 20:51:59 | 000,000,512 | ---- | C] () -- C:\windows\hphmdl33.dat
[2010/08/23 20:39:18 | 000,136,092 | ---- | C] () -- C:\windows\hphins33.dat.temp
[2010/08/23 20:39:18 | 000,000,512 | ---- | C] () -- C:\windows\hphmdl33.dat.temp
[2010/08/20 14:29:01 | 000,139,264 | ---- | C] () -- C:\windows\SysWow64\gswin32c.exe
[2010/07/19 16:47:55 | 000,743,534 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2009/12/16 14:02:25 | 000,000,000 | ---- | C] () -- C:\windows\NDSTray.INI
[2009/12/16 13:47:18 | 000,000,000 | ---- | C] () -- C:\windows\ativpsrm.bin
[2009/07/30 20:58:42 | 000,000,326 | ---- | C] () -- C:\windows\primopdf.ini
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- C:\windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- C:\windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- C:\windows\SysWow64\mlang.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:8BE3D058

< End of report >

*******************************************************************************************************************

OTL Extras logfile created on: 6/19/2011 7:01:44 AM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Robert Hill\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 2.38 Gb Available Physical Memory | 63.42% Memory free
7.49 Gb Paging File | 5.80 Gb Available in Paging File | 77.38% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 454.33 Gb Total Space | 408.71 Gb Free Space | 89.96% Space Free | Partition Type: NTFS
Drive E: | 983.22 Mb Total Space | 873.97 Mb Free Space | 88.89% Space Free | Partition Type: FAT

Computer Name: ROBERTHILL-PC | User Name: Robert Hill | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{20387B45-18A4-4D48-ABD9-A23D2CBE42B3}" = Dolby Control Center
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5BCC94A1-DEF1-4AB4-8046-BC13048E929A}" = TOSHIBA ReelTime
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{7EA2D88A-C8B7-4102-8644-0A437B6FC143}" = Neat Mobile Scanner Driver
"{81F3BC27-141B-635F-5D6B-5DE08D3B5884}" = ccc-utility64
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{89F7D66C-777D-473B-AA11-319C0F190EAC}" = TOSHIBA Internal Modem Region Select Utility
"{8A2BC7D4-A7D3-45D5-B3D2-394718C53C41}" = Neat ADF Scanner 2008 Driver
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{94A90C69-71C1-470A-88F5-AA47ECC96B40}" = TOSHIBA HDD Protection
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96178C0A-BAF9-4E49-A2A5-CDE76722105B}" = HP Deskjet D1600 Printer Driver 14.0 Rel. 6
"{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}" = Microsoft SQL Server Native Client
"{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}" = TOSHIBA PC Health Monitor
"{A0880F03-8480-482E-1606-BC91669B0882}" = ATI Catalyst Install Manager
"{A55F1206-BFA7-4027-92B8-CE4EFDBC3CF2}" = Neat ADF Scanner Driver
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}" = TOSHIBA eco Utility
"{B636C9B9-A3F2-4DCE-ADCC-72E095018385}" = Microsoft SQL Server VSS Writer
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Media Creator
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{BE930E38-7BB3-45B6-85B2-5251F374F844}" = 64 Bit HP CIO Components Installer
"{C4FFA951-9678-4D51-84B4-AFD15D3C45AD}" = TOSHIBA Hardware Setup
"{CBD6B23D-41D5-4A46-8019-6208516C9712}" = TOSHIBA Supervisor Password
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D1108D4B-72F8-419F-88C5-ABB8DC09B3C7}" = Neat Mobile Scanner (Silver) Driver
"{D1157589-296B-4AB7-A2B1-B69900C5F399}" = O2Micro Flash Memory Card Windows Driver
"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DDE25FC9-892D-4D24-9325-3BAA5C15ACA9}" = Neat Mobile Scanner 2008 Driver
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F64684A0-754B-4637-B7F9-6E8DAA8CD5CD}" = TOSHIBA Bulletin Board
"{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"CNXT_AUDIO" = Conexant HD Audio
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"EPSON WorkForce 630 Series" = EPSON WorkForce 630 Series Printer Uninstall
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
"{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}" = Epson Event Manager
"{04F693CE-1C19-4DED-8418-31A9E79212D2}" = Xactimate 25
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}" = Epson FAX Utility
"{0DB8F853-899A-8628-E0D7-29FB190CF848}" = Catalyst Control Center Graphics Full Existing
"{0FB630AB-7BD8-40AE-B223-60397D57C3C9}" = Realtek WLAN Driver
"{117BCF94-6A1E-6741-39F5-09444381445E}" = CCC Help Italian
"{1211D6B0-B7B5-CB9A-99A2-066473FC35CA}" = CCC Help Swedish
"{14956199-1890-C3D4-F8B8-3C0C6FD82993}" = ccc-core-static
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1B87C40B-A60B-4EF3-9A68-706CF4B69978}" = TOSHIBA Assist
"{1D210042-41EE-4472-2219-6A900366B9A3}" = CCC Help French
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 14
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2ABB6396-785C-E2CB-579E-79BAF98E0527}" = Catalyst Control Center Graphics Previews Vista
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (XACTWARE)
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3B843B38-04B1-4CE6-8888-586273E0F289}" = Quickbooks Financial Center
"{3E1B8E31-9692-207B-77B7-A8339AF03795}" = Catalyst Control Center Graphics Full New
"{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Netwaiting
"{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50F68032-B5B7-4513-9116-C978DBD8F27A}" = DVD MovieFactory for TOSHIBA
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{58630658-9DF7-E873-9F5D-0EAF87D25DAA}" = CCC Help Norwegian
"{594A3C2C-19B3-E02E-359C-B8D134F6B939}" = CCC Help Korean
"{5AF550B4-BB67-4E7E-82F1-2C4300279050}" = ToshibaRegistration
"{5E6F6CF3-BACC-4144-868C-E14622C658F3}" = TOSHIBA Web Camera Application
"{6055830B-40E4-C794-3F04-2D0CD8AF1AAC}" = CCC Help Russian
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{6E932CA6-FD17-7694-FD7C-14CE25770EA5}" = Catalyst Control Center Graphics Previews Common
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{739A6E9D-5D7D-8A5D-EC8A-4BD11E5749AA}" = CCC Help Hungarian
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7BD1EAE4-2E08-4087-8600-44B0ACB0C887}" = NeatWorks Core Files
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C72927B-7410-131A-E641-B9C505F4973C}" = CCC Help Japanese
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{911AB6CA-E04C-1E98-523D-8FCFAB4F456C}" = CCC Help Czech
"{9216C6A7-694A-4437-BD00-BD1CF58E1839}" = CCC Help Spanish
"{92DE68CE-BC3E-7323-EA53-99490C8BD34D}" = Catalyst Control Center Graphics Light
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9668AE11-E05C-8169-F6D8-FBF7B507D7DB}" = CCC Help German
"{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}" = TOSHIBA Application Installer
"{979587FD-F264-3C71-B0BE-6FC8DA993790}" = CCC Help Thai
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}" = TOSHIBA Media Controller
"{999307CD-D57D-8C98-27ED-07F384ACFAA1}" = CCC Help Turkish
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A7594D38-0B7E-BCF7-A938-1AC03A6477FB}" = CCC Help English
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC6569FA-6919-442A-8552-073BE69E247A}" = TOSHIBA Service Station
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.2
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AC7BE07B-14D3-6EB5-814A-EB0A63CBFB47}" = CCC Help Polish
"{B1CDB3C6-8DD8-4864-8589-BDFBDA033941}" = CCC Help Chinese Traditional
"{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}" = TOSHIBA eco Utility
"{BDABF8CD-7436-EC6C-DD82-439225E22557}" = CCC Help Finnish
"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Toshiba Online Backup
"{C5A15C68-0DF3-8A13-352E-E605491D7E3D}" = Catalyst Control Center InstallProxy
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C9B2F671-870B-43A0-8B9D-7DB30CEBD87E}" = DJ_SF_06_D1600_SW_Min
"{C9D8A041-2963-4B31-8FFC-1500F3DB9293}" = EpsonNet Setup 3.2
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFAE78A9-A7A4-537E-7CC0-5A794FFBF73F}" = Catalyst Control Center Core Implementation
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D19A1978-2FB2-B39A-5D30-C1EA38F788DD}" = CCC Help Danish
"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D8634D93-03DD-01F1-AC7D-EE468AA24F45}" = CCC Help Dutch
"{DA84ECBF-4B79-47F2-B34C-95C38484C058}" = Skype Launcher
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E151E679-4EC8-36F9-A691-C7600688A1CA}" = CCC Help Chinese Standard
"{E3D63B95-4B21-414A-A2C7-D6D6A6AC6D79}" = Catalyst Control Center - Branding
"{E487EE7D-EAAA-4E2A-9116-E3B477D8A74F}" = TOSHIBA USB Sleep and Charge Utility
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E69992ED-A7F6-406C-9280-1C156417BC49}" = TOSHIBA Quality Application
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EBC6193C-ED23-E332-9A9C-D5CB83CDDE2B}" = Catalyst Control Center Localization All
"{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F2004B8D-7791-4B35-A3FA-D8CA8BB4DD81}" = Direct DiscRecorder
"{F3529665-D75E-4D6D-98F0-745C78C68E9B}" = TOSHIBA ConfigFree
"{F544CA20-6810-E275-D288-F0D92CFADE4A}" = CCC Help Greek
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FEED29DD-7BF3-582C-3353-1F2634C2323D}" = CCC Help Portuguese
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"avast5" = avast! Free Antivirus
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"EPSON PC-FAX Driver 2" = Epson PC-FAX Driver
"EPSON Scanner" = EPSON Scan
"InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}" = DVD MovieFactory for TOSHIBA
"InstallShield_{5BCC94A1-DEF1-4AB4-8046-BC13048E929A}" = TOSHIBA ReelTime
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{89F7D66C-777D-473B-AA11-319C0F190EAC}" = TOSHIBA Internal Modem Region Select Utility
"InstallShield_{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}" = TOSHIBA eco Utility
"InstallShield_{C4FFA951-9678-4D51-84B4-AFD15D3C45AD}" = TOSHIBA Hardware Setup
"InstallShield_{CBD6B23D-41D5-4A46-8019-6208516C9712}" = TOSHIBA Supervisor Password
"InstallShield_{D1157589-296B-4AB7-A2B1-B69900C5F399}" = O2Micro Flash Memory Card Windows Driver
"InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"InstallShield_{F2004B8D-7791-4B35-A3FA-D8CA8BB4DD81}" = Direct DiscRecorder
"InstallShield_{F64684A0-754B-4637-B7F9-6E8DAA8CD5CD}" = TOSHIBA Bulletin Board
"InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"NeatWorks" = NeatWorks
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"PrimoPDF" = PrimoPDF -- by Nitro PDF Software
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"WinLiveSuite" = Windows Live Essentials

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3521119578-3847772557-2731665222-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/2/2011 8:54:25 AM | Computer Name = RobertHill-PC | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 8.0.7600.16722 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 6610 Start
Time: 01cbd8d009700feb Termination Time: 0 Application Path: C:\Program Files (x86)\Internet
Explorer\iexplore.exe Report Id:

Error - 5/25/2011 8:42:27 PM | Computer Name = RobertHill-PC | Source = MsiInstaller | ID = 11704
Description =

[ System Events ]
Error - 1/15/2011 12:20:11 AM | Computer Name = RobertHill-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 1/15/2011 12:20:21 AM | Computer Name = RobertHill-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 1/15/2011 12:20:33 AM | Computer Name = RobertHill-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 1/15/2011 12:20:41 AM | Computer Name = RobertHill-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 1/15/2011 12:20:52 AM | Computer Name = RobertHill-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 1/15/2011 12:21:04 AM | Computer Name = RobertHill-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 1/15/2011 12:21:15 AM | Computer Name = RobertHill-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 1/15/2011 12:21:24 AM | Computer Name = RobertHill-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 1/15/2011 12:21:34 AM | Computer Name = RobertHill-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 1/15/2011 12:21:47 AM | Computer Name = RobertHill-PC | Source = atikmdag | ID = 43029
Description = Display is not active


< End of report >

Hi!

No problem and no worries on bumping the thread.

OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
  
• Copy and Paste the following code into the textbox.
  

  :Services
  :OTL
  PRC - File not found -- C:\Users\Robert Hill\Local Settings\Application Data\rwvdetkr.exe
  PRC - File not found -- C:\Users\Robert Hill\Local Settings\Application Data\ejiqrgxe.exe
  O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
  O4:64bit: - HKLM..\Run: [] File not found
  O4 - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001..\Run: [Uqvjclgu] C:\Users\Robert Hill\Local Settings\Application Data\rwvdetkr.exe File not found
  O4 - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001..\Run: [WorkForce 630(Network)] File not found
  O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] File not found
  O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] File not found
  O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
  O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
  O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
  O33 - MountPoints2\{a29c0a6e-7d9c-11e0-b9ab-00269eaf51d9}\Shell - "" = AutoRun
  O33 - MountPoints2\{a29c0a6e-7d9c-11e0-b9ab-00269eaf51d9}\Shell\AutoRun\command - "" = E:\ToolLauncher-Bootstrap.exe
  O33 - MountPoints2\E\Shell - "" = AutoRun
  O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\ToolLauncher-Bootstrap.exe
  [2011/06/19 06:59:41 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{491DF868-FB8E-471F-B356-0A34045983CD}
  [2011/06/02 23:29:51 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{B045CD3D-7331-4646-9711-8B74319DA974}
  [2011/06/02 23:08:48 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{C1CA0450-4492-4FA5-8CF0-C55F72A1359D}
  [2011/06/01 23:05:34 | 000,000,000 | -H-D | C] -- C:\Users\Robert Hill\AppData\Local\30921202
  [2011/05/25 19:39:18 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{8EF76F4A-B91E-4F27-B8A1-6A64DE51C78A}
  [2011/05/20 21:44:59 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{D43D6909-7DC9-4574-93F0-770ECCF8B131}
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B3
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B2
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B1
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B0
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AF
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AE
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AD
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AC
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AB
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AA
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\918B
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\918A
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9189
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9188
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9187
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9186
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9185
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9184
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9183
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9182
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907D
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907C
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907B
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907A
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9079
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9078
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9077
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9076
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9075
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9074
  [2011/06/01 23:05:36 | 001,207,808 | -H-- | M] () -- C:\Users\Robert Hill\AppData\Local\ejiqrgxe.exe
  [2011/06/01 23:05:36 | 001,207,808 | ---- | M] () -- C:\Users\Robert Hill\AppData\Local\rwvdetkr.exe
  [2011/06/02 23:07:51 | 001,207,808 | -H-- | C] () -- C:\Users\Robert Hill\AppData\Local\ejiqrgxe.exe
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B3
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B2
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B1
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B0
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AF
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AE
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AD
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AC
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AB
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AA
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\918B
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\918A
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9189
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9188
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9187
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9186
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9185
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9184
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9183
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9182
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907D
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907C
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907B
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907A
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9079
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9078
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9077
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9076
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9075
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9074
  [2011/06/02 05:29:05 | 001,207,808 | ---- | C] () -- C:\Users\Robert Hill\AppData\Local\rwvdetkr.exe
  @Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:8BE3D058
  
  :Reg
  
  :Files
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  

  
  
• Push
  
• OTL may ask to reboot the machine. Please do so if asked.
  
• Click the OK button.
  
• A report will open. Copy and Paste that report in your next reply.
  
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:


Running TDSSKiller

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
  
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  
  
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  
  
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  
  
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  
  
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

NEXT:



Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

• Open Malwarebytes' Anti-Malware
  
• Select the Update tab
  
• Click Check for Updates
  
• After the update have been completed, Select the Scanner tab.
  
• Select Perform quick scan, then click on Scan
  
• Leave the default options as it is and click on Start Scan
  
• When done, you will be prompted. Click OK, then click on Show Results
  
• Checked (ticked) all items and click on Remove Selected
  
• After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT:



What issues are you currently experiencing with your computer?

This post has been edited by SweetTech: 19 June 2011 - 09:45 AM

I ran into a problem with the very first step. Running the OTL, I copied and pasted the log and hit the "run fix", it just sits there. I let it go for 45 minutes but nothing. The top banner states (not responding) and just the windows hour glass. I made sure I copied and pasted the whole thing as you wanted and did it again but the same thing happened. Let me know if I did something wrong or what to try next.

Please try running this script instead:

OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
  
• Copy and Paste the following code into the textbox.
  

  :Services
  :OTL
  O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
  O4:64bit: - HKLM..\Run: [] File not found
  O4 - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001..\Run: [Uqvjclgu] C:\Users\Robert Hill\Local Settings\Application Data\rwvdetkr.exe File not found
  O4 - HKU\S-1-5-21-3521119578-3847772557-2731665222-1001..\Run: [WorkForce 630(Network)] File not found
  O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] File not found
  O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] File not found
  O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
  O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
  O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
  O33 - MountPoints2\{a29c0a6e-7d9c-11e0-b9ab-00269eaf51d9}\Shell - "" = AutoRun
  O33 - MountPoints2\{a29c0a6e-7d9c-11e0-b9ab-00269eaf51d9}\Shell\AutoRun\command - "" = E:\ToolLauncher-Bootstrap.exe
  O33 - MountPoints2\E\Shell - "" = AutoRun
  O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\ToolLauncher-Bootstrap.exe
  [2011/06/19 06:59:41 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{491DF868-FB8E-471F-B356-0A34045983CD}
  [2011/06/02 23:29:51 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{B045CD3D-7331-4646-9711-8B74319DA974}
  [2011/06/02 23:08:48 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{C1CA0450-4492-4FA5-8CF0-C55F72A1359D}
  [2011/06/01 23:05:34 | 000,000,000 | -H-D | C] -- C:\Users\Robert Hill\AppData\Local\30921202
  [2011/05/25 19:39:18 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{8EF76F4A-B91E-4F27-B8A1-6A64DE51C78A}
  [2011/05/20 21:44:59 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{D43D6909-7DC9-4574-93F0-770ECCF8B131}
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B3
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B2
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B1
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91B0
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AF
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AE
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AD
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AC
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AB
  [2011/06/02 23:03:14 | 000,100,000 | ---- | M] () -- C:\Users\Public\Documents\91AA
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\918B
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\918A
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9189
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9188
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9187
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9186
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9185
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9184
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9183
  [2011/06/02 23:03:13 | 000,100,000 | ---- | M] () -- C:\ProgramData\9182
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907D
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907C
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907B
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\907A
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9079
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9078
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9077
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9076
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9075
  [2011/06/02 23:03:12 | 000,100,000 | ---- | M] () -- C:\ProgramData\9074
  [2011/06/01 23:05:36 | 001,207,808 | -H-- | M] () -- C:\Users\Robert Hill\AppData\Local\ejiqrgxe.exe
  [2011/06/01 23:05:36 | 001,207,808 | ---- | M] () -- C:\Users\Robert Hill\AppData\Local\rwvdetkr.exe
  [2011/06/02 23:07:51 | 001,207,808 | -H-- | C] () -- C:\Users\Robert Hill\AppData\Local\ejiqrgxe.exe
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B3
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B2
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B1
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91B0
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AF
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AE
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AD
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AC
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AB
  [2011/06/02 23:03:14 | 000,100,000 | ---- | C] () -- C:\Users\Public\Documents\91AA
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\918B
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\918A
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9189
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9188
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9187
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9186
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9185
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9184
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9183
  [2011/06/02 23:03:13 | 000,100,000 | ---- | C] () -- C:\ProgramData\9182
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907D
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907C
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907B
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\907A
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9079
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9078
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9077
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9076
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9075
  [2011/06/02 23:03:12 | 000,100,000 | ---- | C] () -- C:\ProgramData\9074
  [2011/06/02 05:29:05 | 001,207,808 | ---- | C] () -- C:\Users\Robert Hill\AppData\Local\rwvdetkr.exe
  @Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:8BE3D058
  
  :Reg
  
  :Files
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  

  
  
• Push
  
• OTL may ask to reboot the machine. Please do so if asked.
  
• Click the OK button.
  
• A report will open. Copy and Paste that report in your next reply.
  
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

Ok that worked. The tdsskiller and Malware Bytes didnt find anything which worries me. It did actually let me update the Malware Bytes which I couldnt do before. But anyway here they are:

OTL Fix:

========== SERVICES/DRIVERS ==========
========== OTL ==========
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3521119578-3847772557-2731665222-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Uqvjclgu deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3521119578-3847772557-2731665222-1001\Software\Microsoft\Windows\CurrentVersion\Run\\WorkForce 630(Network) deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a29c0a6e-7d9c-11e0-b9ab-00269eaf51d9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a29c0a6e-7d9c-11e0-b9ab-00269eaf51d9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a29c0a6e-7d9c-11e0-b9ab-00269eaf51d9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a29c0a6e-7d9c-11e0-b9ab-00269eaf51d9}\ not found.
File E:\ToolLauncher-Bootstrap.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
File E:\ToolLauncher-Bootstrap.exe not found.
C:\Users\Robert Hill\AppData\Local\{491DF868-FB8E-471F-B356-0A34045983CD} folder moved successfully.
C:\Users\Robert Hill\AppData\Local\{B045CD3D-7331-4646-9711-8B74319DA974} folder moved successfully.
C:\Users\Robert Hill\AppData\Local\{C1CA0450-4492-4FA5-8CF0-C55F72A1359D} folder moved successfully.
Folder move failed. C:\Users\Robert Hill\AppData\Local\30921202 scheduled to be moved on reboot.
C:\Users\Robert Hill\AppData\Local\{8EF76F4A-B91E-4F27-B8A1-6A64DE51C78A} folder moved successfully.
C:\Users\Robert Hill\AppData\Local\{D43D6909-7DC9-4574-93F0-770ECCF8B131} folder moved successfully.
C:\Users\Public\Documents\91B3 moved successfully.
C:\Users\Public\Documents\91B2 moved successfully.
C:\Users\Public\Documents\91B1 moved successfully.
C:\Users\Public\Documents\91B0 moved successfully.
C:\Users\Public\Documents\91AF moved successfully.
C:\Users\Public\Documents\91AE moved successfully.
C:\Users\Public\Documents\91AD moved successfully.
C:\Users\Public\Documents\91AC moved successfully.
C:\Users\Public\Documents\91AB moved successfully.
C:\Users\Public\Documents\91AA moved successfully.
C:\ProgramData\918B moved successfully.
C:\ProgramData\918A moved successfully.
C:\ProgramData\9189 moved successfully.
C:\ProgramData\9188 moved successfully.
C:\ProgramData\9187 moved successfully.
C:\ProgramData\9186 moved successfully.
C:\ProgramData\9185 moved successfully.
C:\ProgramData\9184 moved successfully.
C:\ProgramData\9183 moved successfully.
C:\ProgramData\9182 moved successfully.
C:\ProgramData\907D moved successfully.
C:\ProgramData\907C moved successfully.
C:\ProgramData\907B moved successfully.
C:\ProgramData\907A moved successfully.
C:\ProgramData\9079 moved successfully.
C:\ProgramData\9078 moved successfully.
C:\ProgramData\9077 moved successfully.
C:\ProgramData\9076 moved successfully.
C:\ProgramData\9075 moved successfully.
C:\ProgramData\9074 moved successfully.
C:\Users\Robert Hill\AppData\Local\ejiqrgxe.exe moved successfully.
C:\Users\Robert Hill\AppData\Local\rwvdetkr.exe moved successfully.
File C:\Users\Robert Hill\AppData\Local\ejiqrgxe.exe not found.
File C:\Users\Public\Documents\91B3 not found.
File C:\Users\Public\Documents\91B2 not found.
File C:\Users\Public\Documents\91B1 not found.
File C:\Users\Public\Documents\91B0 not found.
File C:\Users\Public\Documents\91AF not found.
File C:\Users\Public\Documents\91AE not found.
File C:\Users\Public\Documents\91AD not found.
File C:\Users\Public\Documents\91AC not found.
File C:\Users\Public\Documents\91AB not found.
File C:\Users\Public\Documents\91AA not found.
File C:\ProgramData\918B not found.
File C:\ProgramData\918A not found.
File C:\ProgramData\9189 not found.
File C:\ProgramData\9188 not found.
File C:\ProgramData\9187 not found.
File C:\ProgramData\9186 not found.
File C:\ProgramData\9185 not found.
File C:\ProgramData\9184 not found.
File C:\ProgramData\9183 not found.
File C:\ProgramData\9182 not found.
File C:\ProgramData\907D not found.
File C:\ProgramData\907C not found.
File C:\ProgramData\907B not found.
File C:\ProgramData\907A not found.
File C:\ProgramData\9079 not found.
File C:\ProgramData\9078 not found.
File C:\ProgramData\9077 not found.
File C:\ProgramData\9076 not found.
File C:\ProgramData\9075 not found.
File C:\ProgramData\9074 not found.
File C:\Users\Robert Hill\AppData\Local\rwvdetkr.exe not found.
ADS C:\ProgramData\TEMP:8BE3D058 deleted successfully.
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Robert Hill\Desktop\cmd.bat deleted successfully.
C:\Users\Robert Hill\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
HOSTS file reset successfully
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.24.1 log created on 06202011_194548

Files\Folders moved on Reboot...
C:\Users\Robert Hill\AppData\Local\30921202 folder moved successfully.

Registry entries deleted on Reboot...



tdsskiller:

2011/06/20 19:51:03.0819 3104 TDSS rootkit removing tool 2.5.4.0 Jun 7 2011 17:31:48
2011/06/20 19:51:03.0835 3104 ================================================================================
2011/06/20 19:51:03.0835 3104 SystemInfo:
2011/06/20 19:51:03.0835 3104
2011/06/20 19:51:03.0835 3104 OS Version: 6.1.7600 ServicePack: 0.0
2011/06/20 19:51:03.0835 3104 Product type: Workstation
2011/06/20 19:51:03.0835 3104 ComputerName: ROBERTHILL-PC
2011/06/20 19:51:03.0835 3104 UserName: Robert Hill
2011/06/20 19:51:03.0835 3104 Windows directory: C:\windows
2011/06/20 19:51:03.0835 3104 System windows directory: C:\windows
2011/06/20 19:51:03.0835 3104 Running under WOW64
2011/06/20 19:51:03.0835 3104 Processor architecture: Intel x64
2011/06/20 19:51:03.0835 3104 Number of processors: 2
2011/06/20 19:51:03.0835 3104 Page size: 0x1000
2011/06/20 19:51:03.0835 3104 Boot type: Normal boot
2011/06/20 19:51:03.0835 3104 ================================================================================
2011/06/20 19:51:06.0315 3104 Initialize success
2011/06/20 19:51:24.0770 4248 ================================================================================
2011/06/20 19:51:24.0770 4248 Scan started
2011/06/20 19:51:24.0770 4248 Mode: Manual;
2011/06/20 19:51:24.0770 4248 ================================================================================
2011/06/20 19:51:27.0547 4248 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\windows\system32\DRIVERS\1394ohci.sys
2011/06/20 19:51:27.0578 4248 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\windows\system32\DRIVERS\ACPI.sys
2011/06/20 19:51:27.0718 4248 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\windows\system32\DRIVERS\acpipmi.sys
2011/06/20 19:51:27.0796 4248 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\windows\system32\DRIVERS\adp94xx.sys
2011/06/20 19:51:27.0921 4248 adpahci (597f78224ee9224ea1a13d6350ced962) C:\windows\system32\DRIVERS\adpahci.sys
2011/06/20 19:51:28.0062 4248 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\windows\system32\DRIVERS\adpu320.sys
2011/06/20 19:51:28.0108 4248 AFD (b9384e03479d2506bc924c16a3db87bc) C:\windows\system32\drivers\afd.sys
2011/06/20 19:51:28.0296 4248 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\windows\system32\DRIVERS\agp440.sys
2011/06/20 19:51:28.0374 4248 aliide (5812713a477a3ad7363c7438ca2ee038) C:\windows\system32\DRIVERS\aliide.sys
2011/06/20 19:51:28.0467 4248 amdide (1ff8b4431c353ce385c875f194924c0c) C:\windows\system32\DRIVERS\amdide.sys
2011/06/20 19:51:28.0623 4248 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\windows\system32\DRIVERS\amdk8.sys
2011/06/20 19:51:28.0826 4248 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\windows\system32\DRIVERS\amdppm.sys
2011/06/20 19:51:29.0060 4248 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\windows\system32\drivers\amdsata.sys
2011/06/20 19:51:29.0294 4248 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\windows\system32\DRIVERS\amdsbs.sys
2011/06/20 19:51:29.0466 4248 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\windows\system32\drivers\amdxata.sys
2011/06/20 19:51:29.0824 4248 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\windows\system32\drivers\appid.sys
2011/06/20 19:51:30.0214 4248 arc (c484f8ceb1717c540242531db7845c4e) C:\windows\system32\DRIVERS\arc.sys
2011/06/20 19:51:30.0511 4248 arcsas (019af6924aefe7839f61c830227fe79c) C:\windows\system32\DRIVERS\arcsas.sys
2011/06/20 19:51:30.0667 4248 aswFsBlk (6923740db573b46fdda13e1df412c577) C:\windows\system32\drivers\aswFsBlk.sys
2011/06/20 19:51:31.0057 4248 aswMonFlt (de001b988b58bfd453f667842655b22e) C:\windows\system32\drivers\aswMonFlt.sys
2011/06/20 19:51:31.0306 4248 aswRdr (e0d1002d7fa65dd023788b17f714e682) C:\windows\system32\drivers\aswRdr.sys
2011/06/20 19:51:31.0540 4248 aswSP (c3eafdc0f533425614430a112ba71e9a) C:\windows\system32\drivers\aswSP.sys
2011/06/20 19:51:31.0728 4248 aswTdi (0226ffbc420d8fb67ba3b9dbdd1f2dca) C:\windows\system32\drivers\aswTdi.sys
2011/06/20 19:51:31.0884 4248 AsyncMac (769765ce2cc62867468cea93969b2242) C:\windows\system32\DRIVERS\asyncmac.sys
2011/06/20 19:51:31.0930 4248 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\windows\system32\DRIVERS\atapi.sys
2011/06/20 19:51:32.0554 4248 atikmdag (173f4c05f87085e9bda3f7037bc9f40e) C:\windows\system32\DRIVERS\atikmdag.sys
2011/06/20 19:51:33.0022 4248 AtiPcie (7c5d273e29dcc5505469b299c6f29163) C:\windows\system32\DRIVERS\AtiPcie.sys
2011/06/20 19:51:33.0303 4248 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\windows\system32\DRIVERS\bxvbda.sys
2011/06/20 19:51:33.0600 4248 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\windows\system32\DRIVERS\b57nd60a.sys
2011/06/20 19:51:33.0896 4248 Beep (16a47ce2decc9b099349a5f840654746) C:\windows\system32\drivers\Beep.sys
2011/06/20 19:51:34.0099 4248 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\windows\system32\DRIVERS\blbdrive.sys
2011/06/20 19:51:34.0582 4248 bowser (19d20159708e152267e53b66677a4995) C:\windows\system32\DRIVERS\bowser.sys
2011/06/20 19:51:34.0770 4248 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\windows\system32\DRIVERS\BrFiltLo.sys
2011/06/20 19:51:34.0785 4248 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\windows\system32\DRIVERS\BrFiltUp.sys
2011/06/20 19:51:34.0894 4248 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\windows\System32\Drivers\Brserid.sys
2011/06/20 19:51:35.0175 4248 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\windows\System32\Drivers\BrSerWdm.sys
2011/06/20 19:51:35.0347 4248 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\windows\System32\Drivers\BrUsbMdm.sys
2011/06/20 19:51:35.0409 4248 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\windows\System32\Drivers\BrUsbSer.sys
2011/06/20 19:51:35.0565 4248 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\windows\system32\DRIVERS\bthmodem.sys
2011/06/20 19:51:35.0752 4248 CAXHWAZL (d1787e11c6a0078ddeaf8cf3ee2ab293) C:\windows\system32\DRIVERS\CAXHWAZL.sys
2011/06/20 19:51:35.0893 4248 cdfs (b8bd2bb284668c84865658c77574381a) C:\windows\system32\DRIVERS\cdfs.sys
2011/06/20 19:51:36.0018 4248 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\windows\system32\DRIVERS\cdrom.sys
2011/06/20 19:51:36.0174 4248 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\windows\system32\DRIVERS\circlass.sys
2011/06/20 19:51:36.0267 4248 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\windows\system32\CLFS.sys
2011/06/20 19:51:36.0439 4248 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\windows\system32\DRIVERS\CmBatt.sys
2011/06/20 19:51:36.0486 4248 cmdide (e19d3f095812725d88f9001985b94edd) C:\windows\system32\DRIVERS\cmdide.sys
2011/06/20 19:51:36.0595 4248 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\windows\system32\Drivers\cng.sys
2011/06/20 19:51:36.0798 4248 CnxtHdAudService (3cb10294f7a59fd22501f4bad915f250) C:\windows\system32\drivers\CHDRT64.sys
2011/06/20 19:51:36.0922 4248 Compbatt (102de219c3f61415f964c88e9085ad14) C:\windows\system32\DRIVERS\compbatt.sys
2011/06/20 19:51:36.0985 4248 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\windows\system32\DRIVERS\CompositeBus.sys
2011/06/20 19:51:37.0110 4248 crcdisk (1c827878a998c18847245fe1f34ee597) C:\windows\system32\DRIVERS\crcdisk.sys
2011/06/20 19:51:37.0281 4248 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\windows\system32\Drivers\dfsc.sys
2011/06/20 19:51:37.0468 4248 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\windows\system32\drivers\discache.sys
2011/06/20 19:51:37.0702 4248 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\windows\system32\DRIVERS\disk.sys
2011/06/20 19:51:37.0843 4248 Dot4 (b42ed0320c6e41102fde0005154849bb) C:\windows\system32\DRIVERS\Dot4.sys
2011/06/20 19:51:37.0905 4248 Dot4Print (85135ad27e79b689335c08167d917cde) C:\windows\system32\DRIVERS\Dot4Prt.sys
2011/06/20 19:51:37.0999 4248 dot4usb (fd05a02b0370bc3000f402e543ca5814) C:\windows\system32\DRIVERS\dot4usb.sys
2011/06/20 19:51:38.0077 4248 drmkaud (9b19f34400d24df84c858a421c205754) C:\windows\system32\drivers\drmkaud.sys
2011/06/20 19:51:38.0248 4248 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\windows\System32\drivers\dxgkrnl.sys
2011/06/20 19:51:38.0436 4248 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\windows\system32\DRIVERS\evbda.sys
2011/06/20 19:51:38.0685 4248 elxstor (0e5da5369a0fcaea12456dd852545184) C:\windows\system32\DRIVERS\elxstor.sys
2011/06/20 19:51:38.0732 4248 ErrDev (34a3c54752046e79a126e15c51db409b) C:\windows\system32\DRIVERS\errdev.sys
2011/06/20 19:51:38.0779 4248 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\windows\system32\drivers\exfat.sys
2011/06/20 19:51:38.0919 4248 fastfat (0adc83218b66a6db380c330836f3e36d) C:\windows\system32\drivers\fastfat.sys
2011/06/20 19:51:39.0028 4248 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\windows\system32\DRIVERS\fdc.sys
2011/06/20 19:51:39.0106 4248 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\windows\system32\drivers\fileinfo.sys
2011/06/20 19:51:39.0200 4248 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\windows\system32\drivers\filetrace.sys
2011/06/20 19:51:39.0247 4248 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\windows\system32\DRIVERS\flpydisk.sys
2011/06/20 19:51:39.0387 4248 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\windows\system32\drivers\fltmgr.sys
2011/06/20 19:51:39.0512 4248 FsDepends (d43703496149971890703b4b1b723eac) C:\windows\system32\drivers\FsDepends.sys
2011/06/20 19:51:39.0574 4248 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\windows\system32\drivers\Fs_Rec.sys
2011/06/20 19:51:39.0746 4248 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\windows\system32\DRIVERS\fvevol.sys
2011/06/20 19:51:39.0855 4248 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\windows\system32\DRIVERS\gagp30kx.sys
2011/06/20 19:51:40.0120 4248 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\windows\system32\drivers\hcw85cir.sys
2011/06/20 19:51:40.0214 4248 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\windows\system32\drivers\HdAudio.sys
2011/06/20 19:51:40.0276 4248 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\windows\system32\DRIVERS\HDAudBus.sys
2011/06/20 19:51:40.0308 4248 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\windows\system32\DRIVERS\HidBatt.sys
2011/06/20 19:51:40.0386 4248 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\windows\system32\DRIVERS\hidbth.sys
2011/06/20 19:51:40.0432 4248 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\windows\system32\DRIVERS\hidir.sys
2011/06/20 19:51:40.0510 4248 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\windows\system32\DRIVERS\hidusb.sys
2011/06/20 19:51:40.0635 4248 HpSAMD (0886d440058f203eba0e1825e4355914) C:\windows\system32\DRIVERS\HpSAMD.sys
2011/06/20 19:51:40.0807 4248 HSF_DPV (26c5d00321937e49b6bc91029947d094) C:\windows\system32\DRIVERS\CAX_DPV.sys
2011/06/20 19:51:41.0088 4248 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\windows\system32\drivers\HTTP.sys
2011/06/20 19:51:41.0212 4248 hwpolicy (f17766a19145f111856378df337a5d79) C:\windows\system32\drivers\hwpolicy.sys
2011/06/20 19:51:41.0322 4248 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\windows\system32\DRIVERS\i8042prt.sys
2011/06/20 19:51:41.0400 4248 iaStorV (b75e45c564e944a2657167d197ab29da) C:\windows\system32\drivers\iaStorV.sys
2011/06/20 19:51:41.0540 4248 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\windows\system32\DRIVERS\iirsp.sys
2011/06/20 19:51:41.0587 4248 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\windows\system32\DRIVERS\intelide.sys
2011/06/20 19:51:41.0805 4248 intelppm (ada036632c664caa754079041cf1f8c1) C:\windows\system32\DRIVERS\intelppm.sys
2011/06/20 19:51:42.0055 4248 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\windows\system32\DRIVERS\ipfltdrv.sys
2011/06/20 19:51:42.0367 4248 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\windows\system32\DRIVERS\IPMIDrv.sys
2011/06/20 19:51:42.0648 4248 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\windows\system32\drivers\ipnat.sys
2011/06/20 19:51:42.0928 4248 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\windows\system32\drivers\irenum.sys
2011/06/20 19:51:43.0194 4248 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\windows\system32\DRIVERS\isapnp.sys
2011/06/20 19:51:43.0412 4248 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\windows\system32\DRIVERS\msiscsi.sys
2011/06/20 19:51:43.0771 4248 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\windows\system32\DRIVERS\kbdclass.sys
2011/06/20 19:51:44.0161 4248 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\windows\system32\DRIVERS\kbdhid.sys
2011/06/20 19:51:44.0956 4248 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\windows\system32\Drivers\ksecdd.sys
2011/06/20 19:51:46.0329 4248 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\windows\system32\Drivers\ksecpkg.sys
2011/06/20 19:51:46.0969 4248 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\windows\system32\drivers\ksthunk.sys
2011/06/20 19:51:47.0858 4248 L1C (2377ec4cc3e356655b996f39b43486b6) C:\windows\system32\DRIVERS\L1C62x64.sys
2011/06/20 19:51:48.0248 4248 lltdio (1538831cf8ad2979a04c423779465827) C:\windows\system32\DRIVERS\lltdio.sys
2011/06/20 19:51:48.0451 4248 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\windows\system32\DRIVERS\lsi_fc.sys
2011/06/20 19:51:48.0544 4248 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\windows\system32\DRIVERS\lsi_sas.sys
2011/06/20 19:51:48.0576 4248 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\windows\system32\DRIVERS\lsi_sas2.sys
2011/06/20 19:51:48.0716 4248 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\windows\system32\DRIVERS\lsi_scsi.sys
2011/06/20 19:51:48.0763 4248 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\windows\system32\drivers\luafv.sys
2011/06/20 19:51:48.0903 4248 mdmxsdk (e4f44ec214b3e381e1fc844a02926666) C:\windows\system32\DRIVERS\mdmxsdk.sys
2011/06/20 19:51:48.0934 4248 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\windows\system32\DRIVERS\megasas.sys
2011/06/20 19:51:49.0044 4248 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\windows\system32\DRIVERS\MegaSR.sys
2011/06/20 19:51:49.0106 4248 Modem (800ba92f7010378b09f9ed9270f07137) C:\windows\system32\drivers\modem.sys
2011/06/20 19:51:49.0215 4248 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\windows\system32\DRIVERS\monitor.sys
2011/06/20 19:51:49.0278 4248 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\windows\system32\DRIVERS\mouclass.sys
2011/06/20 19:51:49.0418 4248 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\windows\system32\DRIVERS\mouhid.sys
2011/06/20 19:51:49.0465 4248 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\windows\system32\drivers\mountmgr.sys
2011/06/20 19:51:49.0543 4248 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\windows\system32\DRIVERS\mpio.sys
2011/06/20 19:51:49.0590 4248 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\windows\system32\drivers\mpsdrv.sys
2011/06/20 19:51:49.0746 4248 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\windows\system32\drivers\mrxdav.sys
2011/06/20 19:51:49.0808 4248 mrxsmb (b7f3d2c40bdf8ffb73ebfb19c77734e2) C:\windows\system32\DRIVERS\mrxsmb.sys
2011/06/20 19:51:49.0948 4248 mrxsmb10 (86c6f88b5168ce21cf8d69d0b3ff5d19) C:\windows\system32\DRIVERS\mrxsmb10.sys
2011/06/20 19:51:50.0089 4248 mrxsmb20 (b081069251c8e9f42cb8769d07148f9c) C:\windows\system32\DRIVERS\mrxsmb20.sys
2011/06/20 19:51:50.0214 4248 msahci (5c37497276e3b3a5488b23a326a754b7) C:\windows\system32\DRIVERS\msahci.sys
2011/06/20 19:51:50.0245 4248 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\windows\system32\DRIVERS\msdsm.sys
2011/06/20 19:51:50.0354 4248 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\windows\system32\drivers\Msfs.sys
2011/06/20 19:51:50.0385 4248 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\windows\System32\drivers\mshidkmdf.sys
2011/06/20 19:51:50.0463 4248 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\windows\system32\DRIVERS\msisadrv.sys
2011/06/20 19:51:50.0604 4248 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\windows\system32\drivers\MSKSSRV.sys
2011/06/20 19:51:50.0744 4248 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\windows\system32\drivers\MSPCLOCK.sys
2011/06/20 19:51:50.0775 4248 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\windows\system32\drivers\MSPQM.sys
2011/06/20 19:51:50.0822 4248 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\windows\system32\drivers\MsRPC.sys
2011/06/20 19:51:50.0900 4248 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\windows\system32\DRIVERS\mssmbios.sys
2011/06/20 19:51:50.0962 4248 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\windows\system32\drivers\MSTEE.sys
2011/06/20 19:51:51.0040 4248 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\windows\system32\DRIVERS\MTConfig.sys
2011/06/20 19:51:51.0087 4248 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\windows\system32\Drivers\mup.sys
2011/06/20 19:51:51.0212 4248 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\windows\system32\DRIVERS\nwifi.sys
2011/06/20 19:51:51.0337 4248 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\windows\system32\drivers\ndis.sys
2011/06/20 19:51:51.0462 4248 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\windows\system32\DRIVERS\ndiscap.sys
2011/06/20 19:51:51.0508 4248 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\windows\system32\DRIVERS\ndistapi.sys
2011/06/20 19:51:51.0602 4248 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\windows\system32\DRIVERS\ndisuio.sys
2011/06/20 19:51:51.0649 4248 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\windows\system32\DRIVERS\ndiswan.sys
2011/06/20 19:51:51.0742 4248 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\windows\system32\drivers\NDProxy.sys
2011/06/20 19:51:51.0914 4248 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\windows\system32\DRIVERS\netbios.sys
2011/06/20 19:51:51.0945 4248 NetBT (9162b273a44ab9dce5b44362731d062a) C:\windows\system32\DRIVERS\netbt.sys
2011/06/20 19:51:52.0070 4248 nfrd960 (77889813be4d166cdab78ddba990da92) C:\windows\system32\DRIVERS\nfrd960.sys
2011/06/20 19:51:52.0132 4248 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\windows\system32\drivers\Npfs.sys
2011/06/20 19:51:52.0226 4248 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\windows\system32\drivers\nsiproxy.sys
2011/06/20 19:51:52.0398 4248 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\windows\system32\drivers\Ntfs.sys
2011/06/20 19:51:52.0522 4248 NuidFltr (d4012918d3a3847b44b888d56bc095d6) C:\windows\system32\DRIVERS\NuidFltr.sys
2011/06/20 19:51:52.0569 4248 Null (9899284589f75fa8724ff3d16aed75c1) C:\windows\system32\drivers\Null.sys
2011/06/20 19:51:52.0710 4248 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\windows\system32\drivers\nvraid.sys
2011/06/20 19:51:52.0741 4248 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\windows\system32\drivers\nvstor.sys
2011/06/20 19:51:52.0897 4248 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\windows\system32\DRIVERS\nv_agp.sys
2011/06/20 19:51:53.0006 4248 O2MDGRDR (ab0625a70dc664dc232697b53ad12334) C:\windows\system32\DRIVERS\o2mdgx64.sys
2011/06/20 19:51:53.0053 4248 O2SDGRDR (fa1eed3a10992eba9a39172b50346434) C:\windows\system32\DRIVERS\o2sdgx64.sys
2011/06/20 19:51:53.0162 4248 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\windows\system32\DRIVERS\ohci1394.sys
2011/06/20 19:51:53.0334 4248 Parport (0086431c29c35be1dbc43f52cc273887) C:\windows\system32\DRIVERS\parport.sys
2011/06/20 19:51:53.0380 4248 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\windows\system32\drivers\partmgr.sys
2011/06/20 19:51:53.0474 4248 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\windows\system32\DRIVERS\pci.sys
2011/06/20 19:51:53.0599 4248 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\windows\system32\DRIVERS\pciide.sys
2011/06/20 19:51:53.0677 4248 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\windows\system32\DRIVERS\pcmcia.sys
2011/06/20 19:51:53.0786 4248 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\windows\system32\drivers\pcw.sys
2011/06/20 19:51:53.0817 4248 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\windows\system32\drivers\peauth.sys
2011/06/20 19:51:53.0958 4248 PGEffect (663962900e7fea522126ba287715bb4a) C:\windows\system32\DRIVERS\pgeffect.sys
2011/06/20 19:51:54.0270 4248 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\windows\system32\DRIVERS\raspptp.sys
2011/06/20 19:51:54.0426 4248 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\windows\system32\DRIVERS\processr.sys
2011/06/20 19:51:54.0675 4248 Psched (ee992183bd8eaefd9973f352e587a299) C:\windows\system32\DRIVERS\pacer.sys
2011/06/20 19:51:54.0738 4248 QIOMem (c8fcb4899f8b70cc34e0d9876a80963c) C:\windows\system32\DRIVERS\QIOMem.sys
2011/06/20 19:51:54.0925 4248 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\windows\system32\DRIVERS\ql2300.sys
2011/06/20 19:51:55.0112 4248 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\windows\system32\DRIVERS\ql40xx.sys
2011/06/20 19:51:55.0237 4248 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\windows\system32\drivers\qwavedrv.sys
2011/06/20 19:51:55.0299 4248 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\windows\system32\DRIVERS\rasacd.sys
2011/06/20 19:51:55.0393 4248 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\windows\system32\DRIVERS\AgileVpn.sys
2011/06/20 19:51:55.0455 4248 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\windows\system32\DRIVERS\rasl2tp.sys
2011/06/20 19:51:55.0611 4248 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\windows\system32\DRIVERS\raspppoe.sys
2011/06/20 19:51:55.0736 4248 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\windows\system32\DRIVERS\rassstp.sys
2011/06/20 19:51:55.0783 4248 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\windows\system32\DRIVERS\rdbss.sys
2011/06/20 19:51:55.0908 4248 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\windows\system32\DRIVERS\rdpbus.sys
2011/06/20 19:51:55.0939 4248 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\windows\system32\DRIVERS\RDPCDD.sys
2011/06/20 19:51:56.0001 4248 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\windows\system32\drivers\rdpencdd.sys
2011/06/20 19:51:56.0110 4248 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\windows\system32\drivers\rdprefmp.sys
2011/06/20 19:51:56.0220 4248 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\windows\system32\drivers\RDPWD.sys
2011/06/20 19:51:56.0391 4248 rdyboost (634b9a2181d98f15941236886164ec8b) C:\windows\system32\drivers\rdyboost.sys
2011/06/20 19:51:56.0563 4248 RimVSerPort (c903d49655b4aae46673f0aaa6be0f58) C:\windows\system32\DRIVERS\RimSerial_AMD64.sys
2011/06/20 19:51:56.0672 4248 ROOTMODEM (388d3dd1a6457280f3badba9f3acd6b1) C:\windows\system32\Drivers\RootMdm.sys
2011/06/20 19:51:56.0750 4248 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\windows\system32\DRIVERS\rspndr.sys
2011/06/20 19:51:56.0953 4248 rtl8192se (a9ede191b5478d18f0a1bff3b822f7a5) C:\windows\system32\DRIVERS\rtl8192se.sys
2011/06/20 19:51:57.0124 4248 SASDIFSV (99df79c258b3342b6c8a5f802998de56) C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
2011/06/20 19:51:57.0202 4248 SASKUTIL (2859c35c0651e8eb0d86d48e740388f2) C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
2011/06/20 19:51:57.0312 4248 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\windows\system32\DRIVERS\sbp2port.sys
2011/06/20 19:51:57.0358 4248 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\windows\system32\DRIVERS\scfilter.sys
2011/06/20 19:51:57.0483 4248 sdbus (54e47ad086782d3ae9417c155cdceb9b) C:\windows\system32\DRIVERS\sdbus.sys
2011/06/20 19:51:57.0546 4248 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\windows\system32\drivers\secdrv.sys
2011/06/20 19:51:57.0639 4248 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\windows\system32\DRIVERS\serenum.sys
2011/06/20 19:51:57.0686 4248 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\windows\system32\DRIVERS\serial.sys
2011/06/20 19:51:57.0748 4248 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\windows\system32\DRIVERS\sermouse.sys
2011/06/20 19:51:57.0826 4248 sffdisk (a554811bcd09279536440c964ae35bbf) C:\windows\system32\DRIVERS\sffdisk.sys
2011/06/20 19:51:57.0889 4248 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\windows\system32\DRIVERS\sffp_mmc.sys
2011/06/20 19:51:57.0982 4248 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\windows\system32\DRIVERS\sffp_sd.sys
2011/06/20 19:51:58.0060 4248 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\windows\system32\DRIVERS\sfloppy.sys
2011/06/20 19:51:58.0138 4248 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\windows\system32\DRIVERS\SiSRaid2.sys
2011/06/20 19:51:58.0232 4248 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\windows\system32\DRIVERS\sisraid4.sys
2011/06/20 19:51:58.0310 4248 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\windows\system32\DRIVERS\smb.sys
2011/06/20 19:51:58.0482 4248 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\windows\system32\drivers\spldr.sys
2011/06/20 19:51:58.0684 4248 srv (148d50904d2a0df29a19778715eb35bb) C:\windows\system32\DRIVERS\srv.sys
2011/06/20 19:51:58.0747 4248 srv2 (ce2189fe31d36678ac9eb7ddee08ec96) C:\windows\system32\DRIVERS\srv2.sys
2011/06/20 19:51:58.0856 4248 SrvHsfHDA (0c4540311e11664b245a263e1154cef8) C:\windows\system32\DRIVERS\VSTAZL6.SYS
2011/06/20 19:51:58.0934 4248 SrvHsfV92 (02071d207a9858fbe3a48cbfd59c4a04) C:\windows\system32\DRIVERS\VSTDPV6.SYS
2011/06/20 19:51:59.0106 4248 SrvHsfWinac (18e40c245dbfaf36fd0134a7ef2df396) C:\windows\system32\DRIVERS\VSTCNXT6.SYS
2011/06/20 19:51:59.0215 4248 srvnet (cb69edeb069a49577592835659cd0e46) C:\windows\system32\DRIVERS\srvnet.sys
2011/06/20 19:51:59.0308 4248 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\windows\system32\DRIVERS\stexstor.sys
2011/06/20 19:51:59.0340 4248 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\windows\system32\DRIVERS\swenum.sys
2011/06/20 19:51:59.0480 4248 SynTP (12a35e44d8647985fcdb8d298a590134) C:\windows\system32\DRIVERS\SynTP.sys
2011/06/20 19:51:59.0761 4248 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\windows\system32\drivers\tcpip.sys
2011/06/20 19:52:00.0010 4248 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\windows\system32\DRIVERS\tcpip.sys
2011/06/20 19:52:00.0151 4248 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\windows\system32\drivers\tcpipreg.sys
2011/06/20 19:52:00.0291 4248 tdcmdpst (fd542b661bd22fa69ca789ad0ac58c29) C:\windows\system32\DRIVERS\tdcmdpst.sys
2011/06/20 19:52:00.0354 4248 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\windows\system32\drivers\tdpipe.sys
2011/06/20 19:52:00.0432 4248 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\windows\system32\drivers\tdtcp.sys
2011/06/20 19:52:00.0478 4248 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\windows\system32\DRIVERS\tdx.sys
2011/06/20 19:52:00.0494 4248 TermDD (c448651339196c0e869a355171875522) C:\windows\system32\DRIVERS\termdd.sys
2011/06/20 19:52:00.0619 4248 Thpdrv (c013f6acaa9761f571bd28dada7c157d) C:\windows\system32\DRIVERS\thpdrv.sys
2011/06/20 19:52:00.0681 4248 Thpevm (b4e609047434ed948af7bdef2fa66e38) C:\windows\system32\DRIVERS\Thpevm.SYS
2011/06/20 19:52:00.0868 4248 tos_sps64 (09ff7b0b1b5c3d225495cb6f5a9b39f8) C:\windows\system32\DRIVERS\tos_sps64.sys
2011/06/20 19:52:01.0024 4248 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\windows\system32\DRIVERS\tssecsrv.sys
2011/06/20 19:52:01.0071 4248 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\windows\system32\DRIVERS\tunnel.sys
2011/06/20 19:52:01.0196 4248 TVALZ (550b567f9364d8f7684c3fb3ea665a72) C:\windows\system32\DRIVERS\TVALZ_O.SYS
2011/06/20 19:52:01.0258 4248 TVALZFL (9c7191f4b2e49bff47a6c1144b5923fa) C:\windows\system32\DRIVERS\TVALZFL.sys
2011/06/20 19:52:01.0383 4248 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\windows\system32\DRIVERS\uagp35.sys
2011/06/20 19:52:01.0539 4248 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\windows\system32\DRIVERS\udfs.sys
2011/06/20 19:52:01.0648 4248 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\windows\system32\DRIVERS\uliagpkx.sys
2011/06/20 19:52:01.0695 4248 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\windows\system32\DRIVERS\umbus.sys
2011/06/20 19:52:01.0742 4248 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\windows\system32\DRIVERS\umpass.sys
2011/06/20 19:52:01.0882 4248 usbccgp (7b6a127c93ee590e4d79a5f2a76fe46f) C:\windows\system32\DRIVERS\usbccgp.sys
2011/06/20 19:52:01.0992 4248 usbcir (af0892a803fdda7492f595368e3b68e7) C:\windows\system32\DRIVERS\usbcir.sys
2011/06/20 19:52:02.0070 4248 usbehci (92969ba5ac44e229c55a332864f79677) C:\windows\system32\DRIVERS\usbehci.sys
2011/06/20 19:52:02.0194 4248 usbhub (e7df1cfd28ca86b35ef5add0735ceef3) C:\windows\system32\DRIVERS\usbhub.sys
2011/06/20 19:52:02.0319 4248 usbohci (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\windows\system32\DRIVERS\usbohci.sys
2011/06/20 19:52:02.0382 4248 usbprint (73188f58fb384e75c4063d29413cee3d) C:\windows\system32\DRIVERS\usbprint.sys
2011/06/20 19:52:02.0444 4248 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\windows\system32\DRIVERS\usbscan.sys
2011/06/20 19:52:02.0553 4248 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\windows\system32\DRIVERS\USBSTOR.SYS
2011/06/20 19:52:02.0616 4248 usbuhci (bc3070350a491d84b518d7cca9abd36f) C:\windows\system32\drivers\usbuhci.sys
2011/06/20 19:52:02.0772 4248 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\windows\System32\Drivers\usbvideo.sys
2011/06/20 19:52:02.0834 4248 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\windows\system32\DRIVERS\vdrvroot.sys
2011/06/20 19:52:03.0006 4248 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\windows\system32\DRIVERS\vgapnp.sys
2011/06/20 19:52:03.0208 4248 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\windows\System32\drivers\vga.sys
2011/06/20 19:52:03.0302 4248 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\windows\system32\DRIVERS\vhdmp.sys
2011/06/20 19:52:03.0396 4248 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\windows\system32\DRIVERS\viaide.sys
2011/06/20 19:52:03.0505 4248 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\windows\system32\DRIVERS\volmgr.sys
2011/06/20 19:52:03.0583 4248 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\windows\system32\drivers\volmgrx.sys
2011/06/20 19:52:03.0723 4248 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\windows\system32\DRIVERS\volsnap.sys
2011/06/20 19:52:03.0770 4248 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\windows\system32\DRIVERS\vsmraid.sys
2011/06/20 19:52:03.0973 4248 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\windows\system32\DRIVERS\vwifibus.sys
2011/06/20 19:52:04.0191 4248 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\windows\system32\DRIVERS\vwififlt.sys
2011/06/20 19:52:04.0316 4248 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\windows\system32\DRIVERS\wacompen.sys
2011/06/20 19:52:04.0425 4248 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys
2011/06/20 19:52:04.0456 4248 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys
2011/06/20 19:52:04.0628 4248 Wd (72889e16ff12ba0f235467d6091b17dc) C:\windows\system32\DRIVERS\wd.sys
2011/06/20 19:52:04.0737 4248 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\windows\system32\drivers\Wdf01000.sys
2011/06/20 19:52:04.0893 4248 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\windows\system32\DRIVERS\wfplwf.sys
2011/06/20 19:52:04.0940 4248 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\windows\system32\drivers\wimmount.sys
2011/06/20 19:52:05.0080 4248 winachsf (a6ea7a3fc4b00f48535b506db1e86efd) C:\windows\system32\DRIVERS\CAX_CNXT.sys
2011/06/20 19:52:05.0221 4248 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\windows\system32\DRIVERS\WinUsb.sys
2011/06/20 19:52:05.0377 4248 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\windows\system32\DRIVERS\wmiacpi.sys
2011/06/20 19:52:05.0502 4248 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\windows\system32\drivers\ws2ifsl.sys
2011/06/20 19:52:05.0548 4248 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\windows\system32\drivers\WudfPf.sys
2011/06/20 19:52:05.0658 4248 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\windows\system32\DRIVERS\WUDFRd.sys
2011/06/20 19:52:05.0720 4248 XAudio (e8f3fa126a06f8e7088f63757112a186) C:\windows\system32\DRIVERS\XAudio64.sys
2011/06/20 19:52:05.0767 4248 MBR (0x1B8) (5b5e648d12fcadc244c1ec30318e1eb9) \Device\Harddisk0\DR0
2011/06/20 19:52:05.0782 4248 ================================================================================
2011/06/20 19:52:05.0782 4248 Scan finished
2011/06/20 19:52:05.0782 4248 ================================================================================
2011/06/20 19:52:05.0798 3264 Detected object count: 0
2011/06/20 19:52:05.0798 3264 Actual detected object count: 0


Malware Bytes:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6906

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

6/20/2011 8:13:35 PM
mbam-log-2011-06-20 (20-13-35).txt

Scan type: Quick scan
Objects scanned: 173546
Time elapsed: 7 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hi!

That's great to hear! Lets see what these two programs find:

Please be sure to let me know what issues you're experiencing in your next reply.

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the icon on your desktop.
  
  
• Check
  
• Click the button.
  
• Accept any security warnings from your browser.
  
• Check
  
• Make sure that the option "Remove found threats" is Unchecked
  
• When the Computer scan settings display shows, click the Advanced option, the place a check next to the following (if it is not already checked):
  
  • Enable Anti-Stealth technology
  
  
• Push the Start button.
  
• ESET will then download updates for itself, install itself, and begin
  scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, push
  
• Push , and save the file to your desktop using a unique name, such as
  ESETScan. Include the contents of this report in your next reply.
  
• Push the button.
  
• Push

NEXT:


Security Check
Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Ok here is where I have a problem. I still have no icons and all folders are empty. Everything I have done so far has been put on a flashdrive from a clean computer and saved or run off the flashdrive to infected computer. I still dont have any icons or know of a way to get on to this log (or the internet period) to run the item you want done. Cn you give me instructions around this? I restrted the computer and all folders are still empty, desktop only has the items that I have saved to it since me and you have been doing this

In your first post you mentioned unhide, were you able to run it on the infected computer?

Try checking these settings for the internet:

Check - Reset Proxy settings
Malware can alter your proxy settings. If altered, it can affect your ability to browse or download tools required for disinfection.

Internet Explorer Proxy settings:

• Open Internet Explorer > click Tools > Internet Options > Connections tab.
  
• Click the LAN Settings... button and uncheck "Use a proxy server for your LAN"
  or change the settings to the proxy you normally use if you previously reconfigured it.
  
• Remove any unknown addresses from the Address box. 80 is the default Port so it does not have to be changed.
  
• Click OK... then click OK again.
  
• Close Internet Explorer and -restart- the computer.
  
• An example of how to do this with screenshots can be found in steps 3-7 under the section Automated Removal Instructions... in this guide.

Firefox Proxy settings:

• Open Firefox, click Tools > Options > Advanced and click the Network Tab.
  
• Under the Connection section click on the Settings... button.
  
• Under Configure Proxies to Access the Internet, check No proxy. This is the default option if you don't use a proxy.
  
• Click OK... then click OK again.
  
• Close Firefox and -restart- the computer.

For other browsers, please refer to How to configure browser proxy settings.


NEXT:



Make sure the following setting is set as it is supposed to be set:

• Go to Start -> Control Panel -> Double click on Network Connections.
  
• Right click on your default connection (usually Local Area Connection) and select Properties.
  
• Select the General tab.
  
• Double click on Internet Protocol (TCP/IP).
  Under General tab:
  • Select "Obtain an IP address automatically".
    
  • Select "Obtain DNS server address automatically".
  
  
• Click OK twice to save the settings.
  
• Reboot if you had to change any setting.

HEre is the ESET"

C:\Users\Robert Hill\AppData\Local\Temp\wfmtald9ko1.dll Win32/Bayrob.G trojan
C:\Users\Robert Hill\AppData\Local\Temp\wfmtald9ko1.exe a variant of Win32/Kryptik.OSU trojan
C:\Users\Robert Hill\AppData\Local\Temp\wfmtald9ko2.dll Win32/Bayrob.G trojan
C:\Users\Robert Hill\AppData\Local\Temp\WFMTBMJTGAA.EXE a variant of Win32/Kryptik.OSU trojan
C:\Users\Robert Hill\AppData\Local\Temp\WFMT_WINDOWS_SECURITY_UPDATE_BMJVEHA.EXE a variant of Win32/Kryptik.OSU trojan
C:\_OTL\MovedFiles\06202011_194548\C_Users\Robert Hill\AppData\Local\ejiqrgxe.exe a variant of Win32/Kryptik.OSU trojan
C:\_OTL\MovedFiles\06202011_194548\C_Users\Robert Hill\AppData\Local\rwvdetkr.exe a variant of Win32/Kryptik.OSU trojan

And the Checkup:


Results of screen317's Security Check version 0.99.15
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
ESET Online Scanner v3
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java™ 6 Update 14
Out of date Java installed!
Adobe Flash Player
````````````````````````````````
Process Check:
objlist.exe by Laurent
Common Files Microsoft Shared Windows Live AvastSvc.exe -?-
Alwil Software Avast5 AvastUI.exe
``````````End of Log````````````

Hi!

These threat(s) below are currently in Quarantine/System Restore and shall be removed when we clean up our tools later on.

Quote

These threat(s) below will be removed very shortly:

Quote

____________________________________________________

From the looks of your SecurityCheck log, I can see that we have some outdated programs that need to be updated.

Lets address those programs that need updating now!

Java Outdated
Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.

• Microsoft: ‘Unprecedented Wave of Java Exploitation’
  
• Drive-by Trojan preying on out-of-date Java installations
  
• Ghosts of Java Haunt Users

Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  
• Look for "Java Platform, Standard Edition".
  
• Click the "Download JRE" button to the right.
  
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
  
• From the list, select your OS and Platform.
  
  • 32-bit Select: Windows x86 Offline.
    
  • 64-bit Select: Windows x64.
  
  
• If a download for an Offline Installation is available, it is recommended to choose that and save the file to your desktop.
  
• Close any programs you may have running - especially your web browser.

Go to > Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.

• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u25-windows-i586.exe to install the newest version.
  
• If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  
• When the Java Setup - Welcome window opens, click the Install > button.
  
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
  
• The McAfee Security Scan Plus tool is installed by default unless you uncheck the McAfee installation box when updating Java.

-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:

• Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
  
• Click Ok and reboot your computer.

NEXT:



OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
  
• Copy and Paste the following code into the textbox.
  

  :Services
  :OTL
  
  :Reg
  
  :Files
  C:\Users\Robert Hill\AppData\Local\Temp\wfmtald9ko1.dll
  C:\Users\Robert Hill\AppData\Local\Temp\wfmtald9ko1.exe
  C:\Users\Robert Hill\AppData\Local\Temp\wfmtald9ko2.dll
  C:\Users\Robert Hill\AppData\Local\Temp\WFMTBMJTGAA.EXE
  C:\Users\Robert Hill\AppData\Local\Temp\WFMT_WINDOWS_SECURITY_UPDATE_BMJVEHA.EXE
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  

  
  
• Push
  
• OTL may ask to reboot the machine. Please do so if asked.
  
• Click the OK button.
  
• A report will open. Copy and Paste that report in your next reply.
  
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:



OTL Custom Scan

We need to run an OTL Custom Scan

• Please reopen on your desktop.
  
• Copy and Paste the following code into the textbox.
  
  
  
  netsvcs
  drivers32
  hklm\software\clients\startmenuinternet|command /rs
  %USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  
  
  
• Push the button.
  
• A report will open. Copy and Paste that report in your next reply.

NEXT:



What outstanding issues (if any) are you still experiencing with your computer?

I completed the Jave and only had one instance in programs and I installed the one recommended.

OTL Fix:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\Users\Robert Hill\AppData\Local\Temp\wfmtald9ko1.dll not found.
File\Folder C:\Users\Robert Hill\AppData\Local\Temp\wfmtald9ko1.exe not found.
File\Folder C:\Users\Robert Hill\AppData\Local\Temp\wfmtald9ko2.dll not found.
File\Folder C:\Users\Robert Hill\AppData\Local\Temp\WFMTBMJTGAA.EXE not found.
File\Folder C:\Users\Robert Hill\AppData\Local\Temp\WFMT_WINDOWS_SECURITY_UPDATE_BMJVEHA.EXE not found.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Robert Hill\Desktop\cmd.bat deleted successfully.
C:\Users\Robert Hill\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Robert Hill
->Temp folder emptied: 601964 bytes
->Temporary Internet Files folder emptied: 3209582 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 66016 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 4.00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: Default

User: Default User

User: Public

User: Robert Hill
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.24.1 log created on 06222011_221015

Files\Folders moved on Reboot...
File\Folder C:\Users\Robert Hill\AppData\Local\Temp\OICE_DE6A1F03-21B1-40EE-88C7-09B5E994F9F1.0\173BFCD3. not found!
File\Folder C:\Users\Robert Hill\AppData\Local\Temp\OICE_76C26BAA-58E3-4AEC-A019-BF4137453EA4.0\C6F984BC. not found!
File\Folder C:\Users\Robert Hill\AppData\Local\Temp\OICE_1E3985F1-17D3-46BA-8F4F-A2EE06A49E1E.0\832F94B6. not found!
File\Folder C:\Users\Robert Hill\AppData\Local\Temp\OICE_1D8643FD-2858-4B72-8166-7BBE88FA3D73.0\8AC66678. not found!
C:\Users\Robert Hill\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Robert Hill\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Z8C1C25V\index[1].htm moved successfully.
C:\Users\Robert Hill\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Z8C1C25V\index[6].php moved successfully.
C:\Users\Robert Hill\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File move failed. C:\windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...


OTL Custom Scan:

OTL logfile created on: 6/22/2011 7:51:56 PM - Run 2
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Robert Hill\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 2.22 Gb Available Physical Memory | 59.26% Memory free
7.49 Gb Paging File | 5.67 Gb Available in Paging File | 75.61% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 454.33 Gb Total Space | 406.27 Gb Free Space | 89.42% Space Free | Partition Type: NTFS

Computer Name: ROBERTHILL-PC | User Name: Robert Hill | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found --
PRC - [2011/06/19 06:59:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Robert Hill\Desktop\OTL.exe
PRC - [2011/05/25 19:40:07 | 000,240,288 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10q_ActiveX.exe
PRC - [2011/05/13 19:34:53 | 000,307,376 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
PRC - [2011/05/10 07:10:58 | 003,459,712 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/05/10 07:10:57 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009/12/03 11:12:12 | 000,976,320 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
PRC - [2009/12/03 01:00:00 | 000,847,872 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe
PRC - [2009/07/28 23:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2009/07/14 22:10:30 | 000,042,368 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
PRC - [2009/07/13 18:24:00 | 000,304,496 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2009/03/10 21:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
PRC - [2006/12/19 19:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe


========== Modules (SafeList) ==========

MOD - [2011/06/19 06:59:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Robert Hill\Desktop\OTL.exe
MOD - [2011/05/10 07:10:55 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
MOD - [2010/08/21 00:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/05/10 07:10:57 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2010/06/29 12:49:27 | 000,128,752 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
SRV:64bit: - [2009/08/21 12:31:06 | 000,488,800 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:64bit: - [2009/08/11 19:10:48 | 000,252,272 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\TECO\TecoService.exe -- (TOSHIBA eco Utility Service)
SRV:64bit: - [2009/08/04 14:15:06 | 000,826,224 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe -- (TPCHSrv)
SRV:64bit: - [2009/08/03 21:17:56 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:64bit: - [2009/07/30 02:54:22 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/07/28 18:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/08 12:41:02 | 000,531,520 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\ThpSrv.exe -- (Thpsrv)
SRV:64bit: - [2009/07/07 12:38:24 | 000,065,904 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\rselect\RSelSvc.exe -- (RSELSVC)
SRV:64bit: - [2007/02/12 19:43:00 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Windows\SysNative\drivers\o2flash.exe -- (O2FLASH)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/08/17 13:48:42 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2009/08/10 22:55:58 | 000,248,688 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)
SRV - [2009/07/14 22:10:30 | 000,042,368 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe -- (ConfigFree Gadget Service)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/04/29 14:21:18 | 000,436,736 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\XAudio64.dll -- (HsfXAudioService)
SRV - [2009/03/10 21:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)
SRV - [2006/12/19 19:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe -- (EpsonBidirectionalService)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/05/10 06:59:48 | 000,064,344 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2011/03/11 01:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/02/17 13:23:05 | 000,014,920 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV:64bit: - [2010/02/17 13:23:05 | 000,012,360 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV:64bit: - [2009/09/07 22:42:22 | 000,073,376 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\o2mdgx64.sys -- (O2MDGRDR)
DRV:64bit: - [2009/08/26 21:11:12 | 000,942,080 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192se.sys -- (rtl8192se)
DRV:64bit: - [2009/08/18 21:41:06 | 000,049,568 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\o2sdgx64.sys -- (O2SDGRDR)
DRV:64bit: - [2009/07/30 23:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:64bit: - [2009/07/30 21:20:18 | 000,281,648 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009/07/30 15:07:12 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009/07/27 18:04:36 | 000,058,880 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20)
DRV:64bit: - [2009/07/24 18:57:08 | 000,482,384 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tos_sps64.sys -- (tos_sps64)
DRV:64bit: - [2009/07/14 18:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 19:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009/07/13 18:31:10 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2009/06/29 19:16:20 | 000,014,784 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Thpevm.sys -- (Thpevm)
DRV:64bit: - [2009/06/29 13:25:22 | 000,034,880 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\thpdrv.sys -- (Thpdrv)
DRV:64bit: - [2009/06/23 04:28:22 | 000,684,544 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2009/06/22 20:06:38 | 000,035,008 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:64bit: - [2009/06/19 22:15:22 | 000,014,472 | ---- | M] (TOSHIBA Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TVALZFL.sys -- (TVALZFL)
DRV:64bit: - [2009/06/15 16:58:00 | 000,012,800 | ---- | M] (TOSHIBA) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\QIOMem.sys -- (QIOMem)
DRV:64bit: - [2009/06/10 16:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009/06/10 16:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009/06/10 16:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/09 00:14:20 | 000,015,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr)
DRV:64bit: - [2009/05/05 03:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV:64bit: - [2009/04/29 14:21:08 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio)
DRV:64bit: - [2009/02/13 01:24:56 | 001,485,824 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV)
DRV:64bit: - [2009/02/13 01:20:56 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL)
DRV:64bit: - [2009/02/13 01:19:34 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf)
DRV:64bit: - [2009/01/09 15:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2006/06/18 09:27:24 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig?brand=TSNA&bmod=TSNA
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig?brand=TSNA&bmod=TSNA
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: ([2011/06/22 19:45:22 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg64.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [SmartFaceVWatcher] C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [ThpSrv] C:\windows\SysNative\thpsrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [EEventManager] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [FUFAXSTM] C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe (Toshiba)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TUSBSleepChargeSrv] C:\Program Files (x86)\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe (TOSHIBA)
O4 - HKLM..\Run: [TWebCamera] C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA CORPORATION.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} http://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.dvacm - C:\Program Files (x86)\Common Files\Ulead Systems\vio\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.mpegacm - C:\Program Files (x86)\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.ulmp3acm - C:\Program Files (x86)\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/22 19:28:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2011/06/22 19:28:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2011/06/22 19:27:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2011/06/22 19:21:54 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{F1335FF2-AE7C-42DD-88B3-7907557927FE}
[2011/06/22 06:07:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011/06/21 21:42:27 | 000,600,920 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswSnx.sys
[2011/06/20 22:27:23 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{EB0AADD0-2935-4F1D-830C-BD874884F2DB}
[2011/06/20 19:50:33 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{9D5F8576-8380-4661-B913-42B78F301AF1}
[2011/06/20 19:44:10 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{2B256171-D5D1-4624-9385-12EF7626C28D}
[2011/06/20 06:14:16 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{C5F6FCDF-23CC-4301-A026-4D02FAC9C252}
[2011/06/20 05:47:16 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/06/19 07:00:50 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\Robert Hill\Desktop\OTL.exe
[2011/06/11 07:26:21 | 000,607,249 | R--- | C] (Swearware) -- C:\Users\Robert Hill\Desktop\dds.scr
[2011/06/11 06:53:51 | 001,437,488 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Robert Hill\Desktop\tdsskiller.exe
[2011/05/24 23:10:47 | 000,000,000 | ---D | C] -- C:\fd79fef46c6d633f084673548344

========== Files - Modified Within 30 Days ==========

[2011/06/22 19:55:23 | 000,015,792 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/22 19:55:23 | 000,015,792 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/22 19:48:12 | 000,000,894 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/22 19:47:41 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2011/06/22 19:47:36 | 3018,608,640 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/22 19:45:22 | 000,000,098 | ---- | M] () -- C:\windows\SysNative\drivers\etc\Hosts
[2011/06/22 19:13:00 | 000,000,898 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/22 07:23:35 | 000,879,194 | ---- | M] () -- C:\Users\Robert Hill\Desktop\SecurityCheck.exe
[2011/06/22 06:02:51 | 000,001,508 | ---- | M] () -- C:\Users\Robert Hill\Desktop\iexplore - Shortcut.lnk
[2011/06/22 05:39:53 | 000,792,000 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2011/06/22 05:39:53 | 000,670,886 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2011/06/22 05:39:53 | 000,124,044 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2011/06/21 21:42:27 | 000,000,000 | ---- | M] () -- C:\windows\SysWow64\config.nt
[2011/06/20 19:56:48 | 000,001,108 | ---- | M] () -- C:\Users\Robert Hill\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/06/19 06:59:18 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\Robert Hill\Desktop\OTL.exe
[2011/06/11 08:24:42 | 000,607,249 | R--- | M] (Swearware) -- C:\Users\Robert Hill\Desktop\dds.scr
[2011/06/11 08:20:10 | 000,050,477 | ---- | M] () -- C:\Users\Robert Hill\Desktop\Defogger.exe
[2011/06/11 07:52:12 | 001,437,488 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Robert Hill\Desktop\tdsskiller.exe
[2011/06/11 07:47:20 | 001,007,120 | ---- | M] () -- C:\Users\Robert Hill\Desktop\rkill.com
[2011/06/11 07:22:40 | 000,000,000 | ---- | M] () -- C:\Users\Robert Hill\defogger_reenable
[2011/06/03 20:37:26 | 000,606,105 | ---- | M] () -- C:\Users\Robert Hill\Desktop\unhide.exe
[2011/06/03 19:45:58 | 000,001,084 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysWow64\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,025,912 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2011/06/22 07:23:28 | 000,879,194 | ---- | C] () -- C:\Users\Robert Hill\Desktop\SecurityCheck.exe
[2011/06/22 06:02:51 | 000,001,508 | ---- | C] () -- C:\Users\Robert Hill\Desktop\iexplore - Shortcut.lnk
[2011/06/22 05:39:05 | 000,606,105 | ---- | C] () -- C:\Users\Robert Hill\Desktop\unhide.exe
[2011/06/11 07:22:40 | 000,000,000 | ---- | C] () -- C:\Users\Robert Hill\defogger_reenable
[2011/06/11 07:22:11 | 000,050,477 | ---- | C] () -- C:\Users\Robert Hill\Desktop\Defogger.exe
[2011/06/11 06:53:40 | 001,007,120 | ---- | C] () -- C:\Users\Robert Hill\Desktop\rkill.com
[2011/06/03 19:45:58 | 000,001,108 | ---- | C] () -- C:\Users\Robert Hill\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/06/03 19:45:58 | 000,001,084 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/18 20:37:18 | 000,000,097 | ---- | C] () -- C:\windows\SysWow64\PICSDK.ini
[2010/12/18 20:37:17 | 000,073,220 | ---- | C] () -- C:\windows\SysWow64\EPPICPrinterDB.dat
[2010/12/18 20:37:17 | 000,031,053 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern131.dat
[2010/12/18 20:37:17 | 000,029,114 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern1.dat
[2010/12/18 20:37:17 | 000,027,417 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern121.dat
[2010/12/18 20:37:17 | 000,021,021 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern3.dat
[2010/12/18 20:37:17 | 000,015,670 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern5.dat
[2010/12/18 20:37:17 | 000,013,280 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern2.dat
[2010/12/18 20:37:17 | 000,010,673 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern4.dat
[2010/12/18 20:37:17 | 000,004,943 | ---- | C] () -- C:\windows\SysWow64\EPPICPattern6.dat
[2010/12/18 20:37:17 | 000,001,140 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_PT.dat
[2010/12/18 20:37:17 | 000,001,140 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_BP.dat
[2010/12/18 20:37:17 | 000,001,137 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_ES.dat
[2010/12/18 20:37:17 | 000,001,130 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_FR.dat
[2010/12/18 20:37:17 | 000,001,130 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_CF.dat
[2010/12/18 20:37:17 | 000,001,104 | ---- | C] () -- C:\windows\SysWow64\EPPICPresetData_EN.dat
[2010/12/18 20:26:13 | 000,000,079 | ---- | C] () -- C:\windows\EWF630.ini
[2010/08/23 20:51:59 | 000,136,542 | ---- | C] () -- C:\windows\hphins33.dat
[2010/08/23 20:51:59 | 000,000,512 | ---- | C] () -- C:\windows\hphmdl33.dat
[2010/08/23 20:39:18 | 000,136,092 | ---- | C] () -- C:\windows\hphins33.dat.temp
[2010/08/23 20:39:18 | 000,000,512 | ---- | C] () -- C:\windows\hphmdl33.dat.temp
[2010/08/20 14:29:01 | 000,139,264 | ---- | C] () -- C:\windows\SysWow64\gswin32c.exe
[2010/07/19 16:47:55 | 000,743,534 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2009/12/16 14:02:25 | 000,000,000 | ---- | C] () -- C:\windows\NDSTray.INI
[2009/12/16 13:47:18 | 000,000,000 | ---- | C] () -- C:\windows\ativpsrm.bin
[2009/07/30 20:58:42 | 000,000,326 | ---- | C] () -- C:\windows\primopdf.ini
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- C:\windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- C:\windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- C:\windows\SysWow64\mlang.dat

========== LOP Check ==========

[2010/08/26 16:06:58 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\acccore
[2010/07/21 20:13:27 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\Downloaded Installations
[2010/12/19 21:45:46 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\Epson
[2010/12/18 20:57:32 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\Leader Technologies
[2010/12/18 20:45:16 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\Leadertech
[2010/06/26 15:36:49 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\Neat
[2010/06/26 15:36:25 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\Nuance
[2011/06/02 22:53:28 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\PrimoPDF
[2010/07/19 11:02:19 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\Smith Micro
[2011/06/02 22:53:29 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\Template
[2010/05/23 22:23:16 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\Toshiba
[2010/04/29 20:04:37 | 000,000,000 | ---D | M] -- C:\Users\Robert Hill\AppData\Roaming\WinBatch
[2010/11/07 08:21:10 | 000,032,574 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2009/07/13 20:14:21 | 000,176,128 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2009/07/13 20:14:21 | 000,176,128 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2009/07/13 20:14:21 | 000,176,128 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -extoff [2011/02/24 00:32:52 | 000,673,040 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: iexplore.exe

< %USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< >

< >

< >

< >

< End of report >


Outstanding items:

All files are still showing empty, Nothing on desk top other than what you and I have put on it, all programs still show empty, A pop up box states TWIAN DATA SOURCE - propgram was unable to load needed componenent and is going to terminate.

Another thing I did not mention which I think goes along with the above when I state all folders are empty. When on the web, all my favorite folder are there but they are all empty, no links just the folders.

Hi!

To re-enable your Emulation drivers, double click DeFogger to run the tool.

• The application window will appear
• Click the Re-enable button to re-enable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.


NEXT:



OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
  
• Copy and Paste the following code into the textbox.
  

  :Services
  :OTL
  [2011/06/22 19:21:54 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{F1335FF2-AE7C-42DD-88B3-7907557927FE}
  [2011/06/20 22:27:23 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{EB0AADD0-2935-4F1D-830C-BD874884F2DB}
  [2011/06/20 19:50:33 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{9D5F8576-8380-4661-B913-42B78F301AF1}
  [2011/06/20 19:44:10 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{2B256171-D5D1-4624-9385-12EF7626C28D}
  [2011/06/20 06:14:16 | 000,000,000 | ---D | C] -- C:\Users\Robert Hill\AppData\Local\{C5F6FCDF-23CC-4301-A026-4D02FAC9C252}
  [2011/06/22 07:23:35 | 000,879,194 | ---- | M] () -- C:\Users\Robert Hill\Desktop\SecurityCheck.exe
  :Reg
  
  :Files
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  

  
  
• Push
  
• OTL may ask to reboot the machine. Please do so if asked.
  
• Click the OK button.
  
• A report will open. Copy and Paste that report in your next reply.
  
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:



You can restore the defaults for the Start Menu and Administrative Tools as follows:

• Windows 7: Restore Default Shortcuts in Start Menu All Programs
  
• Vista: Restore Default Shortcuts in Start Menu Programs
  
• Restore the Administrative Tools folder with vista_ultimate_admintools.zip

For any other missing program shortcuts you will probably need to reinstall the application or manually create new shortcuts.


NEXT:



To manually recreate "All Programs" entries, follow these steps...

• Download App Paths
  
• Double click on AppPaths.exe to run the program.
  
• Keep the program open.

In this example I'll recreate an entry for Avast antivirus program.

• Go Start>All Programs.
  
• Right click on Avast entry, click "Properties".

NOTE. Make sure, you right click on Avast program, NOT on Avast folder.

• You'll see this window:

Due to the damage caused by the infection, you'll find "Target" box empty.

• Go back to AppPaths window and find Avast entry.
  
• Right click on Avast line, click "Edit".
  
• A pop-up window will open:

• Highlight everything in "Path" box, right click on it, click "Copy"
  
• Go back to Avast "Properties" window, right click inside "Target" box, click "Paste".
  
• IMPORTANT! Add quotation marks at the beginning of the path and at the end
  
• Click OK and you're done.

In case, program's link shows as (empty):

• Open Windows Explorer, navigate to Avast folder in Program Files
  
• Right click on Avast ".exe" file, click "Create shortcut":

• Copy that shortcut, go back to Start menu.
  
• Right click on avast!Free Antivirus, click "Paste".
  
• You'll see Avast shortcut recreated replacing (empty) entry.

Alternatively....
...you paste that shortcut in:
(XP) - C:\Documents and Settings\All Users\Start Menu\Programs\Avast
(Vista/7) - C:\Program Data\Start Menu\Programs\Avast